From: Tom Lane <tgl@sss.pgh.pa.us>
To: Julien Rouhaud <rjuju123@gmail.com>
Cc: Darafei Komяpa Praliaskouski <me@komzpa.net>
Cc: PostgreSQL Developers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Marking some contrib modules as trusted extensions
Date: Wed, 29 Jan 2020 16:38:53 -0500
Message-ID: <5280.1580333933@sss.pgh.pa.us> (raw)
In-Reply-To: <CAOBaU_YcmiKnLvb8kpLNA59Di9WA02V3_TCfJ8pAMriPfeRq_w@mail.gmail.com>
References: <32315.1580326876@sss.pgh.pa.us>
<CAC8Q8tKiedws=GNF_M50tV7qw7TJ0y_=+k+WJHPNc=VqScZr5A@mail.gmail.com>
<CAOBaU_YcmiKnLvb8kpLNA59Di9WA02V3_TCfJ8pAMriPfeRq_w@mail.gmail.com>
Julien Rouhaud <rjuju123@gmail.com> writes:
>>> Probably NO, if only because you'd need additional privileges
>>> to use these anyway:
>>> pg_stat_statements
> But the additional privileges are global, so assuming the extension
> has been properly setup, wouldn't it be sensible to ease the
> per-database installation? If not properly setup, there's no harm in
> creating the extension anyway.
Mmm, I'm not convinced --- the ability to see what statements are being
executed in other sessions (even other databases) is something that
paranoid installations might not be so happy about. Our previous
discussions about what privilege level is needed to look at
pg_stat_statements info were all made against a background assumption
that you needed some extra privilege to set up the view in the first
place. I think that would need another look or two before being
comfortable that we're not shifting the goal posts too far.
The bigger picture here is that I don't want to get push-back that
we've broken somebody's security posture by marking too many extensions
trusted. So for anything where there's any question about security
implications, we should err in the conservative direction of leaving
it untrusted.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, rjuju123@gmail.com, me@komzpa.net, pgsql-hackers@lists.postgresql.org
Subject: Re: Marking some contrib modules as trusted extensions
In-Reply-To: <5280.1580333933@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox