Re: Two-phase commit security restrictions

Heikki Linnakangas <hlinnaka@iki.fi> writes:
> What kind of security restrictions do we want for prepared transactions? 
> Who has the right to finish a transaction that was started by user A? At 
> least the original user, I suppose, but who else?

I would say the original user, any superuser, and nobody else.  This
conforms to Postgres' usual practices (compare to the right to DROP
an object).

> Do we need a "GRANT TRANSACTION" command to give permission to finish 2PC 
> transcations?

Overkill.

> Another approach I've been thinking about is to allow anyone that knows 
> the (user-supplied) global transaction identifier to finish the 
> transaction, and hide the gids of running transactions from regular users. 

Security-by-obscurity isn't really security, and I think that hiding the
GIDs is likely to make things noticeably more painful to manage.
        regards, tom lane