Horton

Re: Possibility to disable `ALTER SYSTEM`

Isaac Morland <isaac.morland@gmail.com>

View thread
From: Isaac Morland <isaac.morland@gmail.com>
To: Magnus Hagander <magnus@hagander.net>
Cc: Martín Marqués <martin.marques@gmail.com>, Gabriele Bartolini <gabriele.bartolini@enterprisedb.com>, pgsql-hackers@postgresql.org
Date: 2023-09-11T16:15:29Z
Lists: pgsql-hackers

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

  1. Add allow_alter_system GUC.

  2. Rename COMPAT_OPTIONS_CLIENT to COMPAT_OPTIONS_OTHER.

  3. Remove support for version-0 calling conventions.

On Mon, 11 Sept 2023 at 11:11, Magnus Hagander <magnus@hagander.net> wrote:

> I'm actually going to put a strong +1 to Gabriele's proposal. It's an
> > undeniable problem (I'm only seeing arguments regarding other ways the
> > system would be insecure), and there might be real use cases for users
> > outside kubernetes for having this feature and using it (meaning
> > disabling the use of ALTER SYSTEM).
>
> If enough people are in favor of it *given the known issues with it*,
> I can drop my objection to a "meh, but I still don't think it's a good
> idea".
>
> But to do that, there would need to be a very in-your-face warning in
> the documentation about it like "note that this only disables the
> ALTER SYSTEM command. It does not prevent a superuser from changing
> the configuration remotely using other means".
>
> For example, in the very simplest, wth the POC patch out there now, I
> can still run:
>
[…]

Maybe in addition to making "ALTER SYSTEM" throw an error, the feature that
disables it should also disable reading postgresql.auto.conf? Maybe even
delete it and make it an error if it is present on startup (maybe even warn
if it shows up while the DB is running?).

Interesting corner case: What happens if I do "ALTER SYSTEM SET
alter_system_disabled = true"?

Counterpoint: maybe the idea is to disable ALTER SYSTEM but still use
postgresql.auto.conf, maintained by an external program, to control the
instance's behaviour.