From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Nathan Bossart <nathandbossart@gmail.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: allow building trusted languages without the untrusted versions
Date: Wed, 25 May 2022 14:28:31 -0400
Message-ID: <1978948.1653503311@sss.pgh.pa.us> (raw)
In-Reply-To: <20220525174940.GQ9030@tamriel.snowman.net>
References: <20220523165403.GC938919@nathanxps13>
<1290329.1653326228@sss.pgh.pa.us>
<CA+TgmoY-Xy_ObfYVUTSamD8BmW8npaktbr65JtnkW-c1VQobVA@mail.gmail.com>
<1333860.1653338790@sss.pgh.pa.us>
<CA+TgmoYZKLxftaZZvj4_-zHQ27CBeUs+KvggyU3qS79-7aQEPA@mail.gmail.com>
<1354561.1653345768@sss.pgh.pa.us>
<CA+TgmoZ_c0j4ut87_QCFm697Qq5Z_u66VZt2PYenfZVjUT1qRA@mail.gmail.com>
<20220524172851.GA1191690@nathanxps13>
<CA+TgmobOQiDXpYq6TgaCzH3p5c0Fko-wXqCjgd5YsR6RsX31vA@mail.gmail.com>
<20220524205841.GA1254661@nathanxps13>
<20220525174940.GQ9030@tamriel.snowman.net>
Stephen Frost <sfrost@snowman.net> writes:
> I really don't think this is going to be anywhere near as
> straight-forward as it might appear to be to prevent a superuser from
> being able to break out of PG.
This gets back to the point I made before about it not being worthwhile
to implement half-measures. There is a whole lot of history and code
details associated with the presumption that superuser gives you OS
access, and I'm certainly prepared to believe that turning that off
is a fool's errand.
Perhaps a better answer for providers who need something like this
is to sandbox the Postgres server using OS-provided facilities.
> Instead, we should be moving in the
> direction of making it so that there doesn't need to be a superuser
> that's ever logged into except under serious emergency situations where
> the system is built to require multi-person access to do so.
I'm a little skeptical that our present design direction really moves
the needle very far in this area. We've sliced and diced superuser
aplenty, but that doesn't make individual capabilities such as
pg_write_all_data or ALTER SYSTEM any less dangerous from the standpoint
of someone trying to prevent breaking out.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, nathandbossart@gmail.com, robertmhaas@gmail.com
Subject: Re: allow building trusted languages without the untrusted versions
In-Reply-To: <1978948.1653503311@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox