diff options
| author | Robert Haas <rhaas@postgresql.org> | 2024-03-29 08:44:45 -0400 |
|---|---|---|
| committer | Robert Haas <rhaas@postgresql.org> | 2024-03-29 08:45:11 -0400 |
| commit | d3ae2a24f265a028f4b9e8df79ea7b075c6cf016 (patch) | |
| tree | 821da445f3c814a50ca560105f33be84f2a3435d /src/backend/utils/misc/guc.c | |
| parent | 0075d78947e3800c5a807f48fd901f16db91101b (diff) | |
| download | postgresql-d3ae2a24f265a028f4b9e8df79ea7b075c6cf016.tar.gz postgresql-d3ae2a24f265a028f4b9e8df79ea7b075c6cf016.zip | |
Add allow_alter_system GUC.
This is marked PGC_SIGHUP, so it can only be set in a configuration
file, not anywhere else; and it is also marked GUC_DISALLOW_IN_AUTO_FILE,
so it can't be set using ALTER SYSTEM. When set to false, the
ALTER SYSTEM command is disallowed.
There was considerable concern that this would be misinterpreted as
a security feature, which it is not, because a determined superuser
has various ways of bypassing it. Hence, a lot of work has gone into
wordsmithing the documentation, in the hopes of avoiding any such
confusion.
Jelte Fennemia-Nio and Gabriele Bartolini, with wording suggestions
for the documentation from many others.
Discussion: http://postgr.es/m/CA%2BVUV5rEKt2%2BCdC_KUaPoihMu%2Bi5ChT4WVNTr4CD5-xXZUfuQw%40mail.gmail.com
Diffstat (limited to 'src/backend/utils/misc/guc.c')
| -rw-r--r-- | src/backend/utils/misc/guc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index 391866145ee..f51b3e0b507 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -4563,6 +4563,11 @@ AlterSystemSetConfigFile(AlterSystemStmt *altersysstmt) */ name = altersysstmt->setstmt->name; + if (!AllowAlterSystem) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("ALTER SYSTEM is not allowed in this environment"))); + switch (altersysstmt->setstmt->kind) { case VAR_SET_VALUE: |