Re: [HACKERS] if (!superuser) checks

2016-04-22 Thread Andres Freund
Hi, On 2016-04-22 14:56:44 -0400, Stephen Frost wrote: > The idea we came up with is to have a pg_replication default role which > essentially replaces the REPLICATION role attribute. Andres didn't see > it as being terribly valuable to disallow a role with the REPLICATION > attribute from loggin

Re: [HACKERS] if (!superuser) checks

2016-04-22 Thread Stephen Frost
All, * Stephen Frost (sfr...@snowman.net) wrote: > In particular, the pg_logical_* functions have superuser checks and > those checks also allow roles who have the replication role attribute. > That isn't something we can represent with the GRANT system currently. I chatted with Andres a bit at P

[HACKERS] if (!superuser) checks

2016-04-07 Thread Stephen Frost
All, Andres, Now that we have begun removing the if (!superuser) checks and instead relying on the GRANT system to determine who is allowed to call certain functions, it's time to consider functions beyond the initial set. In particular, the pg_logical_* functions have superuser checks and those