• Stephen Frost's avatar
    Add default roles for file/program access · 0fdc8495
    Stephen Frost authored
    This patch adds new default roles named 'pg_read_server_files',
    'pg_write_server_files', 'pg_execute_server_program' which
    allow an administrator to GRANT to a non-superuser role the ability to
    access server-side files or run programs through PostgreSQL (as the user
    the database is running as).  Having one of these roles allows a
    non-superuser to use server-side COPY to read, write, or with a program,
    and to use file_fdw (if installed by a superuser and GRANT'd USAGE on
    it) to read from files or run a program.
    
    The existing misc file functions are also changed to allow a user with
    the 'pg_read_server_files' default role to read any files on the
    filesystem, matching the privileges given to that role through COPY and
    file_fdw from above.
    
    Reviewed-By: Michael Paquier
    Discussion: https://postgr.es/m/20171231191939.GR2416%40tamriel.snowman.net
    0fdc8495
user-manag.sgml 24.9 KB