Hi,
I'm not quite clear what the goal of allow_system_table_mods
is. Obviously, it's extremely dangerous to target catalogs with DDL. But
at the same time we allow DML to catalog tables without any sort of
restriction.
I also don't understand what's achieved by having
allow_system_table_mods be PGC_POSTMASTER. If anything it seems to make
it more likely to resort to a) leaving it enabled all the time b) use
DML to modify catalogs.
Wouldn't it be more sensible to disallow all catalog modifications
unless allow_system_table_mods was enabled, and make
allow_system_table_mods PGC_SUSET and GUC_DISALLOW_IN_FILE?
Greetings,
Andres Freund