From: Tom Lane <tgl@sss.pgh.pa.us>
To: Tomas Vondra <tomas.vondra@2ndquadrant.com>
cc: Dean Rasheed <dean.a.rasheed@gmail.com>,
        Stephen Frost <sfrost@snowman.net>,
 Andres Freund <andres@anarazel.de>,
        PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Multivariate MCV stats can leak data to unprivileged users
In-reply-to: <20190519173845.tgf7ku3vigwgndn5@development>
References: 
 <CAEZATCW3iAJnU8opUCXb2i_-8syU7on4cdXLWHBeWr04v67HoQ@mail.gmail.com>
 <4E0E0C14-C476-446A-835F-CC3558709DA9@anarazel.de>
 <20190518190042.2y33h4toxk4fxv5t@development> <568.1558208711@sss.pgh.pa.us>
 <20190518232812.qpnjmydlx3uzzsj7@development>
 <20866.1558223060@sss.pgh.pa.us> <20190518234841.GE6197@tamriel.snowman.net>
 <CAEZATCUcoAKrn-1NFkDN7md-wt6CQev0JXa+Tv31T9Jjkxgx5Q@mail.gmail.com>
 <23229.1558275148@sss.pgh.pa.us> <23772.1558276123@sss.pgh.pa.us>
 <20190519173845.tgf7ku3vigwgndn5@development>
Comments: In-reply-to Tomas Vondra <tomas.vondra@2ndquadrant.com>
	message dated "Sun, 19 May 2019 19:38:45 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2508.1558289694.1@sss.pgh.pa.us>
Date: Sun, 19 May 2019 14:14:54 -0400
Message-ID: <2509.1558289694@sss.pgh.pa.us>
Precedence: bulk

Tomas Vondra <tomas.vondra@2ndquadrant.com> writes:
> On Sun, May 19, 2019 at 10:28:43AM -0400, Tom Lane wrote:
>> No, wait, scratch that.  We could fold the three existing types
>> pg_ndistinct, pg_dependencies, pg_mcv_list into one new type, say
>> "pg_stats_ext_data", where the actual storage would need to have an
>> ID field (so we'd waste a byte or two duplicating the externally
>> visible stxkind field inside stxdata).  The output function for this
>> type is just a switch over the existing code.  The big advantage of
>> this way compared to the current approach is that adding a new
>> ext-stats type requires *zero* work with adding new catalog entries.
>> Just add another switch case in pg_stats_ext_data_out() and you're
>> done.

> The annoying thing is that this undoes the protections provided by special
> data types generated only in internally. It's not possible to generate
> e.g. pg_mcv_list values in user code (except for C code, at which points
> all bets are off anyway). By abandoning this and reverting to bytea anyone
> could craft a bytea and claim it's a statistic value.

That would have been true of the original proposal, but not of this
modified one.

			regards, tom lane