Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps
 (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1mdkKy-0001XZ-EN
	for pgsql-admin@arkaria.postgresql.org; Fri, 22 Oct 2021 02:31:16 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.92)
	(envelope-from <pgsql-admin-owner+archive@lists.postgresql.org>)
	id 1mdkKx-0000j2-Ce
	for pgsql-admin@arkaria.postgresql.org; Fri, 22 Oct 2021 02:31:15 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1mdkKx-0000it-37
	for pgsql-admin@lists.postgresql.org; Fri, 22 Oct 2021 02:31:15 +0000
Received: from sss.pgh.pa.us ([66.207.139.130])
	by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256)
	(Exim 4.92)
	(envelope-from <tgl@sss.pgh.pa.us>)
	id 1mdkKu-0004NB-FQ
	for pgsql-admin@postgresql.org; Fri, 22 Oct 2021 02:31:14 +0000
Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1])
	by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 19M2VAjJ2653741;
	Thu, 21 Oct 2021 22:31:10 -0400
From: Tom Lane <tgl@sss.pgh.pa.us>
To: "David G. Johnston" <david.g.johnston@gmail.com>
cc: Wells Oliver <wells.oliver@gmail.com>,
        pgsql-admin <pgsql-admin@postgresql.org>
Subject: Re: RDS and postgres extension approval
In-reply-to: 
 <CAKFQuwYt1WJ0rUOAVONndioLfz_hzFRQKOpcGQU80L==0M_o4g@mail.gmail.com>
References: 
 <CAOC+FBXoX1wYSrownCOAYwetebA9ghKE9q_XThrn_eMiY4thwA@mail.gmail.com>
 <CAKFQuwbZjgktk2RcAaGXjg-2jSLwob8RHMJ57DMRDnUH4R7=mg@mail.gmail.com>
 <CAOC+FBVBCcRgB8WGu0-ophNN0_5nmBTbtcvmTkGKPqOjq3R_bg@mail.gmail.com>
 <CAKFQuwYt1WJ0rUOAVONndioLfz_hzFRQKOpcGQU80L==0M_o4g@mail.gmail.com>
Comments: In-reply-to "David G. Johnston" <david.g.johnston@gmail.com>
	message dated "Thu, 21 Oct 2021 18:50:07 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2653739.1634869870.1@sss.pgh.pa.us>
Date: Thu, 21 Oct 2021 22:31:10 -0400
Message-ID: <2653740.1634869870@sss.pgh.pa.us>
List-Id: <pgsql-admin.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-admin@lists.postgresql.org>
List-Owner: <mailto:pgsql-admin-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-admin>
Archived-At: 
 <https://www.postgresql.org/message-id/2653740.1634869870%40sss.pgh.pa.us>
Precedence: bulk

"David G. Johnston" <david.g.johnston@gmail.com> writes:
> On Thu, Oct 21, 2021 at 6:48 PM Wells Oliver <wells.oliver@gmail.com> wrote:
>> Is there anything out there written about what trusted means? The PG
>> community seems pretty trusting :)

> It basically means the programming language allows the author of the code
> to break out of the server and access the underlying operating system as
> the postgres user.

Right.  If RDS won't give you superuser, they sure as heck won't
give you an untrusted PL, because that's an even shorter path to
getting access to the underlying system.

> I believe this is written in the docs - but I haven't
> searched recently.

The CREATE LANGUAGE man page defines the flag as

      <literal>TRUSTED</literal> specifies that the language does
       not grant access to data that the user would not otherwise
       have.

That's a tighter definition than is of interest here --- for
example, a language that only gave you SQL access but let
you bypass SQL privilege checks would have to be not-trusted,
a conclusion I agree with.  In practice though, external PL
systems know darn little about SQL.  It's their ability to
access the underlying OS that makes them problematic.

			regards, tom lane