diff --git a/ansible/files/postgresql_config/supautils.conf.j2 b/ansible/files/postgresql_config/supautils.conf.j2 index 58739905eb..16ce476d6e 100644 --- a/ansible/files/postgresql_config/supautils.conf.j2 +++ b/ansible/files/postgresql_config/supautils.conf.j2 @@ -9,6 +9,7 @@ supautils.drop_trigger_grants = '{"postgres":["auth.audit_log_entries","auth.flo # NOTE: keep nix/tests/prime-superuser.sql in sync with the "may be unsafe" + "deprecated" lists above. supautils.privileged_extensions = 'address_standardizer, address_standardizer_data_us, autoinc, bloom, btree_gin, btree_gist, citext, cube, dblink, dict_int, dict_xsyn, earthdistance, fuzzystrmatch, hstore, http, hypopg, index_advisor, insert_username, intarray, isn, ltree, moddatetime, orioledb, pg_buffercache, pg_cron, pg_graphql, pg_hashids, pg_jsonschema, pg_net, pg_prewarm, pg_repack, pg_stat_monitor, pg_stat_statements, pg_tle, pg_trgm, pg_walinspect, pgaudit, pgcrypto, pgjwt, pgroonga, pgroonga_database, pgrouting, pgrowlocks, pgsodium, pgstattuple, pgtap, plcoffee, pljava, plls, plpgsql_check, plv8, postgis, postgis_raster, postgis_sfcgal, postgis_tiger_geocoder, postgis_topology, postgres_fdw, refint, rum, seg, sslinfo, supabase_vault, supautils, tablefunc, tcn, timescaledb, tsm_system_rows, tsm_system_time, unaccent, uuid-ossp, vector, wrappers' supautils.extension_custom_scripts_path = '/etc/postgresql-custom/extension-custom-scripts' +supautils.restrict_extension_versions = 'warn' supautils.privileged_extensions_superuser = 'supabase_admin' supautils.privileged_role = 'supabase_privileged_role' supautils.privileged_role_allowed_configs = 'auto_explain.*, deadlock_timeout, log_duration, log_lock_waits, log_min_duration_statement, log_min_error_statement, log_min_messages, log_parameter_max_length, log_replication_commands, log_statement, log_temp_files, pg_net.batch_size, pg_net.ttl, pg_stat_statements.*, pgaudit.log, pgaudit.log_catalog, pgaudit.log_client, pgaudit.log_level, pgaudit.log_relation, pgaudit.log_rows, pgaudit.log_statement, pgaudit.log_statement_once, pgaudit.role, pgrst.*, plan_filter.*, safeupdate.enabled, session_replication_role, track_functions, track_io_timing, wal_compression' diff --git a/ansible/vars.yml b/ansible/vars.yml index 3c1f57c721..c540b0441a 100644 --- a/ansible/vars.yml +++ b/ansible/vars.yml @@ -10,9 +10,9 @@ postgres_major: # Full version strings for each major version postgres_release: - postgresorioledb-17: "17.9.0.008-orioledb" - postgres17: "17.6.1.155" - postgres15: "15.14.1.155" + postgresorioledb-17: "17.9.0.009-orioledb" + postgres17: "17.6.1.156" + postgres15: "15.14.1.156" # Non Postgres Extensions pgbouncer_release: 1.25.1 diff --git a/nix/checks.nix b/nix/checks.nix index 776491bc80..d56a33306b 100644 --- a/nix/checks.nix +++ b/nix/checks.nix @@ -253,6 +253,7 @@ "extensions_schema" # tests extension loading "roles" # includes roles/schemas from extensions not in CLI (pgtle, pgmq, repack, topology) "pg_net_worker_privileges" # needs the authenticated/postgres roles from the full migrations, not present in the CLI prime file + "supautils_restrict_versions" # needs the postgres role + primed hstore from the full migrations/prime, not present in the CLI variant # Version-specific extension tests "z_17_ext_interface" "z_17_pg_stat_monitor" diff --git a/nix/tests/expected/supautils_restrict_versions.out b/nix/tests/expected/supautils_restrict_versions.out new file mode 100644 index 0000000000..514016f1e2 --- /dev/null +++ b/nix/tests/expected/supautils_restrict_versions.out @@ -0,0 +1,52 @@ +-- supautils.conf.j2 sets supautils.restrict_extension_versions = 'warn': +-- CREATE/ALTER EXTENSION version clauses from non-exempt roles are ignored +-- with a WARNING and the extension's default_version is used instead. +-- +-- This suite runs against the rendered supautils.conf.j2 with the real +-- migrations applied (see nix/tools/run-server.sh.in), so the restriction +-- can be asserted as the actual platform roles. The supautils regress suite +-- covers the GUC logic (all modes, ALTER, duplicate clauses); this test +-- covers the platform wiring. See PSQL-1159. +-- the platform config sets warn mode +show supautils.restrict_extension_versions; + supautils.restrict_extension_versions +--------------------------------------- + warn +(1 row) + +-- precondition: postgres is not a superuser, else it would be exempt +select rolsuper from pg_roles where rolname = 'postgres'; + rolsuper +---------- + f +(1 row) + +-- drop the hstore created by prime.sql so the creates below are observable +drop extension hstore; +-- non-exempt role: the version clause is ignored with a warning and the +-- default version is installed +set role postgres; +create extension hstore version '1.4'; +WARNING: only superusers can specify extension versions, ignoring version "1.4" and installing the default version +select extversion = default_version as installed_default + from pg_extension, pg_available_extensions + where extname = name and extname = 'hstore'; + installed_default +------------------- + t +(1 row) + +reset role; +drop extension hstore; +-- exempt role (supabase_admin, via supautils.privileged_extensions_superuser): +-- the version clause is honored, with no warning +create extension hstore version '1.4'; +select extversion from pg_extension where extname = 'hstore'; + extversion +------------ + 1.4 +(1 row) + +-- restore the state prime.sql created (hstore at default version) +drop extension hstore; +create extension hstore; diff --git a/nix/tests/sql/supautils_restrict_versions.sql b/nix/tests/sql/supautils_restrict_versions.sql new file mode 100644 index 0000000000..9f5d6f3a55 --- /dev/null +++ b/nix/tests/sql/supautils_restrict_versions.sql @@ -0,0 +1,38 @@ +-- supautils.conf.j2 sets supautils.restrict_extension_versions = 'warn': +-- CREATE/ALTER EXTENSION version clauses from non-exempt roles are ignored +-- with a WARNING and the extension's default_version is used instead. +-- +-- This suite runs against the rendered supautils.conf.j2 with the real +-- migrations applied (see nix/tools/run-server.sh.in), so the restriction +-- can be asserted as the actual platform roles. The supautils regress suite +-- covers the GUC logic (all modes, ALTER, duplicate clauses); this test +-- covers the platform wiring. See PSQL-1159. + +-- the platform config sets warn mode +show supautils.restrict_extension_versions; + +-- precondition: postgres is not a superuser, else it would be exempt +select rolsuper from pg_roles where rolname = 'postgres'; + +-- drop the hstore created by prime.sql so the creates below are observable +drop extension hstore; + +-- non-exempt role: the version clause is ignored with a warning and the +-- default version is installed +set role postgres; +create extension hstore version '1.4'; +select extversion = default_version as installed_default + from pg_extension, pg_available_extensions + where extname = name and extname = 'hstore'; +reset role; + +drop extension hstore; + +-- exempt role (supabase_admin, via supautils.privileged_extensions_superuser): +-- the version clause is honored, with no warning +create extension hstore version '1.4'; +select extversion from pg_extension where extname = 'hstore'; + +-- restore the state prime.sql created (hstore at default version) +drop extension hstore; +create extension hstore;