Re: user-based query white list

Hi

We use plproxy for this kind of security enhancement. We create plpgsql
functions that do whats needed and then we create so called proxy database
that contains only plproxy interfaces for these functions. Users get access
only to proxy database. This way it is easier to rest assured that users
don't get access by accident to something they should not.

regards,
Asko

On Sat, Dec 6, 2008 at 8:21 PM, Andrew Chernow <ac(at)esilo(dot)com> wrote:

> Looking for a way to limited a user to a specific set of queries. I don't
> think this can be done right now ... or can it? Has this feature request
> surfaced in the past?
>
> I currently need this as an extra security measure for a libpq client app
> (want to block arbitrary queries from malicious attackers). The easiest way
> I found was to add some query_string checks into backend/tcop/postgres.c for
> the 'Q' and 'P' commands in PostgresMain(). Seems to work just fine. If it
> doesn't match, I issue an ereport FATAL since that is seen as a "malicious
> query execution attempt".
>
> I think it is something rather simple to design/implement (probably use a
> table of user allowed queries, support regex matches, etc.. loaded at
> session startup and SIGHUP).
>
> --
> Andrew Chernow
> eSilo, LLC
> every bit counts
> http://www.esilo.com/
>
> --
> Sent via pgsql-hackers mailing list (pgsql-hackers(at)postgresql(dot)org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-hackers
>