On Wed, Mar 22, 2017 at 12:55 PM, Peter Eisentraut <peter.eisentr...@2ndquadrant.com> wrote: > On 3/22/17 07:48, Dave Page wrote: >> With the patch, complex monitoring systems can easily be setup with >> something like: >> >> CREATE ROLE monitoring_user LOGIN; >> GRANT pg_monitor TO monitoring_role; > > That assumes that we have thought of all the ways in which people might > want to monitor things.
Right - it was discussed here, and at other meetings. We may not have everything but either users can GRANT anything we need that we missed later, or we can add them in a future release. > If we do it via GRANTs instead, then users can easily extend it. They can do that anyway. > If we instead change the hardcoded superuser checks to hardcoded > some-other-role checks, then the whole system instantly becomes unusable > the moment someone wants to monitor something we haven't thought of. I haven't replaced the checks, I've made them superuser || pg_monitor. Nothing is going to break if we haven't thought of something. -- Dave Page Blog: http://pgsnake.blogspot.com Twitter: @pgsnake EnterpriseDB UK: http://www.enterprisedb.com The Enterprise PostgreSQL Company -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
