Re: [PATCH] Allow bare library names for non-superuser LOAD

From: solai v <solai(dot)cdac(at)gmail(dot)com>
To: Japin Li <japinli(at)hotmail(dot)com>
Cc: cca5507 <cca5507(at)qq(dot)com>, pgsql-hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Subject: Re: [PATCH] Allow bare library names for non-superuser LOAD
Date: 2026-09-09 05:36:53
Message-ID: CAF0whufCAODiDvbu0NzK0xOnyzzN1OOvDwRRzqyxR=c6EqNjnQ@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi all
I reviewed and tested the v1 patch for allowing bare library names for
non-superuser LOAD.
I was able to reproduce the existing behavior before applying the patch:
-As a non-superuser, LOAD mylib failed with access to library mylib is
not allowed.
-LOAD $libdir/plugins/mylib succeeded.

After applying the v1 patch and rebuilding/restarting PostgreSQL:
-LOAD mylib succeeded and loaded the library from $libdir/plugins.
-LOAD $libdir/plugins/mylib continued to work.
-Attempts to load /tmp/mylib.so, $libdir/mylib, and ../mylib were
still rejected for the non-superuser.
I also ran git diff --check, which completed without any errors.

From my testing, the patch fixes the reported issue while preserving
the existing security restriction for non-superuser LOAD.
I did not find any functional issue with the patch during these tests.

Regards
solai

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Xuneng Zhou 2026-09-09 05:39:28 Re: Implement waiting for wal lsn replay: reloaded
Previous Message Henson Choi 2026-09-09 05:33:28 Re: Row pattern recognition