Re: pgsql: Add pg_audit, an auditing extension - Mailing list pgsql-committers

From Stephen Frost
Subject Re: pgsql: Add pg_audit, an auditing extension
Date
Msg-id 20150514192135.GK30322@tamriel.snowman.net
Whole thread Raw
In response to Re: pgsql: Add pg_audit, an auditing extension  (Tom Lane <tgl@sss.pgh.pa.us>)
Responses Re: pgsql: Add pg_audit, an auditing extension
List pgsql-committers
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > * Tom Lane (tgl@sss.pgh.pa.us) wrote:
> >> Quite aside from any security risks, that means that running "make
> >> installcheck" twice in a row fails.  Please fix.
>
> > Right, will do, though one kind of requires the other (we can't drop the
> > only user we know how to connect as which is a superuser...).  I'll
> > figure out a way to make it work though.
>
> Instead of physically reconnecting, could you do SET ROLE or SET SESSION
> AUTHORIZATION?  I think that's what we do in the core tests.

Alright, I believe this has been fixed now, using the brand-new \gset
option.

Two installcheck's in a row still breaks though..  I'm not quite sure
what to do about that but I'm certainly open to thoughts.  I can reset
the role attributes later, but those get logged with the username used
too in the ALTER statement, which changes.

I'll continue to think about it though, perhaps there's a way I can
disable logging as the superuser without it logging the role involved.

    Thanks!

        Stephen


Attachment

pgsql-committers by date:

Previous
From: Stephen Frost
Date:
Subject: pgsql: Improve pg_audit regression tests
Next
From: Stephen Frost
Date:
Subject: Re: pgsql: Add pg_audit, an auditing extension