noset
Module for blocking SET variables for non-super users.
Repository
https://gitlab.com/ongresinc/extensions/noset
https://gitlab.com/ongresinc/extensions/noset
Source
noset-v0.3.0.tar.gz
noset-v0.3.0.tar.gz
Overview
| Package | Version | Category | License | Language |
|---|---|---|---|---|
pg_noset | 0.3.0 | SEC | AGPL-3.0 | C |
| ID | Extension | Bin | Lib | Load | Create | Trust | Reloc | Schema |
|---|---|---|---|---|---|---|---|---|
| 7420 | noset | No | Yes | Yes | Yes | No | Yes | - |
| Related | pg_readonly pg_permissions set_user pgaudit login_hook sepgsql safeupdate credcheck |
|---|
Version
| Type | Repo | Version | PG Ver | Package | Deps |
|---|---|---|---|---|---|
| EXT | PIGSTY | 0.3.0 | 1817161514 | pg_noset | - |
| RPM | PIGSTY | 0.3.0 | 1817161514 | noset_$v | - |
| DEB | PIGSTY | 0.3.0 | 1817161514 | postgresql-$v-noset | - |
Build
You can build the RPM / DEB packages for pg_noset using pig build:
pig build pkg pg_noset # build RPM / DEB packages
Install
You can install pg_noset directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:
pig repo add pgsql -u # Add repo and update cache
Install the extension using pig or apt/yum/dnf:
pig install pg_noset; # Install for current active PG version
pig ext install -y pg_noset -v 18 # PG 18
pig ext install -y pg_noset -v 17 # PG 17
pig ext install -y pg_noset -v 16 # PG 16
pig ext install -y pg_noset -v 15 # PG 15
pig ext install -y pg_noset -v 14 # PG 14
dnf install -y noset_18 # PG 18
dnf install -y noset_17 # PG 17
dnf install -y noset_16 # PG 16
dnf install -y noset_15 # PG 15
dnf install -y noset_14 # PG 14
apt install -y postgresql-18-noset # PG 18
apt install -y postgresql-17-noset # PG 17
apt install -y postgresql-16-noset # PG 16
apt install -y postgresql-15-noset # PG 15
apt install -y postgresql-14-noset # PG 14
Preload:
shared_preload_libraries = 'noset';
Create Extension:
CREATE EXTENSION noset;
Usage
noset: Prevent users from changing session parameters via SET/RESET
noset is a loadable module that prevents specific users from using SET or RESET commands to change session parameters.
CREATE EXTENSION noset;
Configuration
Add to postgresql.conf:
shared_preload_libraries = 'noset'
GUC Parameters
| Parameter | Default | Description |
|---|---|---|
noset.enabled | false | Enable SET/RESET blocking for the role |
noset.parameters | * | Parameters to block (comma-separated, * = all) |
Setting Up Per-User Restrictions
-- Block ALL SET/RESET for a user
ALTER USER appuser SET noset.enabled = true;
-- Block only specific parameters
ALTER USER appuser SET noset.enabled = true;
ALTER USER appuser SET noset.parameters = 'work_mem,jit';
Example
-- As appuser:
SET work_mem = '1GB';
-- ERROR: permission denied to set/reset parameter 'set work_mem = '1GB';'
SET maintenance_work_mem = '1GB';
-- SET (allowed, not in blocked list)
Finding Restricted Users
SELECT usename, useconfig FROM pg_user
WHERE useconfig IS NOT NULL
AND array['noset.enabled=on'] <@ useconfig;
Notes
- Does not apply to superusers
- The extension revokes access to the
set_configfunction from PUBLIC
Feedback
Was this page helpful?
Thanks for the feedback! Please let us know how we can improve.
Sorry to hear that. Please let us know how we can improve.