pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Chao Li <li.evan.chao@gmail.com>
To: Jacob Champion <jacob.champion@enterprisedb.com>
Cc: Hayato Kuroda (Fujitsu) <kuroda.hayato@fujitsu.com>
Cc: pgsql-hackers@lists.postgresql.org <pgsql-hackers@lists.postgresql.org>
Cc: Fujii Masao <masao.fujii@gmail.com>
Subject: Re: pg_createsubscriber does not check output_plugin_libraries
Date: Tue, 15 Sep 2026 13:47:49 +0800
Message-ID: <EB0EDFFC-F11D-410A-9110-43AEDE63F614@gmail.com> (raw)
In-Reply-To: <CAOYmi+=AoWyU=MqfsFWUP2QHxsydHG9w2VuNnzswoBZCsCOobg@mail.gmail.com>
References: <OS9PR01MB12149618ED793133C85A61A34F5B52@OS9PR01MB12149.jpnprd01.prod.outlook.com>
	<CAOYmi+=AoWyU=MqfsFWUP2QHxsydHG9w2VuNnzswoBZCsCOobg@mail.gmail.com>



> On Sep 9, 2026, at 00:33, Jacob Champion <jacob.champion@enterprisedb.com> wrote:
> 
> On Thu, Sep 3, 2026 at 8:49 PM Hayato Kuroda (Fujitsu)
> <kuroda.hayato@fujitsu.com> wrote:
>> 
>> Hi hackers,
>> (CC: Jacob, who was an author of 226e49cb)
> 
> Hi! Thanks for the report, and sorry for the delay over the US holiday weekend.
> 
>> 226e49cb added a GUC parameter to specify trusted output plugins, and slot creation
>> would fail if a give plugin is not listed there.
> 
> Right. (pgoutput is in that parameter by default, so the case in
> question requires a DBA to remove it and then be surprised at the
> results.)
> 
>> pg_createsubscriber command creates replication slots with plugin 'pgoutput',
>> without checking the GUC. This meant if the plugin name is not specified in the
>> parameter, --dry-run mode passes but actual convertion fails.
>> It's very surprising for users and should be avoided.
> 
> Isn't this the same behavior as for all other permissions issues? We
> don't check for
> - REPLICATION privs
> - permission for FOR ALL TABLES
> - CREATE on the target databases
> - ownership on a publication to drop
> - permission to call pg_log_standby_snapshot()
> 
> Looks like all those pass a --dry-run and then fail later.
> 

That’s a fair point. The distinction I had in mind is that this patch explicitly adds a check for output_plugin_libraries to make --dry-run more useful. But when the caller cannot read that setting, pg_createsubscriber simply does not have enough information to perform the check. Would it make sense to print a warning in that case, rather than silently letting --dry-run succeed?

Best regards,
--
Chao Li (Evan)
HighGo Software Co., Ltd.
https://www.highgo.com/









view thread (25+ messages)  latest in thread

Message-ID: <EB0EDFFC-F11D-410A-9110-43AEDE63F614@gmail.com>
Permalink:  ../EB0EDFFC-F11D-410A-9110-43AEDE63F614@gmail.com/
Also on:    postgresql.org/message-id/EB0EDFFC-F11D-410A-9110-43AEDE63F614@gmail.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: li.evan.chao@gmail.com, jacob.champion@enterprisedb.com, kuroda.hayato@fujitsu.com, pgsql-hackers@lists.postgresql.org, masao.fujii@gmail.com
  Subject: Re: pg_createsubscriber does not check output_plugin_libraries
  In-Reply-To: <EB0EDFFC-F11D-410A-9110-43AEDE63F614@gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox