From: Stephen Frost <sfrost@snowman.net>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
Date: Fri, 10 Jan 2020 15:50:03 -0500
Message-ID: <20200110205003.GD3195@tamriel.snowman.net> (raw)
In-Reply-To: <CA+TgmoYry3gSXN98s8hVyf8GVzTuqV8WuhCvpxNzMFEOdvx84w@mail.gmail.com>
References: <20200109163013.GR3195@tamriel.snowman.net>
<CA+TgmoYbsVCHNkX0g5QTZS=fgf9AXYoXHT2_4Jy6gpEFD5yBXQ@mail.gmail.com>
<6440.1578594907@sss.pgh.pa.us>
<CA+Tgmobk+ihJ498JF_XD=aLryTAujmmA5qn86qRUdBvd3g-hog@mail.gmail.com>
<9933.1578599320@sss.pgh.pa.us>
<CAOuzzgr2YXEBsK6oaW-B0PCp7VbQ5XujZ6qFGJbWYgyHkHZxvw@mail.gmail.com>
<12039.1578602021@sss.pgh.pa.us>
<20200110192646.GZ3195@tamriel.snowman.net>
<16979.1578685198@sss.pgh.pa.us>
<CA+TgmoYry3gSXN98s8hVyf8GVzTuqV8WuhCvpxNzMFEOdvx84w@mail.gmail.com>
Greetings,
* Robert Haas (robertmhaas@gmail.com) wrote:
> On Fri, Jan 10, 2020 at 2:40 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> > Well, the other direction we could go here, which I guess is what
> > you are arguing for, is to forget the new default role and just
> > say that marking an extension trusted allows it to be installed by
> > DB owners, full stop. That's nice and simple and creates no
> > backwards-compatibility issues. If we later decide that we want
> > a default role, or any other rules about who-can-install, we might
> > feel like this was a mistake --- but the backwards-compatibility issues
> > we'd incur by changing it later are exactly the same as what we'd have
> > today if we do something different from this. The only difference
> > is that there'd be more extensions affected later (assuming we mark
> > more things trusted).
>
> I agree with your analysis, but I'm still inclined to feel that the
> new pre-defined roll is a win.
>
> Generally, decoupled permissions are better. Being able to grant
> someone either A or B or both or neither is usually superior to having
> to grant either both permissions or neither.
Right- I like the idea of decoupled permissions too.
To be clear, I was advocating for a NEW DB-level privilege ('INSTALL' or
'CREATE EXTENSION' if we could make that work), so that we have it be
distinct from CREATE (which, today, really means 'CREATE SCHEMA').
I'd be willing to accept making this part of DB-level 'CREATE' rights if
there is a huge amount of push-back about burning a privilege bit for
it, but, as discussed up-thread, I don't think we should really be
stressing ourselves about that.
I do like the idea of having it be decoupled from explicit DB ownership,
so that a DB owner (or superuser) could say "I want this role to be able
to install extensions, but NOT run ALTER DATABASE", and optionally even
include ADMIN so that it could be further delegated (and also because
then it'd be just like the rest of our GRANT privilege system, and I
like that..).
Thanks,
Stephen
Attachments:
[application/pgp-signature] signature.asc (818B, ../20200110205003.GD3195@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, robertmhaas@gmail.com, tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
In-Reply-To: <20200110205003.GD3195@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox