PG16 - no need for multiple replication slots for security
- Dominant language
- C
- Stars
- 12.8k
- Forks
- 794
- Avg merge
- 2d 14h
- Merged PRs (30d)
- 31
Description
PG16 added the ability to perform logical replication actions as the table owner. https://github.com/postgres/postgres/commit/1e10d49
`run_as_owner` option is added to allow fallback to the previous way - by default run_as_owner is false, meaning that logical replication is performed as the table owner by default. Check out the added `SwitchToUntrustedUser` function.
Previously, logical replication actions have been performed as the subscription owner, who will generally be a superuser. This created a security issue for us.
https://github.com/citusdata/citus/blob/main/src/backend/distributed/replication/multi_logical_replication.c#L1484-L1486
We have that loop to create one subscription per "table owner", because it was unsafe to have a subscription owned by superuser to write into tables owned by another user.
But now with the default run_as_owner = false logic, it has become safe, so we only need a single subscription now.
This would simplify our implementation and we should definitely make use of this run_as_owner option.
Issue opened after consulting with @JelteF
Contributor guide
Assessment
This issue has not been assessed yet.