supautils

Overview

Version

Build

You can build the RPM / DEB packages for supautils using pig build:

pig build pkg supautils         # build RPM / DEB packages

Install

You can install supautils directly. First, make sure the PGDG and PIGSTY repositories are added and enabled:

pig repo add pgsql -u          # Add repo and update cache

Install the extension using pig or apt/yum/dnf:

• Install
• pig
• dnf
• apt

pig install supautils;          # Install for current active PG version

pig ext install -y supautils -v 18  # PG 18
pig ext install -y supautils -v 17  # PG 17
pig ext install -y supautils -v 16  # PG 16
pig ext install -y supautils -v 15  # PG 15
pig ext install -y supautils -v 14  # PG 14

dnf install -y supautils_18       # PG 18
dnf install -y supautils_17       # PG 17
dnf install -y supautils_16       # PG 16
dnf install -y supautils_15       # PG 15
dnf install -y supautils_14       # PG 14

apt install -y postgresql-18-supautils   # PG 18
apt install -y postgresql-17-supautils   # PG 17
apt install -y postgresql-16-supautils   # PG 16
apt install -y postgresql-15-supautils   # PG 15
apt install -y postgresql-14-supautils   # PG 14

Preload:

shared_preload_libraries = 'supautils';

Usage

supautils: Extension that secures a cluster on a cloud environment

supautils is a loadable library that securely allows creating event triggers, publications, and extensions for non-superusers. It is completely managed by configuration – no tables, functions, or security labels are added to your database.

Configuration

Add to postgresql.conf:

shared_preload_libraries = 'supautils'
supautils.privileged_role = 'your_privileged_role'

Or enable per-role:

ALTER ROLE role1 SET session_preload_libraries TO 'supautils';

Key GUC Parameters

Non-Superuser Publications

SET ROLE privileged_role;
CREATE PUBLICATION p FOR ALL TABLES;
DROP PUBLICATION p;

Privileged Extensions

supautils.privileged_extensions = 'hstore'

Non-superusers can then create extensions that normally require superuser:

CREATE EXTENSION hstore;

Reserved Roles

supautils.reserved_roles = 'connector, storage_admin'

Users with CREATEROLE cannot ALTER or DROP these roles.

Table Ownership Bypass (RLS Policy Management)

supautils.policy_grants = '{ "my_role": ["public.not_my_table"] }'

Allows my_role to manage RLS policies on tables it does not own.