Re: What's the point of allow_system_table_mods?

Andrew Gierth <andrew(at)tao11(dot)riddles(dot)org(dot)uk> writes:
> "Andres" == Andres Freund <andres(at)anarazel(dot)de> writes:
> Andres> Why is it so much more dangerous? I've seen plenty of corrupted
> Andres> clusters due to people doing DML against the catalogs. I'm OK
> Andres> with adding separate GUCs for both, if we want to do that, but
> Andres> I do think we shouldn't allow updating the catalogs wthout
> Andres> having having the superuser explicitly opt into that.

> Be aware that a nonzero number of extensions (postgis especially) do
> catalog DML in their install or update scripts.

I believe we've done that in some contrib update scripts, as well.

> While you might well
> think they shouldn't do that, in practice there is usually no viable
> alternative.

In principle, if the thing is SUSET, we could have such extension scripts
set it temporarily. But it would be a compatibility hazard -- a script
with such a SET command in it would fail in older branches.

What exactly is the motivation for changing this now, after 20 years?

regards, tom lane