Alvaro Herrera <alvherre@2ndquadrant.com> writes:
> Joe Conway wrote:
>> I noticed today that has_language_privilege() returns incorrect answer
>> for non-superuser, e.g.:
>>
>> 8<---------------------------------------------------
>> select has_language_privilege('nobody',
>> 'plperlu',
>> 'usage');
>> has_language_privilege
>> ------------------------
>> t
>> (1 row)
> Funnily enough, this is still the case in 9.6, four years later. Have
> we made any inroads in fixing this?
The reason for the discrepancy is that the check actually enforced by
CreateFunction (functioncmds.c:948) is not about USAGE if it's an
untrusted language. The user does actually have USAGE, so far as the
standard privilege system is concerned, but we're still disallowing the
function creation.
I suppose that this is one of the things that Stephen Frost would like
to normalize to be completely driven by the standard privilege system.
Possibly we could simplify CREATE FUNCTION to just check USAGE all the
time, and instead have CREATE LANGUAGE auto-revoke public USAGE if
it's not a trusted language.
regards, tom lane
