Make superuser imply replication privilege. The idea of a privilege that

superuser doesn't have doesn't make much sense, as a superuser can do
whatever he wants through other means, anyway. So instead of granting
replication privilege to superusers in CREATE USER time by default, allow
replication connection from superusers whether or not they have the
replication privilege.

Patch by Noah Misch, per discussion on bug report #6264

diff --git a/doc/src/sgml/high-availability.sgml b/doc/src/sgml/high-availability.sgml
index 86c2729cfd3f7fbaae38e1a2057847f81f5be56b..c5db6ef01f83a83141c99aee3a422f3d555d2e71 100644 (file)
--- a/doc/src/sgml/high-availability.sgml
+++ b/doc/src/sgml/high-availability.sgml
@@ -797,23 +797,14 @@ archive_cleanup_command = 'pg_archivecleanup /path/to/archive %r'
      It is very important that the access privileges for replication be set up
      so that only trusted users can read the WAL stream, because it is
      easy to extract privileged information from it.  Standby servers must
-     authenticate to the primary as an account that has the
-     <literal>REPLICATION</> privilege. So a role with the
-     <literal>REPLICATION</> and <literal>LOGIN</> privileges needs to be
-     created on the primary.
+     authenticate to the primary as a superuser or an account that has the
+     <literal>REPLICATION</> privilege. It is recommended to create a
+     dedicated user account with <literal>REPLICATION</> and <literal>LOGIN</>
+     privileges for replication. While <literal>REPLICATION</> privilege gives
+     very high permissions, it does not allow the user to modify any data on
+     the primary system, which the <literal>SUPERUSER</> privilege does.
     </para>
 
-    <note>
-     <para>
-      It is recommended that a dedicated user account is used for replication.
-      While the <literal>REPLICATION</> privilege is granted to superuser
-      accounts by default, it is not recommended to use superuser accounts
-      for replication. While <literal>REPLICATION</> privilege gives very high
-      permissions, it does not allow the user to modify any data on the
-      primary system, which the <literal>SUPERUSER</> privilege does.
-     </para>
-    </note>
-
     <para>
      Client authentication for replication is controlled by a
      <filename>pg_hba.conf</> record specifying <literal>replication</> in the

diff --git a/doc/src/sgml/recovery-config.sgml b/doc/src/sgml/recovery-config.sgml
index 86470242eacb262f4fdfa72f72bdf008e179dec9..7e39c0db75ad5cf01e4566f830d6aa54dbf1ef30 100644 (file)
--- a/doc/src/sgml/recovery-config.sgml
+++ b/doc/src/sgml/recovery-config.sgml
@@ -325,9 +325,8 @@ restore_command = 'copy "C:\\server\\archivedir\\%f" "%p"'  # Windows
           The connection string should specify the host name (or address)
           of the primary server, as well as the port number if it is not
           the same as the standby server's default.
-          Also specify a user name corresponding to a role that has the
-          <literal>REPLICATION</> and <literal>LOGIN</> privileges on the
-          primary (see
+          Also specify a user name corresponding to a suitably-privileged role
+          on the primary (see
           <xref linkend="streaming-replication-authentication">).
           A password needs to be provided too, if the primary demands password
           authentication.  It can be provided in the

diff --git a/doc/src/sgml/ref/create_role.sgml b/doc/src/sgml/ref/create_role.sgml
index 4953df678dc2f1a9098db860fdba23b211af3d6b..7ec4d0a8e4cdcf2f15ae247429f0cd048a848690 100644 (file)
--- a/doc/src/sgml/ref/create_role.sgml
+++ b/doc/src/sgml/ref/create_role.sgml
@@ -185,8 +185,7 @@ CREATE ROLE <replaceable class="PARAMETER">name</replaceable> [ [ WITH ] <replac
         A role having the <literal>REPLICATION</> attribute is a very
         highly privileged role, and should only be used on roles actually
         used for replication. If not specified,
-        <literal>NOREPLICATION</literal> is the default for all roles except
-        superusers.
+        <literal>NOREPLICATION</literal> is the default.
        </para>
       </listitem>
      </varlistentry>

diff --git a/doc/src/sgml/ref/pg_basebackup.sgml b/doc/src/sgml/ref/pg_basebackup.sgml
index 8c8c78f0d15030475e80141075291ec582fd4f9a..05d5bedef93c7dc4ae3758544da98d1d017a7e65 100644 (file)
--- a/doc/src/sgml/ref/pg_basebackup.sgml
+++ b/doc/src/sgml/ref/pg_basebackup.sgml
@@ -50,12 +50,13 @@ PostgreSQL documentation
 
   <para>
    The backup is made over a regular <productname>PostgreSQL</productname>
-   connection, and uses the replication protocol. The connection must be
-   made with a user having <literal>REPLICATION</literal> permissions (see
-   <xref linkend="role-attributes">), and the user must be granted explicit
-   permissions in <filename>pg_hba.conf</filename>. The server must also
-   be configured with <xref linkend="guc-max-wal-senders"> set high enough
-   to leave at least one session available for the backup.
+   connection, and uses the replication protocol. The connection must be made
+   with a superuser or a user having <literal>REPLICATION</literal>
+   permissions (see <xref linkend="role-attributes">),
+   and <filename>pg_hba.conf</filename> must explicitly permit the replication
+   connection. The server must also be configured
+   with <xref linkend="guc-max-wal-senders"> set high enough to leave at least
+   one session available for the backup.
   </para>
 
