From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
Date: Mon, 06 Jan 2020 18:26:45 -0500
Message-ID: <20919.1578353205@sss.pgh.pa.us> (raw)
In-Reply-To: <20200106230718.GN3195@tamriel.snowman.net>
References: <5889.1566415762@sss.pgh.pa.us>
<c15c0f58-79a9-4051-1f43-8fc06564df69@2ndquadrant.com>
<27727.1573052802@sss.pgh.pa.us>
<20191107183856.GY6962@tamriel.snowman.net>
<31658.1573152852@sss.pgh.pa.us>
<20191107191320.GZ6962@tamriel.snowman.net>
<CA+TgmobJFrdrjak+RJq=8FrSe6fFZC_qrOasneAmz2b3Ux7TYQ@mail.gmail.com>
<8636.1578335267@sss.pgh.pa.us>
<CA+TgmoZK=5EC2O13J3sfOUCvYtvjGtxUKg=wQ11Q-wy4sc4b+g@mail.gmail.com>
<2247.1578350318@sss.pgh.pa.us>
<20200106230718.GN3195@tamriel.snowman.net>
Stephen Frost <sfrost@snowman.net> writes:
> Perhaps I'm wrong, but I wouldn't think changing this from a
> default-role based approach over to a GRANT'able right using our
> existing GRANT system would be a lot of work.
Nobody has proposed a GRANT-based API that seems even close to
acceptable from where I sit. A new privilege bit on databases
is not it, at least not unless it works completely unlike
any other privilege bit. It's giving control to the DB owners,
not the superuser, and that seems like quite the wrong thing
for this purpose.
Or to put it another way: I think that the grantable role, which
ultimately is handed out by the superuser, is the primary permissions
API in this design. The fact that DB owners effectively have that
same privilege is a wart for backwards-compatibility. If we were
doing this from scratch, that wart wouldn't be there. What you're
proposing is to make the wart the primary (indeed sole) permissions
control mechanism for extension installation, and that just seems
completely wrong. Superusers would have effectively *no* say in
who gets to install trusted extensions, which is turning the whole
thing on its head I think; it's certainly not responding to either
of Robert's first two points.
If we were willing to break backwards compatibility, what I'd prefer
is to just have the grantable role, and to say that you have to grant
that to DB owners if you want them to be able to install PLs. I'm
not sure how loud the howls would be if we did that, but it'd be a
lot cleaner than any of these other ideas.
> I do *not* agree that this means we shouldn't have DB-level rights for
> database owners and that we should just go hand-hack the system to have
> explicit "is this the DB owner?" checks. The suggestion you're making
> here seems to imply we should go hack up the CREATE SCHEMA check to have
> it see if the user is the DB owner and then allow it, instead of doing
> our normal privilege checks, and I don't think that makes any sense.
Uh, what? Nothing in what I'm proposing goes anywhere near the
permissions needed for CREATE SCHEMA.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, robertmhaas@gmail.com, peter.eisentraut@2ndquadrant.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
In-Reply-To: <20919.1578353205@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox