Add an output_plugin_libraries GUC to bless trusted output plugins
REPLICATION users were not previously subject to restrictions on output
plugin paths, so they were able to bypass LOAD-time protections during
logical decoding. Unfortunately, adding the standard LOAD restrictions
now would retroactively require all third-party output plugins to be
installed under the $libdir/plugins directory. This would prevent the
use of dynamic_library_path, introduce a wire incompatibility for
clients, and require all plugin authors to check that their libraries
are safe for use by any unprivileged user; we want to avoid that.
Instead, introduce an output_plugin_libraries GUC so that DBAs can
specify the output plugins that are trusted for use in logical decoding.
For simplicity, superusers are subject to the restriction as well
(though they're free to modify the GUC at will during a session, so no
power is actually lost).
The default setting is 'pgoutput, test_decoding'. If other third-party
plugins are in use, DBAs will need to modify this parameter after they
update. Some pointers have been added to the documentation to assist
with this.
Author: Jacob Champion <jacob.champion@enterprisedb.com>
Reported-by: Vladimir Tokarev <vladimirelitokarev@gmail.com>
Reported-by: Yu Kunpeng <yu443940816@live.com>
Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Robert Haas <robertmhaas@gmail.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Backpatch-through: 14
Security: CVE-2026-6471
Branch
------
REL_16_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/4e1252ee56c33b8a1144b25b5803f47276662519
Author: Jacob Champion <jchampion@postgresql.org>
Modified Files
--------------
contrib/test_decoding/expected/permissions.out | 11 ++++
contrib/test_decoding/expected/slot.out | 3 +
contrib/test_decoding/sql/permissions.sql | 8 +++
contrib/test_decoding/sql/slot.sql | 3 +
doc/src/sgml/config.sgml | 57 +++++++++++++++++++
doc/src/sgml/logical-replication.sgml | 9 +++
src/backend/replication/logical/logical.c | 76 +++++++++++++++++++++++++-
src/backend/utils/misc/guc_tables.c | 12 ++++
src/backend/utils/misc/postgresql.conf.sample | 1 +
src/bin/pg_dump/dumputils.c | 1 +
src/include/replication/logical.h | 3 +
src/test/subscription/t/100_bugs.pl | 28 +++++++++-
12 files changed, 209 insertions(+), 3 deletions(-)
