From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Nathan Bossart <nathandbossart@gmail.com>,
        Robert Haas <robertmhaas@gmail.com>,
        "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: allow building trusted languages without the untrusted versions
In-reply-to: <20220525200717.GR9030@tamriel.snowman.net>
References: 
 <CA+TgmoY-Xy_ObfYVUTSamD8BmW8npaktbr65JtnkW-c1VQobVA@mail.gmail.com>
 <1333860.1653338790@sss.pgh.pa.us>
 <CA+TgmoYZKLxftaZZvj4_-zHQ27CBeUs+KvggyU3qS79-7aQEPA@mail.gmail.com>
 <1354561.1653345768@sss.pgh.pa.us>
 <CA+TgmoZ_c0j4ut87_QCFm697Qq5Z_u66VZt2PYenfZVjUT1qRA@mail.gmail.com>
 <20220524172851.GA1191690@nathanxps13>
 <CA+TgmobOQiDXpYq6TgaCzH3p5c0Fko-wXqCjgd5YsR6RsX31vA@mail.gmail.com>
 <20220524205841.GA1254661@nathanxps13>
 <20220525174940.GQ9030@tamriel.snowman.net>
 <1978948.1653503311@sss.pgh.pa.us>
 <20220525200717.GR9030@tamriel.snowman.net>
Comments: In-reply-to Stephen Frost <sfrost@snowman.net>
	message dated "Wed, 25 May 2022 16:07:17 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2002560.1653510034.1@sss.pgh.pa.us>
Date: Wed, 25 May 2022 16:20:34 -0400
Message-ID: <2002561.1653510034@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2002561.1653510034%40sss.pgh.pa.us>
Precedence: bulk

Stephen Frost <sfrost@snowman.net> writes:
> The very specific "it'd be nice to build PG w/o having untrusted
> languages compiled in" is at least reasonably clearly contained and
> reasonable to see if we are, in fact, doing what we claim we're doing
> with such a switch.

I agree that it's specific and easily measured.  What I don't get is why
it's worth troubling over, if we acknowledge that keeping superusers from
breaking out to OS access is infeasible.  At most, not having access to
plpythonu means you've got to kluge something up involving COPY TO
PROGRAM 'python'.

If somebody else is excited enough about it to do the legwork, I won't
stand in the way particularly.  But it strikes me as a waste of effort,
not only for the patch author but for everyone who has to read about
or maintain the resulting configure options etc.

			regards, tom lane