From: Laurenz Albe <laurenz.albe@cybertec.at>
To: kaido vaikla <kaido.vaikla@gmail.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: pg_dumpall and owner of the extension
Date: Mon, 29 Jan 2024 08:57:21 +0100
Message-ID: <89497a7a56d5db84084d9eac3ca062176bc311e7.camel@cybertec.at> (raw)
In-Reply-To: <CA+427g-yY89-N0EdMrYYQ0GYjcj-TOqpc_NNWTDi2zkLARZWbQ@mail.gmail.com>
References: <CA+427g-YecPcvrHLJjoP92gDQy199qvvKCj_OvXhR3qmeu0zRQ@mail.gmail.com>
<17144af8b80466cf6c807d531de8410f1783ed90.camel@cybertec.at>
<CA+427g_gE_Np=MLtO+kJYfpfKsTWADOcRbo64DoKTAze8ZU24Q@mail.gmail.com>
<3419e4a28e16f2155fd97fe666b1a931ba7067a9.camel@cybertec.at>
<CA+427g-yY89-N0EdMrYYQ0GYjcj-TOqpc_NNWTDi2zkLARZWbQ@mail.gmail.com>
On Wed, 2024-01-24 at 19:04 +0200, kaido vaikla wrote:
> CREATE EXTENSION doc should be change like:
> "The user who runs CREATE EXTENSION becomes the owner of the extension until first export-import" ;)
Here is a patch that implements something like that.
Yours,
Laurenz Albe
Attachments:
[text/x-patch] v1-0001-Document-that-pg_dump-changes-extension-ownership.patch (1.7K, ../89497a7a56d5db84084d9eac3ca062176bc311e7.camel@cybertec.at/2-v1-0001-Document-that-pg_dump-changes-extension-ownership.patch)
download | inline diff:
From c09aca36b0f15728861c321c9d15be1e8195cf55 Mon Sep 17 00:00:00 2001
From: Laurenz Albe <laurenz.albe@cybertec.at>
Date: Mon, 29 Jan 2024 08:55:24 +0100
Subject: [PATCH v1] Document that pg_dump changes extension ownership
After restoring a dunp, extensions will belong to the restoring
user. This is no security problem, since the members of an
extension will belong to a superuser no matter what. But it can
be annoying for a non-superuser who installs a trusted extension
and finds that she cannot drop the extension after a restore.
Arguably that's a bug, and there should be a command ALTER
EXTENSION ... OWNER TO that gets added to the dump, but until
somebody gets to implement such a command, we had better document
the current behavior.
Author: Laurenz Albe
Discussion: https://postgr.es/m/CA%2B427g-YecPcvrHLJjoP92gDQy199qvvKCj_OvXhR3qmeu0zRQ%40mail.gmail.com
---
doc/src/sgml/ref/create_extension.sgml | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/doc/src/sgml/ref/create_extension.sgml b/doc/src/sgml/ref/create_extension.sgmlindex ca2b80d669..4ec34f31e2 100644--- a/doc/src/sgml/ref/create_extension.sgml+++ b/doc/src/sgml/ref/create_extension.sgml@@ -49,7 +49,9 @@ CREATE EXTENSION [ IF NOT EXISTS ] <replaceable class="parameter">extension_name
The user who runs <command>CREATE EXTENSION</command> becomes the
owner of the extension for purposes of later privilege checks, and
normally also becomes the owner of any objects created by the
- extension's script.+ extension's script. Note that the ownership of extensions is not preserved+ by <command>pg_dump</command>: after restoring a dump, extensions will+ belong to the user who performed the restore.
</para>
<para>
--
2.43.0
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: laurenz.albe@cybertec.at, kaido.vaikla@gmail.com
Subject: Re: pg_dumpall and owner of the extension
In-Reply-To: <89497a7a56d5db84084d9eac3ca062176bc311e7.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox