agora inbox for pgsql-committers@postgresql.orghelp / color / mirror / Atom feed
pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi 5+ messages / 1 participants [nested] [flat]
* pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add an output_plugin_libraries GUC to bless trusted output plugins REPLICATION users were not previously subject to restrictions on output plugin paths, so they were able to bypass LOAD-time protections during logical decoding. Unfortunately, adding the standard LOAD restrictions now would retroactively require all third-party output plugins to be installed under the $libdir/plugins directory. This would prevent the use of dynamic_library_path, introduce a wire incompatibility for clients, and require all plugin authors to check that their libraries are safe for use by any unprivileged user; we want to avoid that. Instead, introduce an output_plugin_libraries GUC so that DBAs can specify the output plugins that are trusted for use in logical decoding. For simplicity, superusers are subject to the restriction as well (though they're free to modify the GUC at will during a session, so no power is actually lost). The default setting is 'pgoutput, test_decoding'. If other third-party plugins are in use, DBAs will need to modify this parameter after they update. Some pointers have been added to the documentation to assist with this. Author: Jacob Champion <jacob.champion@enterprisedb.com> Reported-by: Vladimir Tokarev <vladimirelitokarev@gmail.com> Reported-by: Yu Kunpeng <yu443940816@live.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-6471 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/226e49cbed592eaf7a08320efecb814b7492972e Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/test_decoding/expected/permissions.out | 11 +++ contrib/test_decoding/expected/repack.out | 1 - contrib/test_decoding/expected/slot.out | 3 + contrib/test_decoding/sql/permissions.sql | 8 +++ contrib/test_decoding/sql/slot.sql | 3 + doc/src/sgml/config.sgml | 57 +++++++++++++++ doc/src/sgml/logical-replication.sgml | 13 +++- src/backend/replication/logical/logical.c | 97 ++++++++++++++++++++++++-- src/backend/replication/pgrepack/pgrepack.c | 10 ++- src/backend/utils/misc/guc_parameters.dat | 9 +++ src/backend/utils/misc/guc_tables.c | 1 + src/backend/utils/misc/postgresql.conf.sample | 1 + src/bin/pg_dump/dumputils.c | 1 + src/bin/pg_upgrade/check.c | 85 +++++++++++++++++++++- src/bin/pg_upgrade/t/003_logical_slots.pl | 53 ++++++++++++-- src/include/replication/logical.h | 3 + src/test/subscription/t/100_bugs.pl | 27 ++++++- 17 files changed, 359 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add an output_plugin_libraries GUC to bless trusted output plugins REPLICATION users were not previously subject to restrictions on output plugin paths, so they were able to bypass LOAD-time protections during logical decoding. Unfortunately, adding the standard LOAD restrictions now would retroactively require all third-party output plugins to be installed under the $libdir/plugins directory. This would prevent the use of dynamic_library_path, introduce a wire incompatibility for clients, and require all plugin authors to check that their libraries are safe for use by any unprivileged user; we want to avoid that. Instead, introduce an output_plugin_libraries GUC so that DBAs can specify the output plugins that are trusted for use in logical decoding. For simplicity, superusers are subject to the restriction as well (though they're free to modify the GUC at will during a session, so no power is actually lost). The default setting is 'pgoutput, test_decoding'. If other third-party plugins are in use, DBAs will need to modify this parameter after they update. Some pointers have been added to the documentation to assist with this. Author: Jacob Champion <jacob.champion@enterprisedb.com> Reported-by: Vladimir Tokarev <vladimirelitokarev@gmail.com> Reported-by: Yu Kunpeng <yu443940816@live.