From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Cc: Robert Haas <robertmhaas@gmail.com>
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
Date: Fri, 10 Jan 2020 14:39:58 -0500
Message-ID: <16979.1578685198@sss.pgh.pa.us> (raw)
In-Reply-To: <20200110192646.GZ3195@tamriel.snowman.net>
References: <CA+TgmoYKLetGg7wRREYUQ=M+gSjYfZBb2AV6ad5C8aurJFqPjA@mail.gmail.com>
<20200109150911.GP3195@tamriel.snowman.net>
<CA+Tgmob62hXe2Xkn4S7wRFpe6tPF=Gc32OBRzcS1GzGL=vj+4w@mail.gmail.com>
<20200109163013.GR3195@tamriel.snowman.net>
<CA+TgmoYbsVCHNkX0g5QTZS=fgf9AXYoXHT2_4Jy6gpEFD5yBXQ@mail.gmail.com>
<6440.1578594907@sss.pgh.pa.us>
<CA+Tgmobk+ihJ498JF_XD=aLryTAujmmA5qn86qRUdBvd3g-hog@mail.gmail.com>
<9933.1578599320@sss.pgh.pa.us>
<CAOuzzgr2YXEBsK6oaW-B0PCp7VbQ5XujZ6qFGJbWYgyHkHZxvw@mail.gmail.com>
<12039.1578602021@sss.pgh.pa.us>
<20200110192646.GZ3195@tamriel.snowman.net>
Stephen Frost <sfrost@snowman.net> writes:
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> Don't see how this follows. It's somewhat accidental I think that
>> the existing behavior is tied to DB ownership. That's just because
>> at the time, that's the only sort of privilege we had that seemed
>> intermediate between superuser and Joe User. If we were designing
>> the behavior today, with default roles already a done deal for
>> handing out possibly-dangerous privileges, I think there's no
>> question that we'd be setting up this privilege as a default role
>> rather than tying it to DB ownership. We don't make DB ownership
>> a prerequisite to creating other sorts of functions, yet other
>> functions can be just as dangerous in some cases as C functions.
> I suppose I'll just have to say that I disagree. I see a lot of value
> in having a level between superuser and Joe User, and DB owner looks
> pretty natural as exactly that, particularly for creating database-level
> objects like extensions.
Well, the other direction we could go here, which I guess is what
you are arguing for, is to forget the new default role and just
say that marking an extension trusted allows it to be installed by
DB owners, full stop. That's nice and simple and creates no
backwards-compatibility issues. If we later decide that we want
a default role, or any other rules about who-can-install, we might
feel like this was a mistake --- but the backwards-compatibility issues
we'd incur by changing it later are exactly the same as what we'd have
today if we do something different from this. The only difference
is that there'd be more extensions affected later (assuming we mark
more things trusted).
I'm willing to go with this solution if it'll end the argument.
Robert, Peter, what do you think?
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, pgsql-hackers@lists.postgresql.org, robertmhaas@gmail.com
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
In-Reply-To: <16979.1578685198@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox