From: Tom Lane <tgl@sss.pgh.pa.us>
To: Chapman Flack <chap@anastigmatix.net>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: tracking owner of extension-managed objects
Date: Mon, 21 Dec 2015 12:46:44 -0500
Message-ID: <3486.1450720004@sss.pgh.pa.us> (raw)
In-Reply-To: <56783412.6090005@anastigmatix.net>
References: <56783412.6090005@anastigmatix.net>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
Chapman Flack <chap@anastigmatix.net> writes:
> PL/Java is an extension that manages some objects (jar files, which
> users can tell PL/Java to load, drop, or replace). The objects have
> owners (have had since PL/Java 1.1.0 anyway).
> When the owner tracking was added for 1.1.0 it recorded the owner oid.
> In 2006, before 1.3.0, it was changed to keep the owner name instead
> of the oid, in response to a bug report 1506 that involved the wrong
> owner name being shown after dump/restore into another db where the
> user oids were different.
Surely that is wrong. What happens after ALTER USER RENAME?
You should *store* user identities as OIDs in the catalogs, but textual
dumps should present them as names. The recently added datatype regrole
might help with doing this in extension-defined tables.
BTW, any such ownership relationship really needs to be reflected into
pg_shdepend, else someone might drop a role that still owns objects.
(I guess there are problems with extensions trying to do such things at
all, since we don't provide a way for extensions to hook into the DROP
mechanisms. Perhaps that should be fixed.)
> I am also wondering whether PL/Java ought to
> create references, or a trigger, on pg_authid to clean up if the user
> goes away; it currently doesn't.
A trigger would be useless, since we do not support triggers on system
catalogs, and are unlikely to start doing so, and even if we did it could
not fix ownerships appearing in other databases. But see pg_shdepend.
On the whole I'm afraid PL/Java may have gotten out in front of the
available extension infrastructure by trying to do this. But tell me:
why do you need to record ownership? Anything involving filesystem
references really ought to be superuser-only, I'd think, and the ability
to load arbitrary jarfiles even more so. If so, you really don't need to
remember which superuser created the reference; all superusers are
equivalent from a security standpoint.
regards, tom lane
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, chap@anastigmatix.net
Subject: Re: tracking owner of extension-managed objects
In-Reply-To: <3486.1450720004@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox