public inbox for [email protected]  

help / color / mirror / Atom feed

From: Andreas Karlsson <[email protected]>
To: vaibhave postgres <[email protected]>
To: [email protected]
Subject: Re: Rendezvous variables: safe to pass an access token between two extensions?
Date: Thu, 9 Jul 2026 12:44:19 +0200
Message-ID: <[email protected]> (raw)
In-Reply-To: <CAM_eQjy8rG7yExX5JMhA3UKycWfvtw6w-x-SBV+sPmKWAmXvMA@mail.gmail.com>
References: <CAM_eQjy8rG7yExX5JMhA3UKycWfvtw6w-x-SBV+sPmKWAmXvMA@mail.gmail.com>

On 7/9/26 12:36, vaibhave postgres wrote:
> Since rendezvous variables are just a global, name-keyed void * with no 
> notion of who populated the slot, is it safe to pass a sensitive value 
> (the token) this way? My worry is that another loaded module could 
> register the same name and receive the token instead of the intended 
> extension B.
> 
> Is there a supported way to verify the publisher of a rendezvous 
> variable, or is there a better way to do this? Any prior art would help.

As PostgreSQL extensions are not sandboxed and therefore can access the 
full memory of the backend (including shared memory) I do not think this 
is really a concern specific to rendezvous variables. If an extension 
wants to steal an access token it can as it can just grab them form 
anywhere in the process memory.

You need to either audit all extensions you load or trust your packagers 
and extension authors. If you load extensions you do not trust they can 
do anything the postgres process can do.

-- 
Andreas Karlsson
Percona

view thread (2+ messages)

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: Rendezvous variables: safe to pass an access token between two extensions?
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox