Date: Wed, 25 May 2022 16:27:15 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Nathan Bossart <nathandbossart@gmail.com>,
	Robert Haas <robertmhaas@gmail.com>,
	"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: allow building trusted languages without the untrusted versions
Message-ID: <20220525202715.GS9030@tamriel.snowman.net>
References: 
 <CA+TgmoYZKLxftaZZvj4_-zHQ27CBeUs+KvggyU3qS79-7aQEPA@mail.gmail.com>
 <1354561.1653345768@sss.pgh.pa.us>
 <CA+TgmoZ_c0j4ut87_QCFm697Qq5Z_u66VZt2PYenfZVjUT1qRA@mail.gmail.com>
 <20220524172851.GA1191690@nathanxps13>
 <CA+TgmobOQiDXpYq6TgaCzH3p5c0Fko-wXqCjgd5YsR6RsX31vA@mail.gmail.com>
 <20220524205841.GA1254661@nathanxps13>
 <20220525174940.GQ9030@tamriel.snowman.net>
 <1978948.1653503311@sss.pgh.pa.us>
 <20220525200717.GR9030@tamriel.snowman.net>
 <2002561.1653510034@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="nccO0ldXW0cuDU6a"
Content-Disposition: inline
In-Reply-To: <2002561.1653510034@sss.pgh.pa.us>
User-Agent: Mutt/1.5.24 (2015-08-30)
Archived-At: 
 <https://www.postgresql.org/message-id/20220525202715.GS9030%40tamriel.snowman.net>
Precedence: bulk


--nccO0ldXW0cuDU6a
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > The very specific "it'd be nice to build PG w/o having untrusted
> > languages compiled in" is at least reasonably clearly contained and
> > reasonable to see if we are, in fact, doing what we claim we're doing
> > with such a switch.
>=20
> I agree that it's specific and easily measured.  What I don't get is why
> it's worth troubling over, if we acknowledge that keeping superusers from
> breaking out to OS access is infeasible.  At most, not having access to
> plpythonu means you've got to kluge something up involving COPY TO
> PROGRAM 'python'.

I agree that this seems to need more discussion and explanation as it
isn't actually sufficient by itself for "anyone who wants to disallow
file system access" as the initial post claimed.  If there isn't
sufficient explanation coming forward to support this change by itself
then we can reject it, but I don't think it makes sense to try and morph
it into something a lot more generic and a lot harder to actually get
right and document and guarantee.

> If somebody else is excited enough about it to do the legwork, I won't
> stand in the way particularly.  But it strikes me as a waste of effort,
> not only for the patch author but for everyone who has to read about
> or maintain the resulting configure options etc.

I agree that we need to be judicious in what configure options we add as
new options introduce additional maintenance effort.

Thanks,

Stephen

--nccO0ldXW0cuDU6a
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJijpEjAAoJEO1sijiDR2RVWggP/0Xq0JtOtK8oneg75WGm9ogQ
8f+QfwZ62mhGepYRMj59d0sNYR47fwWpHZc20OlDuDQzQcel3xQ94B1/427/VwUd
5aDprOr5DLTLmoQtomlXSl1v4mwmB8udIX6/2uEqP1SOddNYK5nWdJHm5rZMY0Si
0si8yzQQl0GicHLqGzXrqEd330AFPf9At2GuLoP+79MQYlXx3IMaun9HQUVRgY7+
J4w21S8XFtKAvtS6vY0UWa4WXS3Hp3Un94QvUB0ENiR59qIjv50VSZ6qNJzH2Ma/
3AqdCSdT07BTF/WZWNQuvgxhlVyllMx6NaQ1DhV62PEztIsmBpG5kgNr/EZfjLtb
B++PlsjpI5zgZZJ6LP5cgRrkelJKw0xlqKvVs9/4XX8uxWsPYihsRSUV1cpGKBYl
D3pgntlxDvHHmwPvmCh1JhsxNRd+gk4SeLCkG4vjN6XfE+rzyEV4iJ/iYulVpIPt
9wYMBTterWXiOEF+/gjtYUx83QQRnbOzNRm4TuEeifTzkQB/s2WtNI0ajZPktPTJ
0pliq+cNp7sxL7HpmG+BFF+P2a5DmqV5LthH8CYg5Lka6Xj/0IRHjznt8p1Xrevk
NYynwp2QXx8AFdMiKo5fHBLNZTvRI5yHyp6JT9OcK35Zt5iQxgzX8USaoBMHjNbe
lPCJBl69fN+ILwlxDhK5
=N5Pn
-----END PGP SIGNATURE-----

--nccO0ldXW0cuDU6a--