block_copy_command

Overview

Requires shared_preload_libraries = block_copy_command.

Version

Build

You can build the RPM / DEB packages for block_copy_command using pig build:

pig build pkg block_copy_command         # build RPM / DEB packages

Install

You can install block_copy_command directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

• Install
• pig
• dnf
• apt

pig install block_copy_command;          # Install for current active PG version

pig ext install -y block_copy_command -v 18  # PG 18
pig ext install -y block_copy_command -v 17  # PG 17
pig ext install -y block_copy_command -v 16  # PG 16
pig ext install -y block_copy_command -v 15  # PG 15
pig ext install -y block_copy_command -v 14  # PG 14

dnf install -y block_copy_command_18       # PG 18
dnf install -y block_copy_command_17       # PG 17
dnf install -y block_copy_command_16       # PG 16
dnf install -y block_copy_command_15       # PG 15
dnf install -y block_copy_command_14       # PG 14

apt install -y postgresql-18-block-copy-command   # PG 18
apt install -y postgresql-17-block-copy-command   # PG 17
apt install -y postgresql-16-block-copy-command   # PG 16
apt install -y postgresql-15-block-copy-command   # PG 15
apt install -y postgresql-14-block-copy-command   # PG 14

Preload:

shared_preload_libraries = 'block_copy_command';

Create Extension:

CREATE EXTENSION block_copy_command;

Usage

• GitHub Repo: rustwizard/block_copy_command
• README: rustwizard/block_copy_command/blob/master/README.md

block_copy_command blocks COPY commands cluster-wide by installing a ProcessUtility hook. It is loaded with shared_preload_libraries, and CREATE EXTENSION only registers the extension metadata in each database.

This extension is intended for deployments that want to stop COPY TO and COPY FROM by default for non-superusers, while still allowing finer-grained policy through GUCs and an audit table.

Setup

shared_preload_libraries = 'block_copy_command'

CREATE EXTENSION block_copy_command;

The README says the hook becomes active for the whole cluster as soon as the library is loaded.

Blocking Rules

By default, non-superusers are blocked from running COPY.

COPY my_table TO STDOUT;
COPY my_table FROM STDIN;
COPY (SELECT * FROM my_table) TO '/tmp/out.csv';

Superusers bypass the block unless they are listed in block_copy_command.blocked_roles or block_copy_command.block_program is enabled. COPY ... PROGRAM is blocked for everyone by default.

Settings

• block_copy_command.enabled toggles blocking for non-superusers.
• block_copy_command.block_to controls whether COPY TO is blocked.
• block_copy_command.block_from controls whether COPY FROM is blocked.
• block_copy_command.block_program blocks COPY TO/FROM PROGRAM for all users.
• block_copy_command.hint appends a custom HINT: to blocked commands.
• block_copy_command.blocked_roles permanently blocks named roles, including superusers.
• block_copy_command.audit_log_enabled controls whether intercepted COPY events are written to block_copy_command.audit_log.

Audit Log

The extension records intercepted COPY activity in block_copy_command.audit_log and also writes blocked events to the PostgreSQL server log at LOG level.

Typical monitoring queries from the README include listing recent events, filtering blocked events, and grouping by user.

Scope

The upstream README covers requirements, enablement, blocking behavior, the main GUCs, the audit table, and test coverage. No separate project homepage or docs site was needed for this stub.