Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit00c5f55

Browse files
committed
Make superuser imply replication privilege. The idea of a privilege that
superuser doesn't have doesn't make much sense, as a superuser can dowhatever he wants through other means, anyway. So instead of grantingreplication privilege to superusers in CREATE USER time by default, allowreplication connection from superusers whether or not they have thereplication privilege.Patch by Noah Misch, per discussion on bug report #6264
1 parentea038d6 commit00c5f55

File tree

8 files changed

+32
-56
lines changed

8 files changed

+32
-56
lines changed

‎doc/src/sgml/high-availability.sgml

Lines changed: 6 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -797,23 +797,14 @@ archive_cleanup_command = 'pg_archivecleanup /path/to/archive %r'
797797
It is very important that the access privileges for replication be set up
798798
so that only trusted users can read the WAL stream, because it is
799799
easy to extract privileged information from it. Standby servers must
800-
authenticate to the primary as an account that has the
801-
<literal>REPLICATION</> privilege. So a role with the
802-
<literal>REPLICATION</> and <literal>LOGIN</> privileges needs to be
803-
created on the primary.
800+
authenticate to the primary as a superuser or an account that has the
801+
<literal>REPLICATION</> privilege. It is recommended to create a
802+
dedicated user account with <literal>REPLICATION</> and <literal>LOGIN</>
803+
privileges for replication. While <literal>REPLICATION</> privilege gives
804+
very high permissions, it does not allow the user to modify any data on
805+
the primary system, which the <literal>SUPERUSER</> privilege does.
804806
</para>
805807

806-
<note>
807-
<para>
808-
It is recommended that a dedicated user account is used for replication.
809-
While the <literal>REPLICATION</> privilege is granted to superuser
810-
accounts by default, it is not recommended to use superuser accounts
811-
for replication. While <literal>REPLICATION</> privilege gives very high
812-
permissions, it does not allow the user to modify any data on the
813-
primary system, which the <literal>SUPERUSER</> privilege does.
814-
</para>
815-
</note>
816-
817808
<para>
818809
Client authentication for replication is controlled by a
819810
<filename>pg_hba.conf</> record specifying <literal>replication</> in the

‎doc/src/sgml/recovery-config.sgml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -325,9 +325,8 @@ restore_command = 'copy "C:\\server\\archivedir\\%f" "%p"' # Windows
325325
The connection string should specify the host name (or address)
326326
of the primary server, as well as the port number if it is not
327327
the same as the standby server's default.
328-
Also specify a user name corresponding to a role that has the
329-
<literal>REPLICATION</> and <literal>LOGIN</> privileges on the
330-
primary (see
328+
Also specify a user name corresponding to a suitably-privileged role
329+
on the primary (see
331330
<xref linkend="streaming-replication-authentication">).
332331
A password needs to be provided too, if the primary demands password
333332
authentication. It can be provided in the

‎doc/src/sgml/ref/create_role.sgml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -185,8 +185,7 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
185185
A role having the <literal>REPLICATION</> attribute is a very
186186
highly privileged role, and should only be used on roles actually
187187
used for replication. If not specified,
188-
<literal>NOREPLICATION</literal> is the default for all roles except
189-
superusers.
188+
<literal>NOREPLICATION</literal> is the default.
190189
</para>
191190
</listitem>
192191
</varlistentry>

‎doc/src/sgml/ref/pg_basebackup.sgml

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -50,12 +50,13 @@ PostgreSQL documentation
5050

5151
<para>
5252
The backup is made over a regular <productname>PostgreSQL</productname>
53-
connection, and uses the replication protocol. The connection must be
54-
made with a user having <literal>REPLICATION</literal> permissions (see
55-
<xref linkend="role-attributes">), and the user must be granted explicit
56-
permissions in <filename>pg_hba.conf</filename>. The server must also
57-
be configured with <xref linkend="guc-max-wal-senders"> set high enough
58-
to leave at least one session available for the backup.
53+
connection, and uses the replication protocol. The connection must be made
54+
with a superuser or a user having <literal>REPLICATION</literal>
55+
permissions (see <xref linkend="role-attributes">),
56+
and <filename>pg_hba.conf</filename> must explicitly permit the replication
57+
connection. The server must also be configured
58+
with <xref linkend="guc-max-wal-senders"> set high enough to leave at least
59+
one session available for the backup.
5960
</para>
6061

