Add allow_alter_system GUC.

This is marked PGC_SIGHUP, so it can only be set in a configuration
file, not anywhere else; and it is also marked GUC_DISALLOW_IN_AUTO_FILE,
so it can't be set using ALTER SYSTEM. When set to false, the
ALTER SYSTEM command is disallowed.

There was considerable concern that this would be misinterpreted as
a security feature, which it is not, because a determined superuser
has various ways of bypassing it. Hence, a lot of work has gone into
wordsmithing the documentation, in the hopes of avoiding any such
confusion.

Jelte Fennemia-Nio and Gabriele Bartolini, with wording suggestions
for the documentation from many others.

Discussion: http://postgr.es/m/CA%2BVUV5rEKt2%2BCdC_KUaPoihMu%2Bi5ChT4WVNTr4CD5-xXZUfuQw%40mail.gmail.com

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 5468637e2ef3dbcca5cfaf539c881714f707f0e0..f65c17e5ae4891ef575604ac4d5937708c98a910 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -199,7 +199,8 @@ shared_buffers = 128MB
     
      External tools may also
      modify postgresql.auto.conf.  It is not
-     recommended to do this while the server is running, since a
+     recommended to do this while the server is running unless 
+     linkend="guc-allow-alter-system"/> is set to off, since a
      concurrent ALTER SYSTEM command could overwrite
      such changes.  Such tools might simply append new settings to the end,
      or they might choose to remove duplicate settings and/or comments
@@ -10767,6 +10768,54 @@ dynamic_library_path = 'C:\tools\postgresql;H:\my_project\lib;$libdir'
       
      
 
+     
+      allow_alter_system (boolean)
+      
+       allow_alter_system configuration parameter
+      
+      
+      
+       
+        When allow_alter_system is set to
+        off, an error is returned if the ALTER
+        SYSTEM command is executed. This parameter can only be set in
+        the postgresql.conf file or on the server command
+        line. The default value is on.
+       
+
+       
+        Note that this setting must not be regarded as a security feature. It
+        only disables the ALTER SYSTEM command. It does not
+        prevent a superuser from changing the configuration using other SQL
+        commands. A superuser has many ways of executing shell commands at
+        the operating system level, and can therefore modify
+        postgresql.auto.conf regardless of the value of
+        this setting.
+       
+
+       
+        Turning this setting off is intended for environments where the
+        configuration of PostgreSQL is managed by
+        some external tool.
+        In such environments, a well intentioned superuser might
+        mistakenly use ALTER SYSTEM
+        to change the configuration instead of using the external tool.
+        This might result in unintended behavior, such as the external tool
+        overwriting the change at some later point in time when it updates the
+        configuration.
+        Setting this parameter to off can
+        help avoid such mistakes.
+       
+
+       
+        This parameter only controls the use of ALTER SYSTEM.
+        The settings stored in postgresql.auto.conf
+        take effect even if allow_alter_system is set to
+        off.
+       
+      
+     
+
      
     
    


diff --git a/doc/src/sgml/ref/alter_system.sgml b/doc/src/sgml/ref/alter_system.sgml

index bea5714ba1aab8f85f9fcbead5d834586b4d01d5..1bde66d6ad2d31603b7b7fb2f26aecc4ad3139bc 100644 (file)

--- a/doc/src/sgml/ref/alter_system.sgml
+++ b/doc/src/sgml/ref/alter_system.sgml
@@ -104,6 +104,7 @@ ALTER SYSTEM RESET ALL
 
   
    This command can't be used to set ,
+   ,
    nor parameters that are not allowed in postgresql.conf
    (e.g., preset options).
   
@@ -111,6 +112,13 @@ ALTER SYSTEM RESET ALL
   
    See  for other ways to set the parameters.
   
