Okay, so we'll do the symlinks.
CREATE DATABASE xxx WITH LOCATION='/else/where';
will clone ('cp -r') template1 in /else/where/base/<id> and create a
symlink to there from $PGDATA/base/<id>.  The '/else/where' location will
be stored in pg_database.datpath.
How do we control the allowed paths?  Should we continue with the
environment variables?  Perhaps a config option listing the allowed
directories?  A system catalog?
Somehow I also get the feeling that pg_dumpall should be saving these
paths...
-- 
Peter Eisentraut      peter_e(at)gmx(dot)net       http://yi.org/peter-e/