From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Nathan Bossart <nathandbossart@gmail.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: allow building trusted languages without the untrusted versions
Date: Wed, 25 May 2022 16:27:15 -0400
Message-ID: <20220525202715.GS9030@tamriel.snowman.net> (raw)
In-Reply-To: <2002561.1653510034@sss.pgh.pa.us>
References: <CA+TgmoYZKLxftaZZvj4_-zHQ27CBeUs+KvggyU3qS79-7aQEPA@mail.gmail.com>
<1354561.1653345768@sss.pgh.pa.us>
<CA+TgmoZ_c0j4ut87_QCFm697Qq5Z_u66VZt2PYenfZVjUT1qRA@mail.gmail.com>
<20220524172851.GA1191690@nathanxps13>
<CA+TgmobOQiDXpYq6TgaCzH3p5c0Fko-wXqCjgd5YsR6RsX31vA@mail.gmail.com>
<20220524205841.GA1254661@nathanxps13>
<20220525174940.GQ9030@tamriel.snowman.net>
<1978948.1653503311@sss.pgh.pa.us>
<20220525200717.GR9030@tamriel.snowman.net>
<2002561.1653510034@sss.pgh.pa.us>
Greetings,
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > The very specific "it'd be nice to build PG w/o having untrusted
> > languages compiled in" is at least reasonably clearly contained and
> > reasonable to see if we are, in fact, doing what we claim we're doing
> > with such a switch.
>
> I agree that it's specific and easily measured. What I don't get is why
> it's worth troubling over, if we acknowledge that keeping superusers from
> breaking out to OS access is infeasible. At most, not having access to
> plpythonu means you've got to kluge something up involving COPY TO
> PROGRAM 'python'.
I agree that this seems to need more discussion and explanation as it
isn't actually sufficient by itself for "anyone who wants to disallow
file system access" as the initial post claimed. If there isn't
sufficient explanation coming forward to support this change by itself
then we can reject it, but I don't think it makes sense to try and morph
it into something a lot more generic and a lot harder to actually get
right and document and guarantee.
> If somebody else is excited enough about it to do the legwork, I won't
> stand in the way particularly. But it strikes me as a waste of effort,
> not only for the patch author but for everyone who has to read about
> or maintain the resulting configure options etc.
I agree that we need to be judicious in what configure options we add as
new options introduce additional maintenance effort.
Thanks,
Stephen
Attachments:
[application/pgp-signature] signature.asc (818B, ../20220525202715.GS9030@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, tgl@sss.pgh.pa.us, nathandbossart@gmail.com, robertmhaas@gmail.com
Subject: Re: allow building trusted languages without the untrusted versions
In-Reply-To: <20220525202715.GS9030@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox