Re: allow building trusted languages without the untrusted versions

Поиск
Список
Период
Сортировка
От Tom Lane
Тема Re: allow building trusted languages without the untrusted versions
Дата
Msg-id 1290329.1653326228@sss.pgh.pa.us
обсуждение исходный текст
Ответ на Re: allow building trusted languages without the untrusted versions  (Nathan Bossart <nathandbossart@gmail.com>)
Ответы Re: allow building trusted languages without the untrusted versions  (Nathan Bossart <nathandbossart@gmail.com>)
Re: allow building trusted languages without the untrusted versions  (Robert Haas <robertmhaas@gmail.com>)
Список pgsql-hackers
Nathan Bossart <nathandbossart@gmail.com> writes:
> On Fri, May 20, 2022 at 08:20:11PM -0400, Tom Lane wrote:
>> Lastly, you've offered no reason to think this would provide any real
>> security improvement.  Someone who's gained the ability to issue CREATE
>> EXTENSION on untrusted extensions has already got all the privileges he
>> needs; leaving out a few extension files is at most going to slow him
>> down a bit on the way to full filesystem access.  (See, eg, COPY TO
>> PROGRAM.)

> I'd like to provide the ability to disallow these other things, too.  This
> is intended to be a first step in that direction.

There would probably be some interest in a "--disable-disk-access"
configure option that did all of this stuff (and some more things
too), with the aim of locking down *all* known paths to filesystem
access.  I don't see much value in retail options that do some of that.
In fact, what they might mostly accomplish is to give people a false
sense of security.

            regards, tom lane



В списке pgsql-hackers по дате отправления:

Предыдущее
От: Nathan Bossart
Дата:
Сообщение: Re: allow building trusted languages without the untrusted versions
Следующее
От: Nathan Bossart
Дата:
Сообщение: Re: fix typos in storing statistics in shared memory