Search code examples
postgresqlpermissionscentos7superuserpgcrypto

Using Postgres PGCrypto encryption requires superuser to run view queries


Using: Postgres 9, CentOS 7, Postgres Data directory not in default location but used RSync to make sure permissions were correct. And yes appropriate .config files were changed.

When I try to query a view containing an encrypted item as a NON superuser (Testuser), I get this error:

ERROR: must be superuser to read files CONTEXT: PL/pgSQL function decrypt_data(bytea) line 13 at assignment

If I run that same query using POSTGRES superuser, the query completes fine.

This seems to be a file system read permission error when trying to read the Key files. Everything I see using encryption seem to not mention how to run without being superuser.

I have already run the following grants for Testuser:

GRANT ALL PRIVILEGES ON DATABASE xxx_db to Testuser;
GRANT SELECT ON ALL TABLES IN SCHEMA xxxxx TO Testuser;
GRANT ALL ON ALL TABLES IN SCHEMA xxxxx TO Testuser;

The test user can create tables, views, basically anything within that db.. just not read encryption keys.

The permissions on the keys are 775 right now, I even tried 777 without luck.

Any Ideas?


Solution

  • I found the issue. I need to grant the user with function permissions.

    GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA xxxxx TO yyyyyyyyy;