pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Nathan Bossart <nathandbossart@gmail.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: allow building trusted languages without the untrusted versions
Date: Wed, 25 May 2022 16:34:54 -0400
Message-ID: <2005351.1653510894@sss.pgh.pa.us> (raw)
In-Reply-To: <20220525202715.GS9030@tamriel.snowman.net>
References: <CA+TgmoYZKLxftaZZvj4_-zHQ27CBeUs+KvggyU3qS79-7aQEPA@mail.gmail.com>
	<1354561.1653345768@sss.pgh.pa.us>
	<CA+TgmoZ_c0j4ut87_QCFm697Qq5Z_u66VZt2PYenfZVjUT1qRA@mail.gmail.com>
	<20220524172851.GA1191690@nathanxps13>
	<CA+TgmobOQiDXpYq6TgaCzH3p5c0Fko-wXqCjgd5YsR6RsX31vA@mail.gmail.com>
	<20220524205841.GA1254661@nathanxps13>
	<20220525174940.GQ9030@tamriel.snowman.net>
	<1978948.1653503311@sss.pgh.pa.us>
	<20220525200717.GR9030@tamriel.snowman.net>
	<2002561.1653510034@sss.pgh.pa.us>
	<20220525202715.GS9030@tamriel.snowman.net>

Stephen Frost <sfrost@snowman.net> writes:
> I agree that this seems to need more discussion and explanation as it
> isn't actually sufficient by itself for "anyone who wants to disallow
> file system access" as the initial post claimed.  If there isn't
> sufficient explanation coming forward to support this change by itself
> then we can reject it, but I don't think it makes sense to try and morph
> it into something a lot more generic and a lot harder to actually get
> right and document and guarantee.

The reason I pushed the discussion in that direction was that I was
curious to see if --disable-disk-access could actually be a thing.
If it could, it'd have clear utility for at least some service providers.
But it seems the (preliminary?) conclusion is "no, we still can't do that
in any way that's credibly bulletproof".  So yeah, that justification
for the currently-proposed patch doesn't seem to hold water.

			regards, tom lane





view thread (35+ messages)  latest in thread

Message-ID: <2005351.1653510894@sss.pgh.pa.us>
Permalink:  ../2005351.1653510894@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/2005351.1653510894@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, nathandbossart@gmail.com, robertmhaas@gmail.com
  Subject: Re: allow building trusted languages without the untrusted versions
  In-Reply-To: <2005351.1653510894@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox