Hi all, Recent commit bfc80683 has added some documentation in pg_rewind about the fact that it is possible to do the operation with a non-superuser, assuming that this role has sufficient grant rights to execute the functions used by pg_rewind.
Peter Eisentraut has suggested to have some tests for this kind of user here: https://www.postgresql.org/message-id/e1570ba6-4459-d9b2-1321-9449adaae...@2ndquadrant.com Attached is a patch which switches all the TAP tests of pg_rewind to do that. As of now, the tests depend on a superuser for everything, and it seems to me that it makes little sense to make the tests more pluggable by being able to switch the roles used on-the-fly (the invocation of pg_rewind is stuck into RewindTest.pm) as a superuser has no restrictions. Any thoughts? -- Michael
diff --git a/src/bin/pg_rewind/t/RewindTest.pm b/src/bin/pg_rewind/t/RewindTest.pm
index 900d452d8b..618de85161 100644
--- a/src/bin/pg_rewind/t/RewindTest.pm
+++ b/src/bin/pg_rewind/t/RewindTest.pm
@@ -144,6 +144,20 @@ sub start_master
{
$node_master->start;
+ # Create a custom role which will be used to run pg_rewind. This has
+ # minimal permissions to make pg_rewind able to work with an online
+ # source.
+ $node_master->psql('postgres', "
+ CREATE ROLE rewind_user LOGIN;
+ GRANT EXECUTE ON function pg_catalog.pg_ls_dir(text, boolean, boolean)
+ TO rewind_user;
+ GRANT EXECUTE ON function pg_catalog.pg_stat_file(text, boolean)
+ TO rewind_user;
+ GRANT EXECUTE ON function pg_catalog.pg_read_binary_file(text)
+ TO rewind_user;
+ GRANT EXECUTE ON function pg_catalog.pg_read_binary_file(text, bigint, bigint, boolean)
+ TO rewind_user;");
+
#### Now run the test-specific parts to initialize the master before setting
# up standby
@@ -207,6 +221,9 @@ sub run_pg_rewind
my $standby_connstr = $node_standby->connstr('postgres');
my $tmp_folder = TestLib::tempdir;
+ # Append the rewind role to the connection string.
+ $standby_connstr = "$standby_connstr user=rewind_user";
+
# Stop the master and be ready to perform the rewind
$node_master->stop;
signature.asc
Description: PGP signature
