diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml index 357f25df0df..cf41baa2063 100644 --- a/doc/src/sgml/user-manag.sgml +++ b/doc/src/sgml/user-manag.sgml @@ -530,10 +530,6 @@ DROP ROLE doomed_role; Execute monitoring functions that may take ACCESS SHARE locks on tables, potentially for a long time. - - pg_signal_backend - Send signals to other backends (eg: cancel query, terminate). - pg_monitor Read/execute various monitoring views and functions. @@ -541,6 +537,10 @@ DROP ROLE doomed_role; pg_read_all_stats and pg_stat_scan_tables. + + pg_signal_backend + Signal another backend to cancel a query or terminate its session. + @@ -554,14 +554,23 @@ DROP ROLE doomed_role; other system information normally restricted to superusers. + + The pg_signal_backend role is intended to allow + administrators to enable trusted, but non-superuser, roles to send signals + to other backends. Currently this role enables sending of signals for + canceling a query on another backend or terminating its session. A user + granted this role cannot however send signals to a backend owned by a + superuser. See . + + Care should be taken when granting these roles to ensure they are only used where needed to perform the desired monitoring. - Administrators can grant access to these roles to users using the GRANT - command: + Administrators can grant access to these roles to users using the + command, for example: GRANT pg_signal_backend TO admin_user;