citusdata / citusdata/citus

PG16 - no need for multiple replication slots for security

Open
#7,171 0 comments 0 reactions 0 assignees View on GitHub
development enhancement pg16_support rebalancer
Dominant language
C
Stars
12.8k
Forks
794
Avg merge
2d 14h
Merged PRs (30d)
31

Description

PG16 added the ability to perform logical replication actions as the table owner. https://github.com/postgres/postgres/commit/1e10d49
`run_as_owner` option is added to allow fallback to the previous way - by default run_as_owner is false, meaning that logical replication is performed as the table owner by default. Check out the added `SwitchToUntrustedUser` function.

Previously, logical replication actions have been performed as the subscription owner, who will generally be a superuser. This created a security issue for us.
https://github.com/citusdata/citus/blob/main/src/backend/distributed/replication/multi_logical_replication.c#L1484-L1486
We have that loop to create one subscription per "table owner", because it was unsafe to have a subscription owned by superuser to write into tables owned by another user.
But now with the default run_as_owner = false logic, it has become safe, so we only need a single subscription now.
This would simplify our implementation and we should definitely make use of this run_as_owner option.

Issue opened after consulting with @JelteF

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.