Re: [HACKERS] What about CREATE OR REPLACE FUNCTION?
От | Peter Eisentraut |
---|---|
Тема | Re: [HACKERS] What about CREATE OR REPLACE FUNCTION? |
Дата | |
Msg-id | Pine.LNX.4.30.0110092056560.672-100000@peter.localdomain обсуждение исходный текст |
Ответ на | Re: [HACKERS] What about CREATE OR REPLACE FUNCTION? (Tom Lane <tgl@sss.pgh.pa.us>) |
Ответы |
Re: [HACKERS] What about CREATE OR REPLACE FUNCTION?
|
Список | pgadmin-hackers |
Tom Lane writes: > I believe the primary reason why PL languages aren't installed by > default is security considerations Well, that argumentation seems to be analogous to giving someone login access on a multiuser computer system but not letting him execute, say, perl because he might write recursive functions with it. Such setups exist (perhaps with something else instead of perl and recursive functions) but they are not the norm and usually fine-tuned by the administrator. We have realized time and time again that giving someone access to a PostgreSQL server is already a security risk. Any person can easily crash the server (select cash_out(2) is prominently documented as doing that) or exhaust time and space resources by writing appropriate queries. Privilege systems do not guard against that. Privilege systems are for guarding against a reasonable user "cheating". Now, if a procedural language is not safe (at least as safe as the rest of the system that's accessible to an ordinary user), then it shouldn't be marked "trusted". Otherwise, the consequence of this chain of arguments is that createlang selectively introduces a security whole into your system. Of course, we may warn, "Be careful when installing procedural languages, because ...". But are users going to be careful? How do they know what kind of care to exercise, and just *how* to do that? No, I don't think this is the ideal situation. I don't want to press for changing it right now because I'm not particularly bothered by it, and the second sentence of the previous paragraph might just be true. In a future life, a privilege system should give finer grained control about access to PLs, but we might want to think about what the default should be. -- Peter Eisentraut peter_e@gmx.net http://funkturm.homeip.net/~peter
В списке pgadmin-hackers по дате отправления: