pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedcreate extension requires superuser?
2+ messages / 2 participants
[nested] [flat]
* create extension requires superuser?
@ 2020-02-07 21:26 PG Doc comments form <noreply@postgresql.org>
0 siblings, 1 reply; 2+ messages in thread
From: PG Doc comments form @ 2020-02-07 21:26 UTC (permalink / raw)
To: pgsql-docs@lists.postgresql.org; +Cc: randolph.a.strauss@nasa.gov
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/10/sql-createextension.html
Description:
https://www.postgresql.org/docs/10/sql-createextension.html
"For most extensions this means superuser or database owner privileges are
needed"
(this is the same text for version 12, but I haven't tried that version.)
If I create a database, I can't CREATE EXTENSION postgis;
unless I'm superuser. Is this bad documentation or is it just for this
extension?
It should be documented how to tell.
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: create extension requires superuser?
@ 2020-03-14 23:49 Bruce Momjian <bruce@momjian.us>
parent: PG Doc comments form <noreply@postgresql.org>
0 siblings, 0 replies; 2+ messages in thread
From: Bruce Momjian @ 2020-03-14 23:49 UTC (permalink / raw)
To: randolph.a.strauss@nasa.gov; pgsql-docs@lists.postgresql.org
On Fri, Feb 7, 2020 at 09:26:17PM +0000, PG Doc comments form wrote:
> The following documentation comment has been logged on the website:
>
> Page: https://www.postgresql.org/docs/10/sql-createextension.html
> Description:
>
> https://www.postgresql.org/docs/10/sql-createextension.html
> "For most extensions this means superuser or database owner privileges are
> needed"
> (this is the same text for version 12, but I haven't tried that version.)
>
> If I create a database, I can't CREATE EXTENSION postgis;
> unless I'm superuser. Is this bad documentation or is it just for this
> extension?
> It should be documented how to tell.
Well, our docs say:
https://www.postgresql.org/docs/12/sql-createextension.html
Loading an extension requires the same privileges that would be required
to create its component objects. For most extensions this means
superuser or database owner privileges are needed. The user who runs
CREATE EXTENSION becomes the owner of the extension for purposes of
later privilege checks, as well as the owner of any objects created by
the extension's script.
Looking at the adminpack extension, I think anyone can install it, but
most/all of the functions internally call requireSuperuser(), and that
errors for non-superusers with:
only superuser may access generic file functions
Unfortunately, there is no SQL-level ability to check which functions
require super-user rights. It is buried in the C code.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EnterpriseDB https://enterprisedb.com
+ As you are, so once was I. As I am, so you will be. +
+ Ancient Roman grave inscription +
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2020-03-14 23:49 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-02-07 21:26 create extension requires superuser? PG Doc comments form <noreply@postgresql.org>
2020-03-14 23:49 ` Bruce Momjian <bruce@momjian.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox