Re: allow building trusted languages without the untrusted versions

Nathan Bossart <nathandbossart(at)gmail(dot)com> writes:
> On Fri, May 20, 2022 at 08:20:11PM -0400, Tom Lane wrote:
>> Lastly, you've offered no reason to think this would provide any real
>> security improvement. Someone who's gained the ability to issue CREATE
>> EXTENSION on untrusted extensions has already got all the privileges he
>> needs; leaving out a few extension files is at most going to slow him
>> down a bit on the way to full filesystem access. (See, eg, COPY TO
>> PROGRAM.)

> I'd like to provide the ability to disallow these other things, too. This
> is intended to be a first step in that direction.

There would probably be some interest in a "--disable-disk-access"
configure option that did all of this stuff (and some more things
too), with the aim of locking down *all* known paths to filesystem
access. I don't see much value in retail options that do some of that.
In fact, what they might mostly accomplish is to give people a false
sense of security.

regards, tom lane