[pgpool-general: 8878] Re: restrictions for pgpool set/show commands

[Tatsuo Ishii]

> Hello Pgpool team
> 
> Is it possible to place any restrictions on which users may execute a
> PGPOOL SET/SHOW command?

No.

> As far as I understand, a normal unprivileged user
> (capable of establishing a session with Pgpool frontend) may send a similar
> command.

Yes.

> In the case of PGPOOL SET, a user may alter significant parts of
> the server configuration (which seems to me like more powerful than I would
> expect).

Below are the configuration parameters PGPOOL SET can change its value
in the session. Do you have any concern here?

		{"log_statement", CFGCXT_SESSION, LOGGING_CONFIG,
		{"log_per_node_statement", CFGCXT_SESSION, LOGGING_CONFIG,
		{"log_client_messages", CFGCXT_SESSION, LOGGING_CONFIG,
		{"check_unlogged_table", CFGCXT_SESSION, GENERAL_CONFIG,
		{"allow_sql_comments", CFGCXT_SESSION, LOAD_BALANCE_CONFIG,
		{"client_idle_limit", CFGCXT_SESSION, CONNECTION_POOL_CONFIG,
		{"client_idle_limit_in_recovery", CFGCXT_SESSION, RECOVERY_CONFIG,
		{"log_error_verbosity", CFGCXT_SESSION, LOGGING_CONFIG,
		{"client_min_messages", CFGCXT_SESSION, LOGGING_CONFIG,
		{"log_min_messages", CFGCXT_SESSION, LOGGING_CONFIG,

Best reagards,
--
Tatsuo Ishii
SRA OSS LLC
English: http://www.sraoss.co.jp/index_en/
Japanese:http://www.sraoss.co.jp