From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: Robert Haas <robertmhaas@gmail.com>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
In-reply-to: <20200110205003.GD3195@tamriel.snowman.net>
References: <20200109163013.GR3195@tamriel.snowman.net>
 <CA+TgmoYbsVCHNkX0g5QTZS=fgf9AXYoXHT2_4Jy6gpEFD5yBXQ@mail.gmail.com>
 <6440.1578594907@sss.pgh.pa.us>
 <CA+Tgmobk+ihJ498JF_XD=aLryTAujmmA5qn86qRUdBvd3g-hog@mail.gmail.com>
 <9933.1578599320@sss.pgh.pa.us>
 <CAOuzzgr2YXEBsK6oaW-B0PCp7VbQ5XujZ6qFGJbWYgyHkHZxvw@mail.gmail.com>
 <12039.1578602021@sss.pgh.pa.us> <20200110192646.GZ3195@tamriel.snowman.net>
 <16979.1578685198@sss.pgh.pa.us>
 <CA+TgmoYry3gSXN98s8hVyf8GVzTuqV8WuhCvpxNzMFEOdvx84w@mail.gmail.com>
 <20200110205003.GD3195@tamriel.snowman.net>
Comments: In-reply-to Stephen Frost <sfrost@snowman.net>
	message dated "Fri, 10 Jan 2020 15:50:03 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <27617.1578696790.1@sss.pgh.pa.us>
Date: Fri, 10 Jan 2020 17:53:10 -0500
Message-ID: <27618.1578696790@sss.pgh.pa.us>
Precedence: bulk

Stephen Frost <sfrost@snowman.net> writes:
> To be clear, I was advocating for a NEW DB-level privilege ('INSTALL' or
> 'CREATE EXTENSION' if we could make that work), so that we have it be
> distinct from CREATE (which, today, really means 'CREATE SCHEMA').

I still say this is wrong, or at least pointless, because it'd be a
right that any DB owner could grant to himself.  If we're to have any
meaningful access control on extension installation, the privilege
would have to be attached to some other object ... and there's no clear
candidate for what.  As someone noted awhile back, if we could somehow
attach ACLs to potentially-installable extensions, that might be an
interesting avenue to pursue.  That's well beyond what I'm willing
to pursue for v13, though.

In the meantime, though, this idea as stated doesn't do anything except
let a DB owner grant install privileges to someone else.  I'm not even
convinced that we want that, or that anyone needs it (I can recall zero
such requests related to PLs in the past).  And for sure it does not
belong in a minimal implementation of this feature.

			regards, tom lane