Loading feed…
Planet PostgreSQL0 Hot0 comments4 min read
All Your GUCs in a Row: lo_compat_privileges
The lo_compat_privileges parameter in PostgreSQL reverts large-object security to the pre-9.0 model, where any connected role could read, overwrite, or delete large objects with no owner or ACL checks. Turning it on silently disables the read/write checks in lo_open() and its dependents, the ownership check in lo_unlink(), and the checks on COMMENT ON LARGE OBJECT and SECURITY LABEL, while GRANT, ALTER OWNER, and server-side lo_import/lo_export checks remain intact. People typically enable it to paper over permission-denied errors from ownership mismatches between an import role and the application role, or to stop vacuumlo failing on objects it doesn't own—both of which have cheap correct fixes using pg_largeobject_metadata and GRANT/ALTER OWNER instead of disabling security silently and leaving no log trace.
Source: https://postgr.es/p/9sZ. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.
Recommended for you
Bình luận
Đang tải bình luận…
