supautils

supautils : Extension that secures a cluster on a cloud environment

Overview

Packages

Source

pig build pkg supautils;		# build rpm/deb

Install

Make sure PGDG and PIGSTY repo available:

pig repo add pgsql -u   # add both repo and update cache

Install this extension with pig:

pig install supautils;		# install via package name, for the active PG version

pig install supautils -v 18;   # install for PG 18
pig install supautils -v 17;   # install for PG 17
pig install supautils -v 16;   # install for PG 16
pig install supautils -v 15;   # install for PG 15
pig install supautils -v 14;   # install for PG 14

Config this extension to shared_preload_libraries:

shared_preload_libraries = 'supautils';

This extension does not need CREATE EXTENSION DDL command

Usage

supautils: Extension that secures a cluster on a cloud environment

supautils is a loadable library that securely allows creating event triggers, publications, and extensions for non-superusers. It is completely managed by configuration – no tables, functions, or security labels are added to your database.

Configuration

Add to postgresql.conf:

shared_preload_libraries = 'supautils'
supautils.privileged_role = 'your_privileged_role'

Or enable per-role:

ALTER ROLE role1 SET session_preload_libraries TO 'supautils';

Key GUC Parameters

Non-Superuser Publications

SET ROLE privileged_role;
CREATE PUBLICATION p FOR ALL TABLES;
DROP PUBLICATION p;

Privileged Extensions

supautils.privileged_extensions = 'hstore'

Non-superusers can then create extensions that normally require superuser:

CREATE EXTENSION hstore;

Reserved Roles

supautils.reserved_roles = 'connector, storage_admin'

Users with CREATEROLE cannot ALTER or DROP these roles.

Table Ownership Bypass (RLS Policy Management)

supautils.policy_grants = '{ "my_role": ["public.not_my_table"] }'

Allows my_role to manage RLS policies on tables it does not own.