[prev in list] [next in list] [prev in thread] [next in thread]
List: pgsql-hackers
Subject: Re: [HACKERS] Feature request: permissions change history for auditing
From: Andrew Dunstan <andrew () dunslane ! net>
Date: 2009-11-30 14:00:01
Message-ID: 4B13CFE1.2060602 () dunslane ! net
[Download RAW message or body]
Thom Brown wrote:
> 2009/11/30 Glyn Astill <glynastill@yahoo.co.uk
> <mailto:glynastill@yahoo.co.uk>>
>
> --- On Mon, 30/11/09, Thom Brown <thombrown@gmail.com
> <mailto:thombrown@gmail.com>> wrote:
>
> > As far as I am aware, there is no way to tell when a
> > user/role was granted permissions or had permissions
> > revoked, or who made these changes. I'm wondering if
> > it would be useful for security auditing to maintain a
> > history of permissions changes only accessible to
> > superusers?
>
> I'd have thought you could keep track of this in the logs by
> setting log_statement >= ddl ?
>
> I'm pretty sure this is a feature that's not wanted, but the
> ability to add triggers to these sorts of events would surely make
> more sense than a specific auditing capability.
>
>
> I concede your suggestion of the ddl log output. I guess that could
> then be filtered to obtain the necessary information.
>
>
This could probably be defeated by making the permissions changes in a
stored function. Or even a DO block, I suspect, unless you had
log_statement = all set.
I do agree with Glyn, though, that making provision for auditing one
particular event is not desirable.
cheers
andrew
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic