On Fri, Dec 16, 2011 at 1:21 AM, Greg Smith <g...@2ndquadrant.com> wrote: > This is a problem with the existing code though, and the proposed changes > don't materially alter that; there's just another quick check in one path > through. Right now we check if someone is superuser, then if it's a backend > PID, then we send the signal. If you assume someone can run through all the > PIDs between those checks and the kill, the system is already broken that > way.
From a theoretical point of view, I believe it to be slightly different. If a superuser sends a kill, they will certainly be authorized to kill whatever they end up killing, because they are authorized to kill anything. On the other hand, the proposed patch would potentially result - in the extremely unlikely event of a super-fast PID wraparound - in someone cancelling a query they otherwise wouldn't have been able to cancel. In practice, the chances of this seem fairly remote. -- Robert Haas EnterpriseDB: http://www.enterprisedb.com The Enterprise PostgreSQL Company -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