   <para>

diff --git a/doc/src/sgml/ref/pg_receivexlog.sgml b/doc/src/sgml/ref/pg_receivexlog.sgml
index 9a2a24ba2e3d0c86c1498094a1c633b2c94bf9b5..fad7470ee3516d1b007ef04eff14ca657d12d033 100644 (file)
--- a/doc/src/sgml/ref/pg_receivexlog.sgml
+++ b/doc/src/sgml/ref/pg_receivexlog.sgml
@@ -50,13 +50,13 @@ PostgreSQL documentation
 
   <para>
    The transaction log is streamed over a regular
-   <productname>PostgreSQL</productname> connection, and uses the
-   replication protocol. The connection must be
-   made with a user having <literal>REPLICATION</literal> permissions (see
-   <xref linkend="role-attributes">), and the user must be granted explicit
-   permissions in <filename>pg_hba.conf</filename>. The server must also
-   be configured with <xref linkend="guc-max-wal-senders"> set high enough
-   to leave at least one session available for the stream.
+   <productname>PostgreSQL</productname> connection, and uses the replication
+   protocol. The connection must be made with a superuser or a user
+   having <literal>REPLICATION</literal> permissions (see
+   <xref linkend="role-attributes">), and <filename>pg_hba.conf</filename>
+   must explicitly permit the replication connection. The server must also be
+   configured with <xref linkend="guc-max-wal-senders"> set high enough to
+   leave at least one session available for the stream.
   </para>
  </refsect1>
 

diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml
index 0a4f82daae2988fc2e401370f5da2571617058c5..177ac7aa8c503883935ea08b8cdad272fe499ab6 100644 (file)
--- a/doc/src/sgml/user-manag.sgml
+++ b/doc/src/sgml/user-manag.sgml
@@ -169,16 +169,11 @@ CREATE USER <replaceable>name</replaceable>;
       <listitem>
        <para>
         A database superuser bypasses all permission checks, except the right
-        to log in or the right to initiate replication.  This is a
-        dangerous privilege and should not be used carelessly; it is best
-        to do most of your work as a role that is not a superuser.
-        To create a new database superuser, use <literal>CREATE ROLE
-        <replaceable>name</replaceable> SUPERUSER</literal>.  You must do
-        this as a role that is already a superuser. Creating a superuser
-        will by default also grant permissions to initiate streaming
-        replication. For increased security this can be disallowed using
-        <literal>CREATE ROLE <replaceable>name</replaceable> SUPERUSER
-        NOREPLICATION</literal>.
+        to log in.  This is a dangerous privilege and should not be used
+        carelessly; it is best to do most of your work as a role that is not a
+        superuser.  To create a new database superuser, use <literal>CREATE
+        ROLE <replaceable>name</replaceable> SUPERUSER</literal>.  You must do
+        this as a role that is already a superuser.
        </para>
       </listitem>
      </varlistentry>
@@ -217,7 +212,8 @@ CREATE USER <replaceable>name</replaceable>;
       <listitem>
        <para>
         A role must explicitly be given permission to initiate streaming
-        replication. A role used for streaming replication must always
+        replication (except for superusers, since those bypass all permission
+        checks). A role used for streaming replication must always
         have <literal>LOGIN</> permission as well. To create such a role, use
         <literal>CREATE ROLE <replaceable>name</replaceable> REPLICATION
         LOGIN</literal>.

diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c
index a90f0b1ffef7099998429c2fa21a77b7c5451f51..9a88c907894b6b8ac1d9a11c47c7c5cfb9e414f0 100644 (file)
--- a/src/backend/commands/user.c
+++ b/src/backend/commands/user.c
@@ -239,16 +239,7 @@ CreateRole(CreateRoleStmt *stmt)
        if (dpassword && dpassword->arg)
                password = strVal(dpassword->arg);
        if (dissuper)
-       {
                issuper = intVal(dissuper->arg) != 0;
-
-               /*
-                * Superusers get replication by default, but only if NOREPLICATION
-                * wasn't explicitly mentioned
-                */
-               if (issuper && !(disreplication && intVal(disreplication->arg) == 0))
-                       isreplication = 1;
-       }
        if (dinherit)
                inherit = intVal(dinherit->arg) != 0;
        if (dcreaterole)

diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index f9e4dbc0c08dce789d45ab026473107b1e2f75c4..1baa67da9ff8b3e666b6404944e54537b599067e 100644 (file)
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -659,11 +659,10 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
        {
                Assert(!bootstrap);
 
-               /* must have authenticated as a replication role */
-               if (!is_authenticated_user_replication_role())
+               if (!superuser() && !is_authenticated_user_replication_role())
                        ereport(FATAL,
                                        (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
-                                        errmsg("must be replication role to start walsender")));
+                                        errmsg("must be superuser or replication role to start walsender")));
 
                /* process any options passed in the startup packet */
                if (MyProcPort != NULL)