Horton

Re: Possibility to disable `ALTER SYSTEM`

Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>

View thread
From: Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>
To: Isaac Morland <isaac.morland@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, pgsql-hackers@postgresql.org
Date: 2023-09-08T14:17:04Z
Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Add allow_alter_system GUC.

  2. Rename COMPAT_OPTIONS_CLIENT to COMPAT_OPTIONS_OTHER.

  3. Remove support for version-0 calling conventions.

Hi Isaac,

On Fri, 8 Sept 2023 at 16:11, Isaac Morland <isaac.morland@gmail.com> wrote:

> Alternate idea, not sure how good this is: Use existing OS security
> features (regular permissions, or more modern features such as the
> immutable attribute) to mark the postgresql.auto.conf file as not being
> writeable. Then any attempt to ALTER SYSTEM should result in an error.
>

That is the point I highlighted in the initial post in the thread. We could
make it readonly, but the returned error is misleading and definitely poor
UX:

```
postgres=# ALTER SYSTEM SET wal_level TO minimal;
ERROR:  could not open file "postgresql.auto.conf": Permission denied
```

IMO we should clearly state that `ALTER SYSTEM` is deliberately disabled in
a system, rather than indirectly hinting it through an inaccessible file.
Not sure if I am clearly highlighting the fine difference here.

Thanks,
Gabriele
-- 
Gabriele Bartolini
Vice President, Cloud Native at EDB
enterprisedb.com