Re: Additional role attributes && superuser review

Jim,

* Jim Nasby (Jim.Nasby@BlueTreble.com) wrote:
> On 10/15/14, 12:22 AM, Stephen Frost wrote:
> >   BACKUP:
> >     pg_start_backup()
> >     pg_stop_backup()
> >     pg_switch_xlog()
> >     pg_create_restore_point()
>
> It seems odd to me that this (presumably) supports PITR but not pg_dump*. I realize that most folks probably don't
usepg_dump for actual backups, but I think it is very common to use it to produce schema-only (maybe with data from a
fewtables as well) dumps for developers. I've certainly wished I could offer that ability without going full-blown
super-user.

Can you clarify what you mean by "supports PITR but not pg_dump"?

The role attribute specifically allows a user to execute those
functions.  Further, yes, this capability could be given to a role which
is used by, say, barman, to backup the database, or by other backup
solutions which do filesystem backups, but what do you mean by "does not
support pg_dump"?

What I think you're getting at here is a role attribute which can read
all data, which could certainly be done (as, say, a "READONLY"
attribute), but I view that a bit differently, as it could be used for
auditing and other purposes besides just non-superuser pg_dump support.
Thanks!
    Stephen