11

I have a single postgres database, with two users; Alice and Bob.

I would like to be able to do a NOTIFY alice_channel 'sensitive data' without Bob being able to sneakily LISTEN in just by guessing that the channel name is 'alice_channel'.

In practice the channel names are very hard to guess, but this is security through obscurity at best.

Am I correct in believing that there is no way to prevent a database user from using (abusing) LISTEN & NOTIFY? i.e. there does not appear to be any associated privileges that can be granted or revoked.

Is this a dead end?

Improve this question
4
  • I don't know of a way to exclude users from listening. But if you pick a name for the channel like you would pick a secure password, wouldn't this do the job?
    – Erwin Brandstetter
    May 18, 2013 at 22:37
  • Yeah, that's what I'm doing at the moment (using large random strings), but it feels dirty and is rather limiting. There are some pretty cool things I could do with LISTEN/NOTIFY if I could lock it down a bit. As it stands it's a rather course-grained "poke a client to re-poll for all the data you 'might' need" feature.
    – Chris Farmiloe
    May 18, 2013 at 23:04
  • I just wanted to know if things have changed since this was answered. Were you able to implement something?
    – Phill Pafford
    Aug 1, 2014 at 18:22
  • If you can't trust your apps, you should not let them in. I think it is dead end in production system. There has been proposal though for related privs. postgresql.org/message-id/51CC98FB.9040700%40agliodbs.com
    – Anssi
    Jan 4, 2018 at 11:09

1 Answer 1

Reset to default
6

There are no permissions on LISTEN and NOTIFY. It would not have made sense to have any until support for notify payloads was introduced in more recent versions.

If you want access control, create a table with the information that you want and then send a NOTIFY that's empty or has nothing but a primary key for that table in it. SELECT the row(s) of interest from the table, which can have access control, to get the sensitive data. This used to be the only way to use LISTEN and NOTIFY to send specific data before payloads were added.

Improve this answer
1
  • Thanks Craig I thought as much. I might take a peek at the source and see how hard it will be to implement but I'm guessing it will require a completely new database level AclMode and pg_database_aclcheck call somewhere, it's been a while since I've looked :/
    – Chris Farmiloe
    May 19, 2013 at 15:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.