Superuser Role Specific to certain Databases in PostgreSQL -

-

i have created user role superuser privilege. have around 30 databases on server. want assign role only db. current role lets user access dbs super user. how can restrict him accessing other dbs super user.

this have assigning superuser:

create role fc login    superuser inherit nocreatedb nocreaterole noreplication;

can me this?

as @craig explained, can't (and if could, pointless).

the usual way of implementing restricted superuser permissions connect existing superuser role, , create security definer functions containing limited set of approved commands. these functions executed privileges of creator rather caller.

but need very careful not open injection vulnerabilities, because within function run superuser. e.g. caller write custom = operator grants them superuser rights, , put in search path, need absolutely sure you're using = in pg_catalog schema.

at least, should:

  • create of these functions clause security definer set search_path pg_catalog, pg_temp. pg_temp schema must included @ end of list (if omitted, implicitly included @ start).
  • schema-qualify other tables, functions, etc. function references (e.g. public.mytable instead of mytable), , make sure of these superuser-owned (so callers can't put malicious code in triggers, etc.).
  • never put user input in dynamic query string (execute 'select ...') without exhaustive validation.

Comments

Post a Comment

Popular posts from this blog

python - How to create jsonb index using GIN on SQLAlchemy? -

-
here's current code creating index jsonb. index("mytable_data_idx_id_key", mytable.data['id'].astext, postgresql_using='gin') but got error. sqlalchemy.exc.programmingerror: (psycopg2.programmingerror) data type text has no default operator class access method "gin" hint: must specify operator class index or define default operator class data type. [sql: "create index event_data_idx_id_key on event using gin ((data ->> 'id'))"] is there way create index on sqlalchemy? the postgresql specific sqlalchemy docs @ http://docs.sqlalchemy.org/en/latest/dialects/postgresql.html#operator-classes mention postgresql_ops dictionary provide "operator class" used postgresql, , provide example illustrating use: index('my_index', my_table.c.id, my_table.c.data, postgresql_ops={ 'data': 'text_pattern_ops', ...
Read more

PHP DOM loadHTML() method unusual warning -

-
i had following code works fine on localhost: $document = new domdocument(); $document->loadhtml($p_result); $form = $document->getelementsbytagname('form')->item(0); // code continues using $form variable after same code updated on outside server, loadhtml() failed , issued warning. warning: domdocument::loadhtml() expects parameter 1 valid path, string given in path/name/to/script.php returned null instead of object code pretty gets fatal error. note contents of $p_result absolutely same on outside server , on localhost. but why displays kind of warning , why not work? doesn't loadhtml() expects argument 1 string in first place? why method expects parameter 1 valid path ? just make clear i'm not calling loadhtmlfile() , i'm calling loadhtml() . thanks. you're affected one of php bugs . issue present in php 5.6.8 , 5.6.9. have affected php version on server, , bug-free version on localhost. the bug forbids null ...
Read more

c# - TransactionScope not rolling back although no complete() is called -

-
i'm using transactionscope rollback transaction fail bool errorreported = false; action<importerrorlog> newerrorcallback = e => { errorreported = true; errorcallback(e); }; using (var transaction = new transactionscope()) { foreach (importtaskdefinition task in taskdefinition) { loader.load(streamfile, newerrorcallback, task.destinationtable, processingtaskid); } if (!errorreported) transaction.complete(); } i'm sure there no transactionscope started ahead or after code. i'm using entity framework insert in db. regardless state of errorreported transaction never rolled in case of error. what missing ? transactionscope sets transaction.current . that's does. wants transacted must @ property. i believe ef each time connection opened reason. probably, connection open when scope installed. open connection inside of scope or enlist manually. ef has nasty "design decision": default opens ...
Read more