On Thu, 4 Dec 2025 at 19:49, Kirill Reshke <[email protected]> wrote: > > Good question. I think the easiest would be to always disallow FROM > > PROGRAM (by default) instead of only when connecting over the network. > > How? with GUC?
I meant, sidestep this problem completely by not doing my idea of still allowing FROM PROGRAM over unix connections. And instead disallowing it for any connections. > > Another option would be to have dblink (and pg_fdw) tell postgres (wih > > e.g. a GUC being set in the StartupMessage) that it should be > > considered a remote connection for these purposes. > > Again, if we are using GUC to tell somebody something about security, > this doesn't work. Superuser can easily redefine any GUC. If you mark this GUC as PGC_BACKEND it cannot be changed with SET commands, not even by superusers.