+
+  
+   ALTER SYSTEM can be disabled by setting
+    to off, but this
+   is not a security mechanism (as explained in detail in the documentation for
+   this parameter).
+  
  
 
  


diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c

index 391866145eefae341346ed3aad1d5c7c4fb5314e..f51b3e0b507ec00a8f8e2bb3bd146eb3316994c0 100644 (file)

--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -4563,6 +4563,11 @@ AlterSystemSetConfigFile(AlterSystemStmt *altersysstmt)
     */
    name = altersysstmt->setstmt->name;
 
+   if (!AllowAlterSystem)
+       ereport(ERROR,
+               (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+                errmsg("ALTER SYSTEM is not allowed in this environment")));
+
    switch (altersysstmt->setstmt->kind)
    {
        case VAR_SET_VALUE:


diff --git a/src/backend/utils/misc/guc_tables.c b/src/backend/utils/misc/guc_tables.c

index abd9029451fe70c6fa7bf4e8f69c31b966849018..92fcd5fa4d50a92b04069f19525263d1bc847e6f 100644 (file)

--- a/src/backend/utils/misc/guc_tables.c
+++ b/src/backend/utils/misc/guc_tables.c
@@ -494,6 +494,7 @@ extern const struct config_enum_entry dynamic_shared_memory_options[];
 /*
  * GUC option variables that are exported from this module
  */
+bool       AllowAlterSystem = true;
 bool       log_duration = false;
 bool       Debug_print_plan = false;
 bool       Debug_print_parse = false;
@@ -1040,6 +1041,22 @@ struct config_bool ConfigureNamesBool[] =
        false,
        NULL, NULL, NULL
    },
+   {
+       /*
+        * This setting itself cannot be set by ALTER SYSTEM to avoid an
+        * operator turning this setting off by using ALTER SYSTEM, without a
+        * way to turn it back on.
+        */
+       {"allow_alter_system", PGC_SIGHUP, COMPAT_OPTIONS_OTHER,
+           gettext_noop("Allows running the ALTER SYSTEM command."),
+           gettext_noop("Can be set to off for environments where global configuration "
+                        "changes should be made using a different method."),
+           GUC_DISALLOW_IN_AUTO_FILE
+       },
+       &AllowAlterSystem,
+       true,
+       NULL, NULL, NULL
+   },
    {
        {"bonjour", PGC_POSTMASTER, CONN_AUTH_SETTINGS,
            gettext_noop("Enables advertising the server via Bonjour."),


diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample

index 2244ee52f79ae68453862e9ea133412f68e69347..adcc0257f9153c6f317d8dadd3ee56b7c95a974f 100644 (file)

--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -805,6 +805,7 @@
 # - Other Platforms and Clients -
 
 #transform_null_equals = off
+#allow_alter_system = on
 
 
 #------------------------------------------------------------------------------


diff --git a/src/include/utils/guc.h b/src/include/utils/guc.h

index 3712aba09b0451b0a972efb39c614f012174ad35..8d1fe04078a49b842bf2267f0236ea845c74842f 100644 (file)

--- a/src/include/utils/guc.h
+++ b/src/include/utils/guc.h
@@ -254,6 +254,7 @@ extern PGDLLIMPORT bool log_btree_build_stats;
 extern PGDLLIMPORT bool check_function_bodies;
 extern PGDLLIMPORT bool current_role_is_superuser;
 
+extern PGDLLIMPORT bool AllowAlterSystem;
 extern PGDLLIMPORT bool log_duration;
 extern PGDLLIMPORT int log_parameter_max_length;
 extern PGDLLIMPORT int log_parameter_max_length_on_error;

diff --git a/doc/src/sgml/ref/alter_system.sgml b/doc/src/sgml/ref/alter_system.sgml
index bea5714ba1aab8f85f9fcbead5d834586b4d01d5..1bde66d6ad2d31603b7b7fb2f26aecc4ad3139bc 100644 (file)
--- a/doc/src/sgml/ref/alter_system.sgml
+++ b/doc/src/sgml/ref/alter_system.sgml
@@ -104,6 +104,7 @@ ALTER SYSTEM RESET ALL
 
   
    This command can't be used to set ,
+   ,
    nor parameters that are not allowed in postgresql.conf
    (e.g., preset options).
   
