From: Tom Lane <tgl@sss.pgh.pa.us>
To: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
cc: pgsql-hackers@postgresql.org
Subject: Re: Possibility to disable `ALTER SYSTEM`
In-reply-to: <CA+VUV5rEKt2+CdC_KUaPoihMu+i5ChT4WVNTr4CD5-xXZUfuQw@mail.gmail.com>
References: <CA+VUV5rEKt2+CdC_KUaPoihMu+i5ChT4WVNTr4CD5-xXZUfuQw@mail.gmail.com>
Comments: In-reply-to Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
	message dated "Thu, 07 Sep 2023 21:51:14 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1756005.1694118434.1@sss.pgh.pa.us>
Date: Thu, 07 Sep 2023 16:27:14 -0400
Message-ID: <1756006.1694118434@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/1756006.1694118434%40sss.pgh.pa.us>
Precedence: bulk

Gabriele Bartolini <gabriele.bartolini@enterprisedb.com> writes:
> I would like to propose a patch that allows administrators to disable
> `ALTER SYSTEM` via either a runt-time option to pass to the Postgres server
> process at startup (e.g. `--disable-alter-system=true`, false by default)
> or a new GUC (or even both), without changing the current default method of
> the server.

ALTER SYSTEM is already heavily restricted.  I don't think we need random
kluges added to the permissions system.  I especially don't believe in
kluges to the effect of "superuser doesn't have all permissions anymore".

If you nonetheless feel that that's a good idea for your use case,
you can implement the restriction with an event trigger or the like.

			regards, tom lane