From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Andres Freund <andres@anarazel.de>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Marking some contrib modules as trusted extensions
Date: Tue, 18 Feb 2020 10:13:50 -0500
Message-ID: <20200218151349.GY3195@tamriel.snowman.net> (raw)
In-Reply-To: <13921.1581638230@sss.pgh.pa.us>
References: <32315.1580326876@sss.pgh.pa.us>
<20200213233015.r6rnubcvl4egdh5r@alap3.anarazel.de>
<13921.1581638230@sss.pgh.pa.us>
Greetings,
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Andres Freund <andres@anarazel.de> writes:
> > On 2020-01-29 14:41:16 -0500, Tom Lane wrote:
> >> pgcrypto
>
> > FWIW, given the code quality, I'm doubtful about putting itq into the trusted
> > section.
>
> I don't particularly have an opinion about that --- is it really that
> awful? If there is anything broken in it, wouldn't we consider that
> a security problem anyhow?
I would certainly hope so- and I would expect that to go for any of the
other extensions which are included in core. If we aren't going to
maintain them and deal with security issues in them, then we should drop
them.
Which goes back to my earlier complaint that having extensions in core
which aren't or can't be marked as trusted is not a position we should
put our users in. Either they're maintained and have been vetted
through our commit process, or they aren't and should be removed.
> > Especially with FROM UNPACKAGED it seems like it'd be fairly easy to get
> > an extension script to do dangerous things (as superuser). One could
> > just create pre-existing objects that have *not* been created by a
> > previous version, and some upgrade scripts would do pretty weird
> > stuff. There's several that do things like updating catalogs directly
> > etc. It seems to me that FROM UNPACKAGED shouldn't support trusted.
>
> Hmm, seems like a reasonable idea, but I'm not quite sure how to mechanize
> it given that "unpackaged" isn't magic in any way so far as extension.c
> is concerned. Maybe we could decide that the time for supporting easy
> updates from pre-9.1 is past, and just remove all the unpackaged-to-XXX
> scripts? Maybe even remove the "FROM version" option altogether.
I agree in general with dropping the unpackaged-to-XXX bits.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, tgl@sss.pgh.pa.us, andres@anarazel.de, pgsql-hackers@lists.postgresql.org
Subject: Re: Marking some contrib modules as trusted extensions
In-Reply-To: <20200218151349.GY3195@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox