| From: | Andres Freund <andres(at)anarazel(dot)de> |
|---|---|
| To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
| Cc: | Dimitri Fontaine <dimitri(at)2ndQuadrant(dot)fr>, Heikki Linnakangas <hlinnakangas(at)vmware(dot)com>, Simon Riggs <simon(at)2ndquadrant(dot)com>, Robert Haas <robertmhaas(at)gmail(dot)com>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: Dumping an Extension's Script |
| Date: | 2012-12-05 21:59:57 |
| Message-ID: | 20121205215956.GV27424@awork2.anarazel.de |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On 2012-12-05 16:42:38 -0500, Tom Lane wrote:
> Andres Freund <andres(at)anarazel(dot)de> writes:
> > On 2012-12-05 16:20:41 -0500, Tom Lane wrote:
> >> GUC or no GUC, it'd still be letting an unprivileged network-exposed
> >> application (PG) do something that's against any sane system-level
> >> security policy. Lipstick is not gonna help this pig.
>
> > What about the non-writable per cluster directory? Thats something I've
> > actively wished for in the past when developing a C module thats also
> > used in other clusters.
>
> I see no security objection to either per-cluster or per-database
> script+control-file directories, as long as they can only contain
> SQL scripts and not executable files.
Well, I was explicitly talking about C code above. The question doesn't
really have to do too much with this thread, sorry. Given I am proposing
the directory to be explicitly read-only and under permission that don't
allow postgres to change that its not really suitable for this topic...
Greetings,
Andres Freund
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Robert Haas | 2012-12-05 22:00:11 | Re: Dumping an Extension's Script |
| Previous Message | Andres Freund | 2012-12-05 21:56:52 | Re: PITR potentially broken in 9.2 |