Thread

Re: [PATCH] Add enable_copy_program GUC to control COPY PROGRAM

Jelte Fennema-Nio <postgres@jeltef.nl> — 2025-12-05T10:41:00Z

On Thu, 4 Dec 2025 at 19:49, Kirill Reshke <reshkekirill@gmail.com> wrote:
> > Good question. I think the easiest would be to always disallow FROM
> > PROGRAM (by default) instead of only when connecting over the network.
>
> How? with GUC?

I meant, sidestep this problem completely by not doing my idea of
still allowing FROM PROGRAM over unix connections. And instead
disallowing it for any connections.

> > Another option would be to have dblink (and pg_fdw) tell postgres (wih
> > e.g. a GUC being set in the StartupMessage) that it should be
> > considered a remote connection for these purposes.
>
> Again, if we are using GUC to tell somebody something about security,
> this doesn't work. Superuser can easily redefine any GUC.

If you mark this GUC as PGC_BACKEND it cannot be changed with SET
commands, not even by superusers.