Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit66a8a04

Browse files
committed
Give superusers REPLIACTION permission by default
This can be overriden by using NOREPLICATION on the CREATE ROLEstatement, but by default they will have it, making it backwardscompatible and "less surprising" (given that superusers normallyoverride all checks).
1 parent3302334 commit66a8a04

File tree

6 files changed

+22
-10
lines changed

6 files changed

+22
-10
lines changed

‎doc/src/sgml/high-availability.sgml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -805,9 +805,9 @@ archive_cleanup_command = 'pg_archivecleanup /path/to/archive %r'
805805
<note>
806806
<para>
807807
It is recommended that a dedicated user account is used for replication.
808-
Whileit is possible to addthe <literal>REPLICATION</> privilegeto
809-
a superuser account for the purporses of replication, this is not
810-
recommended. While <literal>REPLICATION</> privilege gives very high
808+
While the <literal>REPLICATION</> privilegeis granted to superuser
809+
accounts by default, it is not recommended to use superuser accounts
810+
for replication. While <literal>REPLICATION</> privilege gives very high
811811
permissions, it does not allow the user to modify any data on the
812812
primary system, which the <literal>SUPERUSER</> privilege does.
813813
</para>

‎doc/src/sgml/ref/create_role.sgml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,8 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
185185
A role having the <literal>REPLICATION</> attribute is a very
186186
highly privileged role, and should only be used on roles actually
187187
used for replication. If not specified,
188-
<literal>NOREPLICATION</literal> is the default.
188+
<literal>NOREPLICATION</literal> is the default for all roles except
189+
superusers.
189190
</para>
190191
</listitem>
191192
</varlistentry>

‎doc/src/sgml/user-manag.sgml‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,11 @@ CREATE USER <replaceable>name</replaceable>;
175175
to do most of your work as a role that is not a superuser.
176176
To create a new database superuser, use <literal>CREATE ROLE
177177
<replaceable>name</replaceable> SUPERUSER</literal>. You must do
178-
this as a role that is already a superuser.
178+
this as a role that is already a superuser. Creating a superuser
179+
will by default also grant permissions to initiate streaming
180+
replication. For increased security this can be disallowed using
181+
<literal>CREATE ROLE <replaceable>name</replaceable> SUPERUSER
182+
NOREPLICATION</literal>.
179183
</para>
180184
</listitem>
181185
</varlistentry>
@@ -214,9 +218,8 @@ CREATE USER <replaceable>name</replaceable>;
214218
<listitem>
215219
<para>
216220
A role must explicitly be given permission to initiate streaming
217-
replication (superusers do not bypass this check). A role used
218-
for streaming replication must always have <literal>LOGIN</>
219-
permission as well. To create such a role, use
221+
replication. A role used for streaming replication must always
222+
have <literal>LOGIN</> permission as well. To create such a role, use
220223
<literal>CREATE ROLE <replaceable>name</replaceable> REPLICATION
221224
LOGIN</literal>.
222225
</para>

‎src/backend/commands/user.c‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,7 +248,15 @@ CreateRole(CreateRoleStmt *stmt)
248248
if (dpassword&&dpassword->arg)
249249
password=strVal(dpassword->arg);
250250
if (dissuper)
251+
{
251252
issuper=intVal(dissuper->arg)!=0;
253+
/*
254+
* Superusers get replication by default, but only if
255+
* NOREPLICATION wasn't explicitly mentioned
256+
*/
257+
if (!(disreplication&&intVal(disreplication->arg)==0))
258+
isreplication=1;
259+
}
252260
if (dinherit)
253261
inherit=intVal(dinherit->arg)!=0;
254262
if (dcreaterole)

‎src/include/catalog/catversion.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/*yyyymmddN */
56-
#defineCATALOG_VERSION_NO201101031
56+
#defineCATALOG_VERSION_NO201101051
5757

5858
#endif

‎src/include/catalog/pg_authid.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ typedef FormData_pg_authid *Form_pg_authid;
9393
* user choices.
9494
* ----------------
9595
*/
96-
DATA(insertOID=10 ("POSTGRES"ttttttf-1_null__null_ ));
96+
DATA(insertOID=10 ("POSTGRES"ttttttt-1_null__null_ ));
9797

9898
#defineBOOTSTRAP_SUPERUSERID 10
9999

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp