Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings
supabase

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings

Allow configuringpgaudit.log_parameter#20183

Unanswered
xEverth asked this question inFeature Requests
Dec 21, 2023· 3 comments· 6 replies
Discussion options

pgaudit is the recommended method to log according to the docs:https://supabase.com/docs/guides/database/extensions/pgaudit
It's possible to enable logging (for a session, or for specific roles) and to choose the log level:https://supabase.com/docs/guides/platform/logs#configuring-pgauditlog

I'd like to verify the call parameters of the RPCs called via postgREST, but I am not able to alter pgaudit.log_parameter due to a permission error:

ERROR: permission denied to set parameter "pgaudit.log_parameter"

To Reproduce

Connect to the database as postgres or use the SQL Editor from the dashboard and run either of the following:
set pgaudit.log_parameter to 'on';
alter role authenticator set pgaudit.log_parameter to 'on';

Expected behavior

I expect to be able to set log_parameter and audit the parameters sent to the RPC.
https://github.com/pgaudit/pgaudit?tab=readme-ov-file#pgauditlog_parameter

Screenshots

image
image
image

System information

Additional context

Postgres version: 15.1.0.113
PostgREST version: 11.2.0

You must be logged in to vote

Replies: 3 comments 6 replies

Comment options

I'll note that I found a way to access the (URL Encoded) parameters for the RPCs from the API Edge Network Logs > Request Metadata > Search. It's not exactly what I was looking for, but it's something!

You must be logged in to vote
0 replies
Comment options

Hi@xEverth! Currently configuringpgaudit.log_parameter is not supported, since it renderspgsodium useless (secrets in encrypted columns will be logged unencrypted). This may not be relevant if you're not using pgsodium orSupabase Vault.

One workaround for this is usingtriggers.

I've converted this issue to a feature request to gauge interest - if enough people want this restriction lifted we may reconsider removing this restriction.

You must be logged in to vote
2 replies
@brandonwheat
Comment options

would love this feature for temporary troubleshooting

@evelant
Comment options

Would also love to be able to use this for troubleshooting. We've got a very difficult problem taking our whole instance down at random. There's not enough information in the logs for us to diagnose. We don't use pgsodium or vault so we're not concerned about leaking any encrypted data to logs.

Comment options

@soedirgo sadly, the trigger-based approach doesn't allow for logging reads (SELECT), and without parameter binding, it is impossible to be compliant with the strict auditing requirements over here in Europe (know which specific records/rows have been accessed) - especially in healthcare. We're self-hosting, and whilelog_parameter can be freely set there, it has absolutely no effect and is overwritten when starting the session for the affected user → I guess you guys patched pgaudit. Is there any way I can bypass this at least on my self-hosted version, other than building my own image or doing nasty patches?

You must be logged in to vote
4 replies
@soedirgo
Comment options

If you're self-hosting, you should be able to modify it by connecting assupabase_admin

@ncryptedV1
Comment options

Worked, thanks! What's the technical explanation for this? Even with the postgres role, I got no permission error, and the setting was persistent across sessions and restarts globally:

SELECT     r.rolname                                           AS role_name,    COALESCE(d.datname, 'GLOBAL')                       AS scope,    unnest(COALESCE(s.setconfig, r.rolconfig))          AS raw_setting,    regexp_match(unnest(COALESCE(s.setconfig, r.rolconfig)), '^pgaudit\.([^=]+)=(.*)') AS parsedFROM pg_roles rLEFT JOIN pg_db_role_setting s ON s.setrole = r.oidLEFT JOIN pg_database d        ON d.oid = s.setdatabaseWHERE (r.rolconfig::text ILIKE '%pgaudit%'     OR s.setconfig::text   ILIKE '%pgaudit%')ORDER BY role_name, scope;

→ looks exactly the same after regardless of whether I set it with postgres or supabase_admin

role_namescoperaw_settingparsed
...
authenticatorGLOBALpgaudit.log_parameter=on["log_parameter","on"]
...
@soedirgo
Comment options

Ah, I assumed from your original comment that you tried running it aspostgres but it didn't work. It actually should work that way on the hosted platform, but hadn't tested it on the self-hosted setup.

Correction:pgaudit.log_parameter isn't configurable on the hosted platform either. I think it works on the self-hosted platform becausepostgres is a superuser there, so it won't hit permission errors

@ncryptedV1
Comment options

Yes, but it does show the parameters now after setting it with supabase_admin. Maybe some overnight replication magic happened, but I restarted multiple times after setting it with postgres and it continuously showed,<not logged> in the audit logs normal forlog_parameter=off (which were'on' though) up until setting it with supabase_admin

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Labels
bugSomething isn't working
5 participants
@xEverth@evelant@ncryptedV1@soedirgo@brandonwheat
Converted from issue

This discussion was converted from issue #19955 on January 05, 2024 08:34.


[8]ページ先頭

©2009-2025 Movatter.jp