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-6471 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/5d47df21e89967e351df5ad7aa93bc3af40db64a Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/test_decoding/expected/permissions.out | 11 +++ contrib/test_decoding/expected/repack.out | 1 - contrib/test_decoding/expected/slot.out | 3 + contrib/test_decoding/sql/permissions.sql | 8 +++ contrib/test_decoding/sql/slot.sql | 3 + doc/src/sgml/config.sgml | 57 +++++++++++++++ doc/src/sgml/logical-replication.sgml | 13 +++- src/backend/replication/logical/logical.c | 97 ++++++++++++++++++++++++-- src/backend/replication/pgrepack/pgrepack.c | 10 ++- src/backend/utils/misc/guc_parameters.dat | 9 +++ src/backend/utils/misc/guc_tables.c | 1 + src/backend/utils/misc/postgresql.conf.sample | 1 + src/bin/pg_dump/dumputils.c | 1 + src/bin/pg_upgrade/check.c | 85 +++++++++++++++++++++- src/bin/pg_upgrade/t/003_logical_slots.pl | 53 ++++++++++++-- src/include/replication/logical.h | 3 + src/test/subscription/t/100_bugs.pl | 27 ++++++- 17 files changed, 359 insertions(+), 24 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add an output_plugin_libraries GUC to bless trusted output plugins REPLICATION users were not previously subject to restrictions on output plugin paths, so they were able to bypass LOAD-time protections during logical decoding. Unfortunately, adding the standard LOAD restrictions now would retroactively require all third-party output plugins to be installed under the $libdir/plugins directory. This would prevent the use of dynamic_library_path, introduce a wire incompatibility for clients, and require all plugin authors to check that their libraries are safe for use by any unprivileged user; we want to avoid that. Instead, introduce an output_plugin_libraries GUC so that DBAs can specify the output plugins that are trusted for use in logical decoding. For simplicity, superusers are subject to the restriction as well (though they're free to modify the GUC at will during a session, so no power is actually lost). The default setting is 'pgoutput, test_decoding'. If other third-party plugins are in use, DBAs will need to modify this parameter after they update. Some pointers have been added to the documentation to assist with this. Author: Jacob Champion <jacob.champion@enterprisedb.com> Reported-by: Vladimir Tokarev <vladimirelitokarev@gmail.com> Reported-by: Yu Kunpeng <yu443940816@live.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-6471 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/2a29b607dbbba47c8e1c97458708e775bfa0e9bb Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/test_decoding/expected/permissions.out | 11 ++++ contrib/test_decoding/expected/slot.out | 3 + contrib/test_decoding/sql/permissions.sql | 8 +++ contrib/test_decoding/sql/slot.sql | 3 + doc/src/sgml/config.sgml | 57 +++++++++++++++++ doc/src/sgml/logical-replication.sgml | 15 ++++- src/backend/replication/logical/logical.c | 73 +++++++++++++++++++++- src/backend/utils/misc/guc_tables.c | 13 ++++ src/backend/utils/misc/postgresql.conf.sample | 1 + src/bin/pg_dump/dumputils.c | 1 + src/bin/pg_upgrade/check.c | 85 +++++++++++++++++++++++++- src/bin/pg_upgrade/t/003_logical_slots.pl | 49 +++++++++++++-- src/include/replication/logical.h | 3 + src/test/subscription/t/100_bugs.pl | 27 +++++++- 14 files changed, 333 insertions(+), 16 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add an output_plugin_libraries GUC to bless trusted output plugins REPLICATION users were not previously subject to restrictions on output plugin paths, so they were able to bypass LOAD-time protections during logical decoding. Unfortunately, adding the standard LOAD restrictions now would retroactively require all third-party output plugins to be installed under the $libdir/plugins directory. This would prevent the use of dynamic_library_path, introduce a wire incompatibility for clients, and require all plugin authors to check that their libraries are safe for use by any unprivileged user; we want to avoid that. Instead, introduce an output_plugin_libraries GUC so that DBAs can specify the output plugins that are trusted for use in logical decoding. For simplicity, superusers are subject to the restriction as well (though they're free to modify the GUC at will during a session, so no power is actually lost). The default setting is 'pgoutput, test_decoding'. If other third-party plugins are in use, DBAs will need to modify this parameter after they update. Some pointers have been added to the documentation to assist with this. Author: Jacob Champion <jacob.champion@enterprisedb.com> Reported-by: Vladimir Tokarev <vladimirelitokarev@gmail.com> Reported-by: Yu Kunpeng <yu443940816@live.