@@ -111,6 +112,13 @@ ALTER SYSTEM RESET ALL
   
    See  for other ways to set the parameters.
   
+
+  
+   ALTER SYSTEM can be disabled by setting
+    to off, but this
+   is not a security mechanism (as explained in detail in the documentation for
+   this parameter).
+  
  
 
  

diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 391866145eefae341346ed3aad1d5c7c4fb5314e..f51b3e0b507ec00a8f8e2bb3bd146eb3316994c0 100644 (file)
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -4563,6 +4563,11 @@ AlterSystemSetConfigFile(AlterSystemStmt *altersysstmt)
     */
    name = altersysstmt->setstmt->name;
 
+   if (!AllowAlterSystem)
+       ereport(ERROR,
+               (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
+                errmsg("ALTER SYSTEM is not allowed in this environment")));
+
    switch (altersysstmt->setstmt->kind)
    {
        case VAR_SET_VALUE:

diff --git a/src/backend/utils/misc/guc_tables.c b/src/backend/utils/misc/guc_tables.c
index abd9029451fe70c6fa7bf4e8f69c31b966849018..92fcd5fa4d50a92b04069f19525263d1bc847e6f 100644 (file)
--- a/src/backend/utils/misc/guc_tables.c
+++ b/src/backend/utils/misc/guc_tables.c
@@ -494,6 +494,7 @@ extern const struct config_enum_entry dynamic_shared_memory_options[];
 /*
  * GUC option variables that are exported from this module
  */
+bool       AllowAlterSystem = true;
 bool       log_duration = false;
 bool       Debug_print_plan = false;
 bool       Debug_print_parse = false;
@@ -1040,6 +1041,22 @@ struct config_bool ConfigureNamesBool[] =
        false,
        NULL, NULL, NULL
    },
+   {
+       /*
+        * This setting itself cannot be set by ALTER SYSTEM to avoid an
+        * operator turning this setting off by using ALTER SYSTEM, without a
+        * way to turn it back on.
+        */
+       {"allow_alter_system", PGC_SIGHUP, COMPAT_OPTIONS_OTHER,
+           gettext_noop("Allows running the ALTER SYSTEM command."),
+           gettext_noop("Can be set to off for environments where global configuration "
+                        "changes should be made using a different method."),
+           GUC_DISALLOW_IN_AUTO_FILE
+       },
+       &AllowAlterSystem,
+       true,
+       NULL, NULL, NULL
+   },
    {
        {"bonjour", PGC_POSTMASTER, CONN_AUTH_SETTINGS,
            gettext_noop("Enables advertising the server via Bonjour."),

diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample
index 2244ee52f79ae68453862e9ea133412f68e69347..adcc0257f9153c6f317d8dadd3ee56b7c95a974f 100644 (file)
--- a/src/backend/utils/misc/postgresql.conf.sample
+++ b/src/backend/utils/misc/postgresql.conf.sample
@@ -805,6 +805,7 @@
 # - Other Platforms and Clients -
 
 #transform_null_equals = off
+#allow_alter_system = on
 
 
 #------------------------------------------------------------------------------

diff --git a/src/include/utils/guc.h b/src/include/utils/guc.h
index 3712aba09b0451b0a972efb39c614f012174ad35..8d1fe04078a49b842bf2267f0236ea845c74842f 100644 (file)
--- a/src/include/utils/guc.h
+++ b/src/include/utils/guc.h
@@ -254,6 +254,7 @@ extern PGDLLIMPORT bool log_btree_build_stats;
 extern PGDLLIMPORT bool check_function_bodies;
 extern PGDLLIMPORT bool current_role_is_superuser;
 
+extern PGDLLIMPORT bool AllowAlterSystem;
 extern PGDLLIMPORT bool log_duration;
 extern PGDLLIMPORT int log_parameter_max_length;
 extern PGDLLIMPORT int log_parameter_max_length_on_error;