6162
<para>

‎doc/src/sgml/ref/pg_receivexlog.sgml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -50,13 +50,13 @@ PostgreSQL documentation
5050

5151
<para>
5252
The transaction log is streamed over a regular
53-
<productname>PostgreSQL</productname> connection, and uses the
54-
replicationprotocol. The connection must be
55-
made with a userhaving <literal>REPLICATION</literal> permissions (see
56-
<xref linkend="role-attributes">), andthe user must be granted explicit
57-
permissions in <filename>pg_hba.conf</filename>. The server must also
58-
beconfigured with <xref linkend="guc-max-wal-senders"> set high enough
59-
toleave at least one session available for the stream.
53+
<productname>PostgreSQL</productname> connection, and uses the replication
54+
protocol. The connection must be made with a superuser or a user
55+
having <literal>REPLICATION</literal> permissions (see
56+
<xref linkend="role-attributes">), and<filename>pg_hba.conf</filename>
57+
must explicitly permit the replication connection. The server must also be
58+
configured with <xref linkend="guc-max-wal-senders"> set high enough to
59+
leave at least one session available for the stream.
6060
</para>
6161
</refsect1>
6262

‎doc/src/sgml/user-manag.sgml

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -169,16 +169,11 @@ CREATE USER <replaceable>name</replaceable>;
169169
<listitem>
170170
<para>
171171
A database superuser bypasses all permission checks, except the right
172-
to log in or the right to initiate replication. This is a
173-
dangerous privilege and should not be used carelessly; it is best
174-
to do most of your work as a role that is not a superuser.
175-
To create a new database superuser, use <literal>CREATE ROLE
176-
<replaceable>name</replaceable> SUPERUSER</literal>. You must do
177-
this as a role that is already a superuser. Creating a superuser
178-
will by default also grant permissions to initiate streaming
179-
replication. For increased security this can be disallowed using
180-
<literal>CREATE ROLE <replaceable>name</replaceable> SUPERUSER
181-
NOREPLICATION</literal>.
172+
to log in. This is a dangerous privilege and should not be used
173+
carelessly; it is best to do most of your work as a role that is not a
174+
superuser. To create a new database superuser, use <literal>CREATE
175+
ROLE <replaceable>name</replaceable> SUPERUSER</literal>. You must do
176+
this as a role that is already a superuser.
182177
</para>
183178
</listitem>
184179
</varlistentry>
@@ -217,7 +212,8 @@ CREATE USER <replaceable>name</replaceable>;
217212
<listitem>
218213
<para>
219214
A role must explicitly be given permission to initiate streaming
220-
replication. A role used for streaming replication must always
215+
replication (except for superusers, since those bypass all permission
216+
checks). A role used for streaming replication must always
221217
have <literal>LOGIN</> permission as well. To create such a role, use
222218
<literal>CREATE ROLE <replaceable>name</replaceable> REPLICATION
223219
LOGIN</literal>.

‎src/backend/commands/user.c

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -239,16 +239,7 @@ CreateRole(CreateRoleStmt *stmt)
239239
if (dpassword&&dpassword->arg)
240240
password=strVal(dpassword->arg);
241241
if (dissuper)
242-
{
243242
issuper=intVal(dissuper->arg)!=0;
244-
245-
/*
246-
* Superusers get replication by default, but only if NOREPLICATION
247-
* wasn't explicitly mentioned
248-
*/
249-
if (issuper&& !(disreplication&&intVal(disreplication->arg)==0))
250-
isreplication=1;
251-
}
252243
if (dinherit)
253244
inherit=intVal(dinherit->arg)!=0;
254245
if (dcreaterole)

‎src/backend/utils/init/postinit.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -659,11 +659,10 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
659659
{
660660
Assert(!bootstrap);
661661

662-
/* must have authenticated as a replication role */
663-
if (!is_authenticated_user_replication_role())
662+
if (!superuser()&& !is_authenticated_user_replication_role())
664663
ereport(FATAL,
665664
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
666-
errmsg("must be replication role to start walsender")));
665+
errmsg("must besuperuser orreplication role to start walsender")));
667666

668667
/* process any options passed in the startup packet */
669668
if (MyProcPort!=NULL)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp