From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Noah Misch <noah@leadboat.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Cc: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Subject: Re: Converting contrib SQL functions to new style
Date: Wed, 14 Apr 2021 13:41:44 -0400
Message-ID: <3566011.1618422104@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+TgmoYQB1qxb=v9xVi09-f_HRDDqwUwfcuNpsZ2SF-ePpWJcw@mail.gmail.com>
References: <3395418.1618352794@sss.pgh.pa.us>
<20210414020827.GA1232417@rfd.leadboat.com>
<3441172.1618369873@sss.pgh.pa.us>
<20210414125811.GB1263822@rfd.leadboat.com>
<CA+TgmoaF_DKSPRnbkakkOufWMFpOBsA8fwE-mF0fF7aeH20zqg@mail.gmail.com>
<3489827.1618411777@sss.pgh.pa.us>
<CA+TgmoYQB1qxb=v9xVi09-f_HRDDqwUwfcuNpsZ2SF-ePpWJcw@mail.gmail.com>
Robert Haas <robertmhaas@gmail.com> writes:
> On Wed, Apr 14, 2021 at 10:49 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> The situation of interest is where you are trying to install an extension
>> into a schema that also contains malicious objects. We've managed to make
>> most of the commands you might use in an extension script secure against
>> that situation, and Noah wants to hold SQL-function creation to that same
>> standard.
> Oh, I was forgetting that the creation schema has to be first in your
> search path. :-(
> Does the idea of allowing the creation schema to be set separately
> have any legs? Because it seems like that would help here.
Doesn't help that much, because you still have to reference objects
already created by your own extension, so it's hard to see how the
target schema won't need to be in the path.
[ thinks for awhile ... ]
Could we hack things so that extension scripts are only allowed to
reference objects created (a) by the system, (b) earlier in the
same script, or (c) owned by one of the declared prerequisite
extensions? Seems like that might provide a pretty bulletproof
defense against trojan-horse objects, though I'm not sure how much
of a pain it'd be to implement.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, robertmhaas@gmail.com, noah@leadboat.com, pgsql-hackers@lists.postgresql.org, peter.eisentraut@enterprisedb.com
Subject: Re: Converting contrib SQL functions to new style
In-Reply-To: <3566011.1618422104@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox