1
0
mirror of https://github.com/postgres/postgres.git synced 2025-05-21 15:54:08 +03:00
postgres/doc/src/sgml/ref/create_extension.sgml
Tom Lane 50fc694e43 Invent "trusted" extensions, and remove the pg_pltemplate catalog.
This patch creates a new extension property, "trusted".  An extension
that's marked that way in its control file can be installed by a
non-superuser who has the CREATE privilege on the current database,
even if the extension contains objects that normally would have to be
created by a superuser.  The objects within the extension will (by
default) be owned by the bootstrap superuser, but the extension itself
will be owned by the calling user.  This allows replicating the old
behavior around trusted procedural languages, without all the
special-case logic in CREATE LANGUAGE.  We have, however, chosen to
loosen the rules slightly: formerly, only a database owner could take
advantage of the special case that allowed installation of a trusted
language, but now anyone who has CREATE privilege can do so.

Having done that, we can delete the pg_pltemplate catalog, moving the
knowledge it contained into the extension script files for the various
PLs.  This ends up being no change at all for the in-core PLs, but it is
a large step forward for external PLs: they can now have the same ease
of installation as core PLs do.  The old "trusted PL" behavior was only
available to PLs that had entries in pg_pltemplate, but now any
extension can be marked trusted if appropriate.

This also removes one of the stumbling blocks for our Python 2 -> 3
migration, since the association of "plpythonu" with Python 2 is no
longer hard-wired into pg_pltemplate's initial contents.  Exactly where
we go from here on that front remains to be settled, but one problem
is fixed.

Patch by me, reviewed by Peter Eisentraut, Stephen Frost, and others.

Discussion: https://postgr.es/m/5889.1566415762@sss.pgh.pa.us
2020-01-29 18:42:43 -05:00

254 lines
9.1 KiB
Plaintext

<!--
doc/src/sgml/ref/create_extension.sgml
PostgreSQL documentation
-->
<refentry id="sql-createextension">
<indexterm zone="sql-createextension">
<primary>CREATE EXTENSION</primary>
</indexterm>
<refmeta>
<refentrytitle>CREATE EXTENSION</refentrytitle>
<manvolnum>7</manvolnum>
<refmiscinfo>SQL - Language Statements</refmiscinfo>
</refmeta>
<refnamediv>
<refname>CREATE EXTENSION</refname>
<refpurpose>install an extension</refpurpose>
</refnamediv>
<refsynopsisdiv>
<synopsis>
CREATE EXTENSION [ IF NOT EXISTS ] <replaceable class="parameter">extension_name</replaceable>
[ WITH ] [ SCHEMA <replaceable class="parameter">schema_name</replaceable> ]
[ VERSION <replaceable class="parameter">version</replaceable> ]
[ FROM <replaceable class="parameter">old_version</replaceable> ]
[ CASCADE ]
</synopsis>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
<para>
<command>CREATE EXTENSION</command> loads a new extension into the current
database. There must not be an extension of the same name already loaded.
</para>
<para>
Loading an extension essentially amounts to running the extension's script
file. The script will typically create new <acronym>SQL</acronym> objects such as
functions, data types, operators and index support methods.
<command>CREATE EXTENSION</command> additionally records the identities
of all the created objects, so that they can be dropped again if
<command>DROP EXTENSION</command> is issued.
</para>
<para>
The user who runs <command>CREATE EXTENSION</command> becomes the
owner of the extension for purposes of later privilege checks, as well
as the owner of any objects created by the extension's script.
</para>
<para>
Loading an extension ordinarily requires the same privileges that would
be required to create its component objects. For many extensions this
means superuser privileges are needed.
However, if the extension is marked <firstterm>trusted</firstterm> in
its control file, then it can be installed by any user who has
<literal>CREATE</literal> privilege on the current database.
In this case the extension object itself will be owned by the calling
user, but the contained objects will be owned by the bootstrap superuser
(unless the extension's script explicitly assigns them to the calling
user). This configuration gives the calling user the right to drop the
extension, but not to modify individual objects within it.
</para>
</refsect1>
<refsect1>
<title>Parameters</title>
<variablelist>
<varlistentry>
<term><literal>IF NOT EXISTS</literal></term>
<listitem>
<para>
Do not throw an error if an extension with the same name already
exists. A notice is issued in this case. Note that there is no
guarantee that the existing extension is anything like the one that
would have been created from the currently-available script file.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><replaceable class="parameter">extension_name</replaceable></term>
<listitem>
<para>
The name of the extension to be
installed. <productname>PostgreSQL</productname> will create the
extension using details from the file
<literal>SHAREDIR/extension/</literal><replaceable class="parameter">extension_name</replaceable><literal>.control</literal>.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><replaceable class="parameter">schema_name</replaceable></term>
<listitem>
<para>
The name of the schema in which to install the extension's
objects, given that the extension allows its contents to be
relocated. The named schema must already exist.
If not specified, and the extension's control file does not specify a
schema either, the current default object creation schema is used.
</para>
<para>
If the extension specifies a <literal>schema</literal> parameter in its
control file, then that schema cannot be overridden with
a <literal>SCHEMA</literal> clause. Normally, an error will be raised if
a <literal>SCHEMA</literal> clause is given and it conflicts with the
extension's <literal>schema</literal> parameter. However, if
the <literal>CASCADE</literal> clause is also given,
then <replaceable class="parameter">schema_name</replaceable> is
ignored when it conflicts. The
given <replaceable class="parameter">schema_name</replaceable> will be
used for installation of any needed extensions that do not
specify <literal>schema</literal> in their control files.
</para>
<para>
Remember that the extension itself is not considered to be within any
schema: extensions have unqualified names that must be unique
database-wide. But objects belonging to the extension can be within
schemas.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><replaceable class="parameter">version</replaceable></term>
<listitem>
<para>
The version of the extension to install. This can be written as
either an identifier or a string literal. The default version is
whatever is specified in the extension's control file.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><replaceable class="parameter">old_version</replaceable></term>
<listitem>
<para>
<literal>FROM</literal> <replaceable class="parameter">old_version</replaceable>
must be specified when, and only when, you are attempting to install
an extension that replaces an <quote>old style</quote> module that is just
a collection of objects not packaged into an extension. This option
causes <command>CREATE EXTENSION</command> to run an alternative installation
script that absorbs the existing objects into the extension, instead
of creating new objects. Be careful that <literal>SCHEMA</literal> specifies
the schema containing these pre-existing objects.
</para>
<para>
The value to use for <replaceable
class="parameter">old_version</replaceable> is determined by the
extension's author, and might vary if there is more than one version
of the old-style module that can be upgraded into an extension.
For the standard additional modules supplied with pre-9.1
<productname>PostgreSQL</productname>, use <literal>unpackaged</literal>
for <replaceable class="parameter">old_version</replaceable> when
updating a module to extension style.
</para>
</listitem>
</varlistentry>
<varlistentry>
<term><literal>CASCADE</literal></term>
<listitem>
<para>
Automatically install any extensions that this extension depends on
that are not already installed. Their dependencies are likewise
automatically installed, recursively. The <literal>SCHEMA</literal> clause,
if given, applies to all extensions that get installed this way.
Other options of the statement are not applied to
automatically-installed extensions; in particular, their default
versions are always selected.
</para>
</listitem>
</varlistentry>
</variablelist>
</refsect1>
<refsect1>
<title>Notes</title>
<para>
Before you can use <command>CREATE EXTENSION</command> to load an extension
into a database, the extension's supporting files must be installed.
Information about installing the extensions supplied with
<productname>PostgreSQL</productname> can be found in
<link linkend="contrib">Additional Supplied Modules</link>.
</para>
<para>
The extensions currently available for loading can be identified from the
<link linkend="view-pg-available-extensions"><structname>pg_available_extensions</structname></link>
or
<link linkend="view-pg-available-extension-versions"><structname>pg_available_extension_versions</structname></link>
system views.
</para>
<para>
For information about writing new extensions, see
<xref linkend="extend-extensions"/>.
</para>
</refsect1>
<refsect1>
<title>Examples</title>
<para>
Install the <link linkend="hstore">hstore</link> extension into the
current database:
<programlisting>
CREATE EXTENSION hstore;
</programlisting>
</para>
<para>
Update a pre-9.1 installation of <literal>hstore</literal> into
extension style:
<programlisting>
CREATE EXTENSION hstore SCHEMA public FROM unpackaged;
</programlisting>
Be careful to specify the schema in which you installed the existing
<literal>hstore</literal> objects.
</para>
</refsect1>
<refsect1>
<title>Compatibility</title>
<para>
<command>CREATE EXTENSION</command> is a <productname>PostgreSQL</productname>
extension.
</para>
</refsect1>
<refsect1>
<title>See Also</title>
<simplelist type="inline">
<member><xref linkend="sql-alterextension"/></member>
<member><xref linkend="sql-dropextension"/></member>
</simplelist>
</refsect1>
</refentry>