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-6471 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/01992176e08169b7aedf2d61be9e22518b5c6640 Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/test_decoding/expected/permissions.out | 11 ++++ contrib/test_decoding/expected/slot.out | 3 + contrib/test_decoding/sql/permissions.sql | 8 +++ contrib/test_decoding/sql/slot.sql | 3 + doc/src/sgml/config.sgml | 57 +++++++++++++++++ doc/src/sgml/logical-replication.sgml | 9 +++ doc/src/sgml/ref/pgupgrade.sgml | 6 +- src/backend/replication/logical/logical.c | 73 +++++++++++++++++++++- src/backend/utils/misc/guc_tables.c | 13 ++++ src/backend/utils/misc/postgresql.conf.sample | 1 + src/bin/pg_dump/dumputils.c | 1 + src/bin/pg_upgrade/check.c | 85 +++++++++++++++++++++++++- src/bin/pg_upgrade/t/003_logical_slots.pl | 49 +++++++++++++-- src/include/replication/logical.h | 3 + src/test/subscription/t/100_bugs.pl | 28 ++++++++- 15 files changed, 336 insertions(+), 14 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi @ 2026-08-10 13:41 Noah Misch <noah@leadboat.com> 0 siblings, 0 replies; 5+ messages in thread From: Noah Misch @ 2026-08-10 13:41 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Add an output_plugin_libraries GUC to bless trusted output plugins REPLICATION users were not previously subject to restrictions on output plugin paths, so they were able to bypass LOAD-time protections during logical decoding. Unfortunately, adding the standard LOAD restrictions now would retroactively require all third-party output plugins to be installed under the $libdir/plugins directory. This would prevent the use of dynamic_library_path, introduce a wire incompatibility for clients, and require all plugin authors to check that their libraries are safe for use by any unprivileged user; we want to avoid that. Instead, introduce an output_plugin_libraries GUC so that DBAs can specify the output plugins that are trusted for use in logical decoding. For simplicity, superusers are subject to the restriction as well (though they're free to modify the GUC at will during a session, so no power is actually lost). The default setting is 'pgoutput, test_decoding'. If other third-party plugins are in use, DBAs will need to modify this parameter after they update. Some pointers have been added to the documentation to assist with this. Author: Jacob Champion <jacob.champion@enterprisedb.com> Reported-by: Vladimir Tokarev <vladimirelitokarev@gmail.com> Reported-by: Yu Kunpeng <yu443940816@live.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-6471 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4e1252ee56c33b8a1144b25b5803f47276662519 Author: Jacob Champion <jchampion@postgresql.org> Modified Files -------------- contrib/test_decoding/expected/permissions.out | 11 ++++ contrib/test_decoding/expected/slot.out | 3 + contrib/test_decoding/sql/permissions.sql | 8 +++ contrib/test_decoding/sql/slot.sql | 3 + doc/src/sgml/config.sgml | 57 +++++++++++++++++++ doc/src/sgml/logical-replication.sgml | 9 +++ src/backend/replication/logical/logical.c | 76 +++++++++++++++++++++++++- src/backend/utils/misc/guc_tables.c | 12 ++++ src/backend/utils/misc/postgresql.conf.sample | 1 + src/bin/pg_dump/dumputils.c | 1 + src/include/replication/logical.h | 3 + src/test/subscription/t/100_bugs.pl | 28 +++++++++- 12 files changed, 209 insertions(+), 3 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2026-08-10 13:41 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-10 13:41 pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi Noah Misch <noah@leadboat.com> 2026-08-10 13:41 pgsql: Add an output_plugin_libraries GUC to bless trusted output plugi Noah Misch <noah@leadboat.com>
This inbox is served by agora; see mirroring instructions for how to clone and mirror all data and code used for this inbox