From 57710f39cc55cba1e98c718300a811aadacec7c5 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Thu, 3 Sep 2009 22:11:13 +0000 Subject: Make LOAD of an already-loaded library into a no-op, instead of attempting to unload and re-load the library. The difficulty with unloading a library is that we haven't defined safe protocols for doing so. In particular, there's no safe mechanism for getting out of a "hook" function pointer unless libraries are unloaded in reverse order of loading. And there's no mechanism at all for undefining a custom GUC variable, so GUC would be left with a pointer to an old value that might or might not still be valid, and very possibly wouldn't be in the same place anymore. While the unload and reload behavior had some usefulness in easing development of new loadable libraries, it's of no use whatever to normal users, so just disabling it isn't giving up that much. Someday we might care to expend the effort to develop safe unload protocols; but even if we did, there'd be little certainty that every third-party loadable module was following them, so some security restrictions would still be needed. Back-patch to 8.2; before that, LOAD was superuser-only anyway. Security: unprivileged users could crash backend. CVE not assigned yet --- src/backend/utils/fmgr/dfmgr.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) (limited to 'src') diff --git a/src/backend/utils/fmgr/dfmgr.c b/src/backend/utils/fmgr/dfmgr.c index 8b819df279c..abe5a870c74 100644 --- a/src/backend/utils/fmgr/dfmgr.c +++ b/src/backend/utils/fmgr/dfmgr.c @@ -8,7 +8,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/utils/fmgr/dfmgr.c,v 1.99 2009/06/11 14:49:05 momjian Exp $ + * $PostgreSQL: pgsql/src/backend/utils/fmgr/dfmgr.c,v 1.99.2.1 2009/09/03 22:11:13 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -385,10 +385,17 @@ incompatible_module_error(const char *libname, * Unload the specified dynamic-link library file, if it is loaded. * * Note: libname is expected to be an exact name for the library file. + * + * XXX for the moment, this is disabled, resulting in LOAD of an already-loaded + * library always being a no-op. We might re-enable it someday if we can + * convince ourselves we have safe protocols for un-hooking from hook function + * pointers, releasing custom GUC variables, and perhaps other things that + * are definitely unsafe currently. */ static void internal_unload_library(const char *libname) { +#ifdef NOT_USED DynamicFileList *file_scanner, *prv, *nxt; @@ -436,6 +443,7 @@ internal_unload_library(const char *libname) else prv = file_scanner; } +#endif /* NOT_USED */ } static bool -- cgit v1.2.3