Add an output_plugin_libraries GUC to bless trusted output plugins REPLICATION users were not previously subject to restrictions on output plugin paths, so they were able to bypass LOAD-time protections during logical decoding. Unfortunately, adding the standard LOAD restrictions now would retroactively require all third-party output plugins to be installed under the $libdir/plugins directory. This would prevent the use of dynamic_library_path, introduce a wire incompatibility for clients, and require all plugin authors to check that their libraries are safe for use by any unprivileged user; we want to avoid that.
Instead, introduce an output_plugin_libraries GUC so that DBAs can specify the output plugins that are trusted for use in logical decoding. For simplicity, superusers are subject to the restriction as well (though they're free to modify the GUC at will during a session, so no power is actually lost). The default setting is 'pgoutput, test_decoding'. If other third-party plugins are in use, DBAs will need to modify this parameter after they update. Some pointers have been added to the documentation to assist with this. Author: Jacob Champion <[email protected]> Reported-by: Vladimir Tokarev <[email protected]> Reported-by: Yu Kunpeng <[email protected]> Reviewed-by: Álvaro Herrera <[email protected]> Reviewed-by: Noah Misch <[email protected]> Reviewed-by: Robert Haas <[email protected]> Reviewed-by: Tom Lane <[email protected]> Backpatch-through: 14 Security: CVE-2026-6471 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/4e1252ee56c33b8a1144b25b5803f47276662519 Author: Jacob Champion <[email protected]> Modified Files -------------- contrib/test_decoding/expected/permissions.out | 11 ++++ contrib/test_decoding/expected/slot.out | 3 + contrib/test_decoding/sql/permissions.sql | 8 +++ contrib/test_decoding/sql/slot.sql | 3 + doc/src/sgml/config.sgml | 57 +++++++++++++++++++ doc/src/sgml/logical-replication.sgml | 9 +++ src/backend/replication/logical/logical.c | 76 +++++++++++++++++++++++++- src/backend/utils/misc/guc_tables.c | 12 ++++ src/backend/utils/misc/postgresql.conf.sample | 1 + src/bin/pg_dump/dumputils.c | 1 + src/include/replication/logical.h | 3 + src/test/subscription/t/100_bugs.pl | 28 +++++++++- 12 files changed, 209 insertions(+), 3 deletions(-)
