Message-ID: <923cf8e8811bccc8dc9c901e7fb0f58aab2dd2f4.camel@cybertec.at>
Subject: Re: [PATCH] New predefined role pg_manage_extensions
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Tom Lane <tgl@sss.pgh.pa.us>, Robert Haas <robertmhaas@gmail.com>
Cc: Michael Banck <mbanck@gmx.net>, Jelte Fennema-Nio <postgres@jeltef.nl>, 
 PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: Wed, 09 Apr 2025 10:42:36 +0200
In-Reply-To: <2738790.1743894439@sss.pgh.pa.us>
References: <65a1524e.050a0220.49266.7670@mx.google.com>
	 <CAGECzQQ2HB85N9PjTAdDTpFCciQmpeE2PcXbc8EKhSF=RPi3fA@mail.gmail.com>
	 <CA+Tgmoa3OA+1T-SBDLkVqgYW1cFSjuSF=L_wh=CJM+k=P+8OAA@mail.gmail.com>
	 <CAGECzQRjkyiQ9b4vB2UDwppX4T3_SNhjYxMog4jxCSc6PEPKag@mail.gmail.com>
	 <CA+TgmoZw-+qLZnFSa-6PvkBVFa2iuJVTarP0EnRUgwBe-47XfA@mail.gmail.com>
	 <67cb04a8.170a0220.4ffef.a81e@mx.google.com>
	 <CA+TgmoZ_JzehEBLPecSnHfavDvwd5beDWXSnyV7GZxUjXqhYZQ@mail.gmail.com>
	 <1021640.1741364484@sss.pgh.pa.us>
	 <CA+TgmoZ+D8YvQouss5Kv=ZQPw1SzEZZyECP0MsOqTPd+3Z1VGw@mail.gmail.com>
	 <2738790.1743894439@sss.pgh.pa.us>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.54.3 (3.54.3-1.fc41) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/923cf8e8811bccc8dc9c901e7fb0f58aab2dd2f4.camel%40cybertec.at>
Precedence: bulk

On Sat, 2025-04-05 at 19:07 -0400, Tom Lane wrote:
> I took another look at this patch, and I still can't persuade
> myself that a good case has been made for it.  There are too
> many scenarios where pg_manage_extensions would be a security
> problem and too few where it seems to really improve manageability.
>=20
> As an example, it was asserted upthread that it's not a security
> problem to let someone install plpython3u, because they still
> couldn't create any plpython3u functions unless they were
> superuser.  Well, fine, but then what's the point of installing
> it?  If there is someone around with enough privilege to use
> plpython3u, that person can install it first.
>=20
> I also don't buy the argument that service providers would be
> unwilling to set the "trusted" flag on extensions that for whatever
> reason they are willing to let be installed by non-superusers.
> This thread is full of (unsupported) assertions that those same
> providers are making far more invasive changes to the PG code base
> to achieve their desired results.
>=20
> Robert Haas <robertmhaas@gmail.com> writes:
> > I agree, but I also don't want the security decisions that the core
> > project takes to become irrelevant in practice. It seems like what's
> > starting to happen is that all of the cloud providers end up finding
> > the same issues and working around them in very similar ways and they
> > don't do anything in PostgreSQL itself, I guess because that would
> > require winning an argument on the mailing list.
>=20
> It would at least require showing up on the mailing list.
> None of the assertions made in this thread about what cloud
> providers are doing have been supported by a whit of evidence
> about that.
>=20
> What I'm wishing for is that some of the providers would show up here
> and provide specific details (preferably patches) about what they are
> changing and why.  Then we could have an informed discussion about
> how to make their lives less painful in the future.  Right now
> I think we're guessing --- I certainly am.  Maybe some of the people
> on this thread have access to such details, but they aren't sharing.

So - should this patch be rejected or moved to the next CF in the hope
to attract some review from said hosting providers?

Michael, do you know any hosting providers you can prompt to comment?

Yours,
Laurenz Albe