Re: Untrusted relations and WAL

Hi,

On 2026-11-08 23:53:37 +0500, Andrey Borodin wrote:
> It would be wonderful to harden every redo function: no combination of
> bytes and WAL records shall... do what, exactly? What would a security
> model even look like here?

I think this is just about impossible. Obviously the catalogs need to be
modifiable by WAL. Once you can update the catalog in arbitrary ways, you're
able to make the database do just about arbitrary things, including obviously
arbitrary code execution.

Introducing a security boundary for physiological replication / crash recovery
makes IMO no sense whatsoever. It's not mathematically impossible, if you make
postgres not have any extensibility and have all crucial configuration
(including authn & authz) outside the database, but there wouldn't be much of
postgres left.

> So the questions:
>
> 1. Is it true that we cannot, even in theory, state a security model in
> which WAL and relations are untrusted? Or is there a clever way to
> draw a comprehensible boundary there?

Correct.

> 2. Alternatively, could a large hardening project over everything we
> read from disk make sense?

Sure, we can add some more or a a lot more hardening of what we read. I think
that's entirely unrelated to make it safe to replay arbitrarily corrupt WAL.

> Although it seems we already have plenty of real reports on the surfaces we
> did promise to defend.

TBH, even just the idea of expanding the scope of what we consider vulns feels
like somewhat an insult at the moment. If you want to make everyone in
postgres maintenance quit from exhaustion, that's the way.

Greetings,

Andres Freund