summaryrefslogtreecommitdiff
path: root/doc/src
diff options
context:
space:
mode:
authorRobert Haas2023-04-04 16:03:03 +0000
committerRobert Haas2023-04-04 16:03:03 +0000
commit482675987bcdffb390ae735cfd5f34b485ae97c6 (patch)
tree889d1ea562d20bf291620e8df982d09f1852aa64 /doc/src
parent1e10d49b65d6c26c61fee07999e4cd59eab2b765 (diff)
Add a run_as_owner option to subscriptions.
This option is normally false, but can be set to true to obtain the legacy behavior where the subscription runs with the permissions of the subscription owner rather than the permissions of the table owner. The advantages of this mode are (1) it doesn't require that the subscription owner have permission to SET ROLE to each table owner and (2) since no role switching occurs, the SECURITY_RESTRICTED_OPERATION restrictions do not apply. On the downside, it allows any table owner to easily usurp the privileges of the subscription owner - basically, to take over their account. Because that's generally quite undesirable, we don't make this mode the default, but we do make it available, just in case the new behavior causes too many problems for someone. Discussion: http://postgr.es/m/CA+TgmoZ-WEeG6Z14AfH7KhmpX2eFh+tZ0z+vf0=eMDdbda269g@mail.gmail.com
Diffstat (limited to 'doc/src')
-rw-r--r--doc/src/sgml/logical-replication.sgml17
-rw-r--r--doc/src/sgml/ref/alter_subscription.sgml3
-rw-r--r--doc/src/sgml/ref/create_subscription.sgml14
3 files changed, 33 insertions, 1 deletions
diff --git a/doc/src/sgml/logical-replication.sgml b/doc/src/sgml/logical-replication.sgml
index 90f3967663..c65f4aabfd 100644
--- a/doc/src/sgml/logical-replication.sgml
+++ b/doc/src/sgml/logical-replication.sgml
@@ -1786,6 +1786,23 @@ CONTEXT: processing remote data for replication origin "pg_16395" during "INSER
</para>
<para>
+ If the subscription has been configured with
+ <literal>run_as_owner = true</literal>, then no user switching will
+ occur. Instead, all operations will be performed with the permissions
+ of the subscription owner. In this case, the subscription owner only
+ needs privileges to <literal>SELECT</literal>, <literal>INSERT</literal>,
+ <literal>UPDATE</literal>, and <literal>DELETE</literal> from the
+ target table, and does not need privileges to <literal>SET ROLE</literal>
+ to the table owner. However, this also means that any user who owns
+ a table into which replication is happening can execute arbitrary code with
+ the privileges of the subscription owner. For example, they could do this
+ by simply attaching a trigger to one of the tables which they own.
+ Because it is usually undesirable to allow one role to freely assume
+ the privileges of another, this option should be avoided unless user
+ security within the database is of no concern.
+ </para>
+
+ <para>
On the publisher, privileges are only checked once at the start of a
replication connection and are not re-checked as each change record is read.
</para>
diff --git a/doc/src/sgml/ref/alter_subscription.sgml b/doc/src/sgml/ref/alter_subscription.sgml
index df88e97537..a85e04e4d6 100644
--- a/doc/src/sgml/ref/alter_subscription.sgml
+++ b/doc/src/sgml/ref/alter_subscription.sgml
@@ -224,7 +224,8 @@ ALTER SUBSCRIPTION <replaceable class="parameter">name</replaceable> RENAME TO <
<link linkend="sql-createsubscription-with-binary"><literal>binary</literal></link>,
<link linkend="sql-createsubscription-with-streaming"><literal>streaming</literal></link>,
<link linkend="sql-createsubscription-with-disable-on-error"><literal>disable_on_error</literal></link>,
- <link linkend="sql-createsubscription-with-password-required"><literal>password_required</literal></link>, and
+ <link linkend="sql-createsubscription-with-password-required"><literal>password_required</literal></link>,
+ <link linkend="sql-createsubscription-with-run-as-owner"><literal>run_as_owner</literal></link>, and
<link linkend="sql-createsubscription-with-origin"><literal>origin</literal></link>.
Only a superuser can set <literal>password_required = false</literal>.
</para>
diff --git a/doc/src/sgml/ref/create_subscription.sgml b/doc/src/sgml/ref/create_subscription.sgml
index 2e4105d36e..68aa2b47f2 100644
--- a/doc/src/sgml/ref/create_subscription.sgml
+++ b/doc/src/sgml/ref/create_subscription.sgml
@@ -366,6 +366,20 @@ CREATE SUBSCRIPTION <replaceable class="parameter">subscription_name</replaceabl
</listitem>
</varlistentry>
+ <varlistentry id="sql-createsubscription-with-run-as-owner">
+ <term><literal>run_as_owner</literal> (<type>string</type>)</term>
+ <listitem>
+ <para>
+ If true, all replication actions are performed as the subscription
+ owner. If false, replication workers will perform actions on each
+ table as the owner of that table. The latter configuration is
+ generally much more secure; for details, see
+ <xref linkend="logical-replication-security" />.
+ The default is <literal>false</literal>.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry id="sql-createsubscription-with-origin">
<term><literal>origin</literal> (<type>string</type>)</term>
<listitem>