
> > If they are using tablespaces is it OK that anyone can see their
> > location?
> 
> Good point.  Should we obscure pg_tablespace similarly to 
> what we do for pg_shadow?

Hmm, I can not see how a person with file access could not easily find the 
file for a specific table without pg_tablespace anyway (since oid names will 
be quite unique). Without file access, what malicious act is he going to do 
with that info ? 

I think hiding that info would not really be safer, thus not worth it.

Andreas

Fri, 8 Oct 2004 13:36:52 +0200
"Zeugswetter Andreas DAZ SD" <ZeugswetterA@spardat.at>
Re: Security implications of config-file-location patch
"Zeugswetter Andreas DAZ SD" <ZeugswetterA@spardat.at> writes:
>> Good point.  Should we obscure pg_tablespace similarly to 
>> what we do for pg_shadow?

> Hmm, I can not see how a person with file access could not easily find the 
> file for a specific table without pg_tablespace anyway (since oid names will 
> be quite unique). Without file access, what malicious act is he going to do 
> with that info ? 

> I think hiding that info would not really be safer, thus not worth it.

Do you also feel that there's no need to hide the values of the GUC
variables pgdata etc?

			regards, tom lane

Fri, 08 Oct 2004 10:18:48 -0400
Tom Lane <tgl@sss.pgh.pa.us>
Re: Security implications of config-file-location patch 