Creating a plpython function requires superuser access in Greenplum
search cancel

Creating a plpython function requires superuser access in Greenplum

book

Article ID: 296441

calendar_today

Updated On:

Products

VMware Tanzu Greenplum

Issue/Introduction

When you create a plpython function, only superuser access (db account) is allowed. Greenplum inherited this design from Postgresql.

Resolution

Checklist:

When you create a plpython function, only superuser access (db account) is allowed. Greenplum inherited this design from Postgresql.

In Postgresql, it has below setting for each user-created language. 
https://www.postgresql.org/docs/8.4/catalog-pg-language.html

True if this is a trusted language, which means that it is believed not to grant access to anything outside the normal SQL execution environment. Only superusers can create functions in untrusted languages.

Currently plpython is classified as an untrusted language.
https://www.postgresql.org/docs/current/plpython.html

PL/Python is only available as an “untrusted” language, meaning it does not offer any way of restricting what users can do in it and is therefore named plpythonu. A trusted variant plpython might become available in the future if a secure execution mechanism is developed in Python. The writer of a function in untrusted PL/Python must take care that the function cannot be used to do anything unwanted, since it will be able to do anything that could be done by a user logged in as the database administrator. Only superusers can create functions in untrusted languages such as plpythonu.

For now, if anyone need a workaround, then we suggest consider the pl/container language:
https://techdocs.broadcom.com/us/en/vmware-tanzu/data-solutions/tanzu-greenplum/6/greenplum-database/analytics-pl_container.html