Skip to main content

Posts

Showing posts with the label pg_stat_activity as non super user.

Normal User As Super User

Recently i faced a problem with some catalog views, which do not give you the complete information as a normal user. For example, take pg_stat_activity, pg_stat_replication, pg_settings, e.t.c. If we run the above catalog views as non super user, you don't get the result what we get as a superuser. This is really a good security between super user and normal user. What we need to do, if we want to collect these metrics as normal user. I think the possible solution is "Write a wrapper function with security definer as like below" and grant/revoke the required privileges to the user/public. CREATE OR REPLACE FUNCTION pg_stat_activity( RETURNS SETOF pg_catalog.pg_stat_activity AS $$ BEGIN RETURN QUERY(SELECT * FROM pg_catalog.pg_stat_activity); END $$ LANGUAGE PLPGSQL SECURITY DEFINER; REVOKE ALL ON FUNCTION pg_stat_activity() FROM public; CREATE VIEW pg_stat_activity AS SELECT * FROM pg_stat_activity(); REVOKE ALL ON pg_stat_activity FROM public; ...