From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Robert Haas <robertmhaas@gmail.com>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
In-reply-to: <20200109200028.GX3195@tamriel.snowman.net>
References: <20200108003247.GE3195@tamriel.snowman.net>
 <CA+TgmoYB4z5R1E61qtwJHDrogsY+dg4R48TRNFSiaO3JDT=X3g@mail.gmail.com>
 <20200108230935.GN3195@tamriel.snowman.net>
 <CA+TgmoYKLetGg7wRREYUQ=M+gSjYfZBb2AV6ad5C8aurJFqPjA@mail.gmail.com>
 <20200109150911.GP3195@tamriel.snowman.net>
 <CA+Tgmob62hXe2Xkn4S7wRFpe6tPF=Gc32OBRzcS1GzGL=vj+4w@mail.gmail.com>
 <20200109163013.GR3195@tamriel.snowman.net>
 <CA+TgmoYbsVCHNkX0g5QTZS=fgf9AXYoXHT2_4Jy6gpEFD5yBXQ@mail.gmail.com>
 <6440.1578594907@sss.pgh.pa.us>
 <CA+Tgmobk+ihJ498JF_XD=aLryTAujmmA5qn86qRUdBvd3g-hog@mail.gmail.com>
 <20200109200028.GX3195@tamriel.snowman.net>
Comments: In-reply-to Stephen Frost <sfrost@snowman.net>
	message dated "Thu, 09 Jan 2020 15:00:28 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <11272.1578601110.1@sss.pgh.pa.us>
Date: Thu, 09 Jan 2020 15:18:30 -0500
Message-ID: <11273.1578601110@sss.pgh.pa.us>
Precedence: bulk

Stephen Frost <sfrost@snowman.net> writes:
> So I'm at a loss for why there is this insistence on a default role and
> a superuser-explicit-granting based approach that goes beyond "is it
> installed on the filesystem?" and "is it marked as trusted?".

Okay, so it seems like we're down to just this one point of contention.
You feel that the superuser can control what is in the extension library
directory and that that ought to be sufficient control.  I disagree
with that, for two reasons:

* ISTM that that's assuming that the DBA and the sysadmin are the same
person (or at least hold identical views on this subject).  In many
installations it'd only be root who has control over what's in that
directory, and I don't think it's unreasonable for the DBA to wish
to be able to exercise additional filtering.

* The point of a default role would be for the DBA to be able to
control which database users can install extensions.  Even if the
DBA has full authority over the extension library, that would not
provide control over who can install, only over what is available
for any of them to install.

			regards, tom lane