Superuser Role Specific to certain Databases in PostgreSQL -


i have created user role superuser privilege. have around 30 databases on server. want assign role only db. current role lets user access dbs super user. how can restrict him accessing other dbs super user.

this have assigning superuser:

create role fc login    superuser inherit nocreatedb nocreaterole noreplication; 

can me this?

as @craig explained, can't (and if could, pointless).

the usual way of implementing restricted superuser permissions connect existing superuser role, , create security definer functions containing limited set of approved commands. these functions executed privileges of creator rather caller.

but need very careful not open injection vulnerabilities, because within function run superuser. e.g. caller write custom = operator grants them superuser rights, , put in search path, need absolutely sure you're using = in pg_catalog schema.

at least, should:

  • create of these functions clause security definer set search_path pg_catalog, pg_temp. pg_temp schema must included @ end of list (if omitted, implicitly included @ start).
  • schema-qualify other tables, functions, etc. function references (e.g. public.mytable instead of mytable), , make sure of these superuser-owned (so callers can't put malicious code in triggers, etc.).
  • never put user input in dynamic query string (execute 'select ...') without exhaustive validation.

Comments

Popular posts from this blog

PHP DOM loadHTML() method unusual warning -

python - How to create jsonb index using GIN on SQLAlchemy? -

c# - TransactionScope not rolling back although no complete() is called -