Re: Permissions for CREATE OPERATOR CLASS

En Fri, 23 Aug 2002 15:17:25 -0400
Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> escribió:

> The new CREATE OPERATOR CLASS command will presently let you create an
> index opclass if you own the datatype the class is for. With the
> recent emphasis on security I'm thinking that this is not an adequate
> permission check. We don't have any reasonable way of checking that
> the provided set of operators and support functions meet the
> expectations of the index AM and are mutually consistent. This means
> it's not at all difficult to make an index opclass that will crash
> the backend when used.

Well, maybe this reduces the usefulness of having a CREATE TYPE as
compared to being able to create operator classes as well, but I wonder
how much people create their own types and want to create operator
classes without being superusers.

Is it too difficult to check whether the functions are "good for AM"?
Does not sound like an easy task... (halting problem maybe?)

> I'm inclined to require superuser permissions to do CREATE OPERATOR
> CLASS. This would not be a loss of functionality compared to prior
> releases, since the old way of creating an opclass involved manual
> insertions into system catalogs, also a superuser-only thing.

If it's unsafe, users should not be able to mess with it.

I was playing around and got this:

alvh=> create type my_cash (input = cash_in, output = cash_out, internallength = variable);
ERROR: TypeCreate: function cash_out(opaque) does not exist

--
Alvaro Herrera (<alvherre[a]atentus.com>)
"La fuerza no está en los medios físicos
sino que reside en una voluntad indomable" (Gandhi)