From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
Date: Thu, 09 Jan 2020 13:35:07 -0500
Message-ID: <6440.1578594907@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+TgmoYbsVCHNkX0g5QTZS=fgf9AXYoXHT2_4Jy6gpEFD5yBXQ@mail.gmail.com>
References: <20200107181727.GB3195@tamriel.snowman.net>
<CA+Tgmob1cEG=CHnUnryBKdpLhg+jxXH0ZRXpF2OGX1WU8hgQvQ@mail.gmail.com>
<20200107213618.GC3195@tamriel.snowman.net>
<CA+TgmoY0yY-mN6FUjD11pruaEoLDHmjD2kS6Y-sVEwk2XwXX2A@mail.gmail.com>
<20200108003247.GE3195@tamriel.snowman.net>
<CA+TgmoYB4z5R1E61qtwJHDrogsY+dg4R48TRNFSiaO3JDT=X3g@mail.gmail.com>
<20200108230935.GN3195@tamriel.snowman.net>
<CA+TgmoYKLetGg7wRREYUQ=M+gSjYfZBb2AV6ad5C8aurJFqPjA@mail.gmail.com>
<20200109150911.GP3195@tamriel.snowman.net>
<CA+Tgmob62hXe2Xkn4S7wRFpe6tPF=Gc32OBRzcS1GzGL=vj+4w@mail.gmail.com>
<20200109163013.GR3195@tamriel.snowman.net>
<CA+TgmoYbsVCHNkX0g5QTZS=fgf9AXYoXHT2_4Jy6gpEFD5yBXQ@mail.gmail.com>
Robert Haas <robertmhaas@gmail.com> writes:
> Again, as I said upthread, Tom had the exact feature about which I am
> talking in the first version of the patch. That is a strong argument
> in favor of it being practical. It's also a pretty good argument that
> it is at least potentially useful, because Tom doesn't usually do
> useless things for no reason.
To try to clarify that a bit: I think there is certainly some value
in allowing superusers to control which extensions could be installed
by non-superusers, further restricting what we may think is trustworthy.
However, I felt at the time that my GUC-based implementation of that
was ugly, and then Peter raised some concrete points against it,
so I took it out. I don't want to put it back in the same form.
I think we could leave designing a replacement for later, because it's
pretty optional, especially if we aren't aggressive about promoting
contrib modules to "trusted" status. I don't agree that the lack of
such a feature is a reason not to commit what I've got.
In any case, AFAICT most of the heat-vs-light in this thread has not
been about which extensions are trustworthy, but about which users
should be allowed to install extensions, which seems like a totally
independent discussion. And controlling that is also a feature that
we don't have today, so I'd rather get a minimal feature committed
for v13 and then later consider whether we need more functionality.
The idea of a DB-level INSTALL privilege addresses the second
point not the first, unless I'm totally misunderstanding it. As
I said before, I'm not terribly comfortable with handing control
of that over to non-superuser DB owners, and I sure don't see why
doing so should be a required part of the minimal feature.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, robertmhaas@gmail.com, sfrost@snowman.net, peter.eisentraut@2ndquadrant.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Removing pg_pltemplate and creating "trustable" extensions
In-Reply-To: <6440.1578594907@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox