From: Tom Lane <tgl@sss.pgh.pa.us>
To: Pavel Stehule <pavel.stehule@gmail.com>
Cc: Merlin Moncure <mmoncure@gmail.com>
Cc: Alvaro Herrera <alvherre@commandprompt.com>
Cc: Joshua D. Drake <jd@commandprompt.com>
Cc: Trevor Talbot <quension@gmail.com>
Cc: Roberts, Jon <Jon.Roberts@asurion.com>
Cc: Kris Jurka <books@ejurka.com>
Cc: Jonah H. Harris <jonah.harris@gmail.com>
Cc: Bill Moran <wmoran@collaborativefusion.com>
Cc: Pgsql Hackers <pgsql-hackers@postgresql.org>
Subject: Re: function body actors (was: [PERFORM] viewing source code)
Date: Fri, 21 Dec 2007 11:18:58 -0500
Message-ID: <5892.1198253938@sss.pgh.pa.us> (raw)
In-Reply-To: <162867790712210639v44a5e4f6y4640f20fbc02126d@mail.gmail.com>
References: <b42b73150712202109u26d05d01q4f1b8be8d29f763c@mail.gmail.com>
<26811.1198215605@sss.pgh.pa.us>
<b42b73150712202306v58b9f301kbea90bf8e150ddfc@mail.gmail.com>
<162867790712210018m68117783y791da209a4a97448@mail.gmail.com>
<b42b73150712210613s1cc85c76p47e6a4bb36257fbe@mail.gmail.com>
<162867790712210639v44a5e4f6y4640f20fbc02126d@mail.gmail.com>
"Pavel Stehule" <pavel.stehule@gmail.com> writes:
> On 21/12/2007, Merlin Moncure <mmoncure@gmail.com> wrote:
>> ... The real issue as I see it is where to
>> keep the key. How did you handle that?
> Simply. I use for password some random plpgsql message text and
> compile it. I though about GUC, and about storing password in
> postgresql.conf. It's equal to protection level. We cannot protect
> code on 100%. If you have admin or superuser account and if you know
> some internal, you can simply get code.
Yeah. There is no defense against someone who is prepared to go in
there with a debugger and pull the post-decryption code out of memory.
So what we need to think about is what sorts of threats we *can* or
should defend against. A couple of goals that seem like they might
be reasonable are:
* Even a superuser can't get the code at the SQL level, ie, it's
secure if you rule out debugger-level attacks. (For example, this
might prevent someone who had remotely breached the superuser account
from getting the code.)
* Code not available if you just look at what's on-disk, ie, you can't
get it by stealing a backup tape.
Any other threats we could consider defending against?
BTW, this thread definitely doesn't belong on -performance anymore.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: tgl@sss.pgh.pa.us, pavel.stehule@gmail.com, mmoncure@gmail.com, alvherre@commandprompt.com, jd@commandprompt.com, quension@gmail.com, Jon.Roberts@asurion.com, books@ejurka.com, jonah.harris@gmail.com, wmoran@collaborativefusion.com, pgsql-hackers@postgresql.org
Subject: Re: function body actors (was: [PERFORM] viewing source code)
In-Reply-To: <5892.1198253938@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox