set_user
similar to SET ROLE but with added logging
set_user : similar to SET ROLE but with added logging
Overview
| ID | Extension | Package | Version | Category | License | Language |
|---|---|---|---|---|---|---|
| 7370 | set_user | set_user | 4.2.0 |
SEC | PostgreSQL | C |
| Attribute | Has Binary | Has Library | Need Load | Has DDL | Relocatable | Trusted |
|---|---|---|---|---|---|---|
| --sLd-- | No | Yes | Yes | Yes | no | no |
| Relationships | |
|---|---|
| See Also | pg_permissions login_hook pg_auth_mon pg_session_jwt auth_delay pgaudit pg_roast pg_readonly acl pg_command_fw |
Packages
| Type | Repo | Version | PG Major Compatibility | Package Pattern | Dependencies |
|---|---|---|---|---|---|
| EXT | PGDG | 4.2.0 |
18 17 16 15 14 | set_user |
- |
| RPM | PGDG | 4.2.0 |
18 17 16 15 14 | set_user_$v |
- |
| DEB | PGDG | 4.2.0 |
18 17 16 15 14 | postgresql-$v-set-user |
- |
| Linux / PG | PG18 | PG17 | PG16 | PG15 | PG14 |
|---|---|---|---|---|---|
| el8.x86_64 | PGDG 4.2.0 | PGDG 4.1.0 | PGDG 4.1.0 | PGDG 4.1.0 | PGDG 4.1.0 |
| el8.aarch64 | PGDG 4.2.0 | PGDG 4.1.0 | PGDG 4.1.0 | PGDG 4.1.0 | PGDG 4.1.0 |
| el9.x86_64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| el9.aarch64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| el10.x86_64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| el10.aarch64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| d12.x86_64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| d12.aarch64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| d13.x86_64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| d13.aarch64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| u22.x86_64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| u22.aarch64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| u24.x86_64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| u24.aarch64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| u26.x86_64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
| u26.aarch64 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 | PGDG 4.2.0 |
Source
github.com/pgaudit/set_user
Install
Make sure PGDG repo available:
Install this extension with pig:
Config this extension to shared_preload_libraries:
Create this extension with:
Usage
set_user allows switching users and optional privilege escalation with enhanced audit logging. It provides an additional layer of control when unprivileged users must escalate to superuser or object owner roles for maintenance tasks.
Configuration
Add to postgresql.conf:
| Parameter | Default | Description |
|---|---|---|
set_user.block_alter_system |
on |
Block ALTER SYSTEM when escalated |
set_user.block_copy_program |
on |
Block COPY PROGRAM when escalated |
set_user.block_log_statement |
on |
Block SET log_statement; force log_statement=all for superusers |
set_user.superuser_allowlist |
* |
Roles allowed to escalate to superuser |
set_user.nosuperuser_target_allowlist |
* |
Roles allowed as non-superuser targets |
set_user.superuser_audit_tag |
AUDIT |
Tag appended to log_line_prefix on escalation |
Functions
Permission Setup
Behavior on Escalation
When escalating to a superuser role:
- The role transition is logged with a specific notation
ALTER SYSTEMandCOPY PROGRAMare blocked (if configured)log_statementis forced toallfor full audit trail- The
AUDITtag is appended tolog_line_prefix