diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 5468637e2e..f65c17e5ae 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -199,7 +199,8 @@ shared_buffers = 128MB External tools may also modify postgresql.auto.conf. It is not - recommended to do this while the server is running, since a + recommended to do this while the server is running unless is set to off, since a concurrent ALTER SYSTEM command could overwrite such changes. Such tools might simply append new settings to the end, or they might choose to remove duplicate settings and/or comments @@ -10767,6 +10768,54 @@ dynamic_library_path = 'C:\tools\postgresql;H:\my_project\lib;$libdir' + + allow_alter_system (boolean) + + allow_alter_system configuration parameter + + + + + When allow_alter_system is set to + off, an error is returned if the ALTER + SYSTEM command is executed. This parameter can only be set in + the postgresql.conf file or on the server command + line. The default value is on. + + + + Note that this setting must not be regarded as a security feature. It + only disables the ALTER SYSTEM command. It does not + prevent a superuser from changing the configuration using other SQL + commands. A superuser has many ways of executing shell commands at + the operating system level, and can therefore modify + postgresql.auto.conf regardless of the value of + this setting. + + + + Turning this setting off is intended for environments where the + configuration of PostgreSQL is managed by + some external tool. + In such environments, a well intentioned superuser might + mistakenly use ALTER SYSTEM + to change the configuration instead of using the external tool. + This might result in unintended behavior, such as the external tool + overwriting the change at some later point in time when it updates the + configuration. + Setting this parameter to off can + help avoid such mistakes. + + + + This parameter only controls the use of ALTER SYSTEM. + The settings stored in postgresql.auto.conf + take effect even if allow_alter_system is set to + off. + + + + diff --git a/doc/src/sgml/ref/alter_system.sgml b/doc/src/sgml/ref/alter_system.sgml index bea5714ba1..1bde66d6ad 100644 --- a/doc/src/sgml/ref/alter_system.sgml +++ b/doc/src/sgml/ref/alter_system.sgml @@ -104,6 +104,7 @@ ALTER SYSTEM RESET ALL This command can't be used to set , + , nor parameters that are not allowed in postgresql.conf (e.g., preset options). @@ -111,6 +112,13 @@ ALTER SYSTEM RESET ALL See for other ways to set the parameters. + + + ALTER SYSTEM can be disabled by setting + to off, but this + is not a security mechanism (as explained in detail in the documentation for + this parameter). + diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index 391866145e..f51b3e0b50 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -4563,6 +4563,11 @@ AlterSystemSetConfigFile(AlterSystemStmt *altersysstmt) */ name = altersysstmt->setstmt->name; + if (!AllowAlterSystem) + ereport(ERROR, + (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), + errmsg("ALTER SYSTEM is not allowed in this environment"))); + switch (altersysstmt->setstmt->kind) { case VAR_SET_VALUE: diff --git a/src/backend/utils/misc/guc_tables.c b/src/backend/utils/misc/guc_tables.c index abd9029451..92fcd5fa4d 100644 --- a/src/backend/utils/misc/guc_tables.c +++ b/src/backend/utils/misc/guc_tables.c @@ -494,6 +494,7 @@ extern const struct config_enum_entry dynamic_shared_memory_options[]; /* * GUC option variables that are exported from this module */ +bool AllowAlterSystem = true; bool log_duration = false; bool Debug_print_plan = false; bool Debug_print_parse = false; @@ -1040,6 +1041,22 @@ struct config_bool ConfigureNamesBool[] = false, NULL, NULL, NULL }, + { + /* + * This setting itself cannot be set by ALTER SYSTEM to avoid an + * operator turning this setting off by using ALTER SYSTEM, without a + * way to turn it back on. + */ + {"allow_alter_system", PGC_SIGHUP, COMPAT_OPTIONS_OTHER, + gettext_noop("Allows running the ALTER SYSTEM command."), + gettext_noop("Can be set to off for environments where global configuration " + "changes should be made using a different method."), + GUC_DISALLOW_IN_AUTO_FILE + }, + &AllowAlterSystem, + true, + NULL, NULL, NULL + }, { {"bonjour", PGC_POSTMASTER, CONN_AUTH_SETTINGS, gettext_noop("Enables advertising the server via Bonjour."), diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 2244ee52f7..adcc0257f9 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -805,6 +805,7 @@ # - Other Platforms and Clients - #transform_null_equals = off +#allow_alter_system = on #------------------------------------------------------------------------------ diff --git a/src/include/utils/guc.h b/src/include/utils/guc.h index 3712aba09b..8d1fe04078 100644 --- a/src/include/utils/guc.h +++ b/src/include/utils/guc.h @@ -254,6 +254,7 @@ extern PGDLLIMPORT bool log_btree_build_stats; extern PGDLLIMPORT bool check_function_bodies; extern PGDLLIMPORT bool current_role_is_superuser; +extern PGDLLIMPORT bool AllowAlterSystem; extern PGDLLIMPORT bool log_duration; extern PGDLLIMPORT int log_parameter_max_length; extern PGDLLIMPORT int log_parameter_max_length_on_error;