From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: pgsql-hackers@postgresql.org
Subject: Re: allow building trusted languages without the untrusted versions
Date: Mon, 23 May 2022 13:17:08 -0400
Message-ID: <1290329.1653326228@sss.pgh.pa.us> (raw)
In-Reply-To: <20220523165403.GC938919@nathanxps13>
References: <20220520225619.GA876272@nathanxps13>
<571753.1653092411@sss.pgh.pa.us>
<20220523165403.GC938919@nathanxps13>
Nathan Bossart <nathandbossart@gmail.com> writes:
> On Fri, May 20, 2022 at 08:20:11PM -0400, Tom Lane wrote:
>> Lastly, you've offered no reason to think this would provide any real
>> security improvement. Someone who's gained the ability to issue CREATE
>> EXTENSION on untrusted extensions has already got all the privileges he
>> needs; leaving out a few extension files is at most going to slow him
>> down a bit on the way to full filesystem access. (See, eg, COPY TO
>> PROGRAM.)
> I'd like to provide the ability to disallow these other things, too. This
> is intended to be a first step in that direction.
There would probably be some interest in a "--disable-disk-access"
configure option that did all of this stuff (and some more things
too), with the aim of locking down *all* known paths to filesystem
access. I don't see much value in retail options that do some of that.
In fact, what they might mostly accomplish is to give people a false
sense of security.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, nathandbossart@gmail.com
Subject: Re: allow building trusted languages without the untrusted versions
In-Reply-To: <1290329.1653326228@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox