Re: What's the point of allow_system_table_mods?

Andrew Gierth <andrew@tao11.riddles.org.uk> writes:
> "Andres" == Andres Freund <andres@anarazel.de> writes:
>  Andres> Why is it so much more dangerous? I've seen plenty of corrupted
>  Andres> clusters due to people doing DML against the catalogs. I'm OK
>  Andres> with adding separate GUCs for both, if we want to do that, but
>  Andres> I do think we shouldn't allow updating the catalogs wthout
>  Andres> having having the superuser explicitly opt into that.

> Be aware that a nonzero number of extensions (postgis especially) do
> catalog DML in their install or update scripts.

I believe we've done that in some contrib update scripts, as well.

> While you might well
> think they shouldn't do that, in practice there is usually no viable
> alternative.

In principle, if the thing is SUSET, we could have such extension scripts
set it temporarily.  But it would be a compatibility hazard -- a script
with such a SET command in it would fail in older branches.

What exactly is the motivation for changing this now, after 20 years?

            regards, tom lane