8000 Give superusers REPLIACTION permission by default · postgrespro/postgres_cluster@66a8a04 · GitHub
[go: up one dir, main page]
Skip to content

Commit 66a8a04

Browse files
mhagandermhagander
committed
Give superusers REPLIACTION permission by default
This can be overriden by using NOREPLICATION on the CREATE ROLE statement, but by default they will have it, making it backwards compatible and "less surprising" (given that superusers normally override all checks).
1 parent 3302334 commit 66a8a04

File tree

6 files changed

+22
-10
lines changed

6 files changed

+22
-10
lines changed

‎doc/src/sgml/high-availability.sgml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -805,9 +805,9 @@ archive_cleanup_command = 'pg_archivecleanup /path/to/archive %r'
805805
<note>
806806
<para>
807807
It is recommended that a dedicated user account is used for replication.
808-
While it is possible to add the <literal>REPLICATION</> privilege to
809-
a superuser account for the purporses of replication, this is not
810-
recommended. While <literal>REPLICATION</> privilege gives very high
808+
While the <literal>REPLICATION</> privilege is granted to superuser
809+
accounts by default, it is not recommended to use superuser accounts
810+
for replication. While <literal>REPLICATION</> privilege gives very high
811811
permissions, it does not allow the user to modify any data on the
812812
primary system, which the <literal>SUPERUSER</> privilege does.
813813
</para>

‎doc/src/sgml/ref/create_role.sgml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -185,7 +185,8 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
185185
A role having the <literal>REPLICATION</> attribute is a very
186186
highly privileged role, and should only be used on roles actually
187187
used for replication. If not specified,
188-
<literal>NOREPLICATION</literal> is the default.
188+
<literal>NOREPLICATION</literal> is the default for all roles except
189+
superusers.
189190
</para>
190191
</listitem>
191192
</varlistentry>

‎doc/src/sgml/user-manag.sgml

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -175,7 +175,11 @@ CREATE USER <replaceable>name</replaceable>;
175175
to do most of your work as a role that is not a superuser.
176176
To create a new database superuser, use <literal>CREATE ROLE
177177
<replaceable>name</replaceable> SUPERUSER</literal>. You must do
178-
this as a role that is already a superuser.
178+
this as a role that is already a superuser. Creating a superuser
179+
will by default also grant permissions to initiate streaming
180+
replication. For increased security this can be disallowed using
181+
<literal>CREATE ROLE <replaceable>name</replaceable> SUPERUSER
182+
NOREPLICATION</literal>.
179183
</para>
180184
</listitem>
181185
</varlistentry>
@@ -214,9 +218,8 @@ CREATE USER <replaceable>name</replaceable>;
214218
<listitem>
215219
<para>
216220
A role must explicitly be given permission to initiate streaming
217-
replication (superusers do not bypass this check). A role used
218-
for streaming replication must always have <literal>LOGIN</>
219-
permission as well. To create such a role, use
221+
replication. A role used for streaming replication must always
222+
have <literal>LOGIN</> permission as well. To create such a role, use
220223
<literal>CREATE ROLE <replaceable>name</replaceable> REPLICATION
221224
LOGIN</literal>.
222225
</para>

‎src/backend/commands/user.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,7 +248,15 @@ CreateRole(CreateRoleStmt *stmt)
248248
if (dpassword && dpassword->arg)
249249
password = strVal(dpassword->arg);
250250
if (dissuper)
251+
{
251252
issuper = intVal(dissuper->arg) != 0;
253+
/*
254+
* Superusers get replication by default, but only if
255+
* NOREPLICATION wasn't explicitly mentioned
256+
*/
257+
if (!(disreplication && intVal(disreplication->arg) == 0))
258+
isreplication = 1;
259+
}
252260
if (dinherit)
253261
inherit = intVal(dinherit->arg) != 0;
254262
if (dcreaterole)

‎src/include/catalog/catversion.h

Lines changed: 1 addition & 1 deletion
57
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/* yyyymmddN */
56-
#define CATALOG_VERSION_NO 201101031
56+
#define CATALOG_VERSION_NO 201101051
57

5858
#endif

‎src/include/catalog/pg_authid.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -93,7 +93,7 @@ typedef FormData_pg_authid *Form_pg_authid;
9393
* user choices.
9494
* ----------------
9595
*/
96-
DATA(insert OID = 10 ( "POSTGRES" t t t t t t f -1 _null_ _null_ ));
96+
DATA(insert OID = 10 ( "POSTGRES" t t t t t t t -1 _null_ _null_ ));
9797

9898
#define BOOTSTRAP_SUPERUSERID 10
9999

0 commit comments

Comments
 (0)
0