Feedback-ID: ia2694551:Fastmail
Date: Tue, 5 Mar 2024 17:19:35 +0100
From: Alvaro Herrera <alvherre@alvh.no-ip.org>
To: Jeff Davis <jdavis@postgresql.org>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: pgsql: Fix search_path to a safe value during maintenance
 operations.
Message-ID: <202403051619.jiuwd3ec4jmi@alvherre.pgsql>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <E1rhJpO-0027Wf-9L@gemulon.postgresql.org>
Archived-At: 
 <https://www.postgresql.org/message-id/202403051619.jiuwd3ec4jmi%40alvherre.pgsql>
Precedence: bulk

On 2024-Mar-05, Jeff Davis wrote:

> Fix search_path to a safe value during maintenance operations.
> 
> While executing maintenance operations (ANALYZE, CLUSTER, REFRESH
> MATERIALIZED VIEW, REINDEX, or VACUUM), set search_path to
> 'pg_catalog, pg_temp' to prevent inconsistent behavior.
> 
> Functions that are used for functional indexes, in index expressions,
> or in materialized views and depend on a different search path must be
> declared with CREATE FUNCTION ... SET search_path='...'.

This appears to have upset the sepgsql tests.  In buildfarm member
rhinoceros there's now a bunch of errors like this

 ALTER TABLE regtest_table_4
       ADD CONSTRAINT regtest_tbl4_con EXCLUDE USING btree (z WITH =);
+LOG:  SELinux: allowed { search } scontext=unconfined_u:unconfined_r:sepgsql_regtest_superuser_t:s0 tcontext=unconfined_u:object_r:sepgsql_schema_t:s0 tclass=db_schema name="regtest_schema" permissive=0
+LOG:  SELinux: allowed { search } scontext=unconfined_u:unconfined_r:sepgsql_regtest_superuser_t:s0 tcontext=system_u:object_r:sepgsql_schema_t:s0 tclass=db_schema name="public" permissive=0

in its ddl.sql test.  I suppose this is just the result of the internal
change of search_path.  Maybe the thing to do is just accept the new
output as expected.

-- 
Álvaro Herrera               48°01'N 7°57'E  —  https://www.EnterpriseDB.com/
Voy a acabar con todos los humanos / con los humanos yo acabaré
voy a acabar con todos (bis) / con todos los humanos acabaré ¡acabaré! (Bender)