Introduce psystem() to replace system()

From: "Jonathan Gonzalez V(dot)" <jonathan(at)abdiel(dot)eu>
To: pgsql-hackers(at)lists(dot)postgresql(dot)org
Subject: Introduce psystem() to replace system()
Date: 2026-08-10 19:27:51
Message-ID: 87zeyt93ns.fsf@abdiel.eu
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers


Hello!!

For some time I've been wondering why PostgreSQL needs system() calls,
which use a shell that can lead to many problems, and also why it
requires a shell to run a command.

I first started thinking about this when I was trying to run a full
distroless PostgreSQL container. It turns out that isn't possible since
the shell is a requirement, and distroless containers are secure exactly
_because_ there's no shell to execute any command other than the ones
that are meant to be executed.

After some research I found out that using system() has other problems,
like issues related to quoting that are really painful to solve [0][1],
and also the exit codes control[2]. Both topics have already been
discussed on the list.

But the main argument now for me is security. Not having a shell avoids
any possible PATH injection, missing quoting to escape a command, or new
lines that the shell interprets differently from what you'd expect.

After some thinking I came up with a small interface, which only purpose
is to replace system() calls in a more smooth way using execv() under
the hood. I suppose you could use execl() but I've decided to keep it
simple, leaving the opportunity to expand in the future. I already
implemented one call with `pg_ctl initdb` as an example.

There's an important topic related to using shell versus not a shell. In
some places like `archive_command` people may use `&&`, but this idea
aims to avoid this kind of behavior since it's not secure. Probably we
can implement a way to run commands in sequence, or simply tell the
users that this isn't allowed anymore, but it's possible to trigger
commands in sequence since the interface allows to manipulate the STDIN
and STDOUT.

I would like to open the discussion here if this is the right direction.
There's a lot to do and this still a work in progress, the current patch
is small and simple, but already provides building blocks in this direction.

[0] https://www.postgresql.org/message-id/7606.1153326421%40sss.pgh.pa.us
[1] https://www.postgresql.org/message-id/CA%2BTgmobBmWWCgPUd04NGoQ%3D_XvcidV%2BsE2F7KChEXfs8KBPg6w%40mail.gmail.com
[2] https://www.postgresql.org/message-id/21292.1358698487%40sss.pgh.pa.us

--
Jonathan Gonzalez V.
EDB https://enterprisedb.com

Attachment Content-Type Size
0001-replace-calls-to-system-with-PostgreSQL-own-implemen.patch text/x-diff 13.7 KB

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Corey Huinker 2026-08-10 19:58:26 Re: use of SPI by postgresImportForeignStatistics
Previous Message Adam Brusselback 2026-08-10 19:12:47 Re: Unlogged materialized views