From: | Bruce Momjian <bruce(at)momjian(dot)us> |
---|---|
To: | Jelte Fennema-Nio <postgres(at)jeltef(dot)nl> |
Cc: | Maciek Sakrejda <m(dot)sakrejda(at)gmail(dot)com>, Robert Haas <robertmhaas(at)gmail(dot)com>, Isaac Morland <isaac(dot)morland(at)gmail(dot)com>, Greg Sabino Mullane <htamfids(at)gmail(dot)com>, Andrew Dunstan <andrew(at)dunslane(dot)net>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Heikki Linnakangas <hlinnaka(at)iki(dot)fi>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org>, Daniel Gustafsson <daniel(at)yesql(dot)se>, Joel Jacobson <joel(at)compiler(dot)org>, Gabriele Bartolini <gabriele(dot)bartolini(at)enterprisedb(dot)com>, Magnus Hagander <magnus(dot)hagander(at)redpill-linpro(dot)com> |
Subject: | Re: Possibility to disable `ALTER SYSTEM` |
Date: | 2024-03-28 00:17:09 |
Message-ID: | ZgS3BemHfzJyX7Mi@momjian.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Thu, Mar 28, 2024 at 12:43:29AM +0100, Jelte Fennema-Nio wrote:
> + <varlistentry id="guc-allow-alter-system" xreflabel="allow_alter_system">
> + <term><varname>allow_alter_system</varname> (<type>boolean</type>)
> + <indexterm>
> + <primary><varname>allow_alter_system</varname> configuration parameter</primary>
> + </indexterm>
> + </term>
> + <listitem>
> + <para>
> + When <literal>allow_alter_system</literal> is set to
> + <literal>off</literal>, an error is returned if the <command>ALTER
> + SYSTEM</command> command is used. This parameter can only be set in
"command is used." -> "command is issued." ?
> + the <filename>postgresql.conf</filename> file or on the server command
> + line. The default value is <literal>on</literal>.
> + </para>
> +
> + <para>
> + Note that this setting cannot be regarded as a security feature. It
"setting cannot be regarded" -> "setting should not be regarded"
> + only disables the <literal>ALTER SYSTEM</literal> command. It does not
> + prevent a superuser from changing the configuration using other SQL
> + commands. A superuser has many ways of executing shell commands at
> + the operating system level, and can therefore modify
> + <literal>postgresql.auto.conf</literal> regardless of the value of
> + this setting.
I like that you explained how this can be bypassed.
> +
> + <para>
> + Turning this setting off is intended for environments where the
> + configuration of <productname>PostgreSQL</productname> is managed by
> + some outside mechanism.
> + In such environments, a well intenioned superuser user might
> + <emphasis>mistakenly</emphasis> use <command>ALTER SYSTEM</command>
> + to change the configuration instead of using the outside mechanism.
> + This might even appear to update the configuration as intended, but
"This might even appear to update" -> "This might temporarily update"
> + then might be discarded at some point in the future when that outside
"that outside" -> "the outside"
> + mechanism updates the configuration.
> + Setting this parameter to <literal>off</literal> can
> + help to avoid such mistakes.
"help to avoid" -> "help avoid"
> + </para>
> +
> + <para>
> + This parameter only controls the use of <command>ALTER SYSTEM</command>.
> + The settings stored in <filename>postgresql.auto.conf</filename> always
"always" -> "still"
Should this paragraph be moved after or as part of the paragraph about
modifying postgresql.auto.conf?
--
Bruce Momjian <bruce(at)momjian(dot)us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
From | Date | Subject | |
---|---|---|---|
Next Message | Robert Treat | 2024-03-28 00:24:04 | Re: DOCS: add helpful partitioning links |
Previous Message | Bruce Momjian | 2024-03-27 23:58:56 | Re: Possibility to disable `ALTER SYSTEM` |