problems installing plpythonu

[Ferdinand]

1) the db user must be superuser to issue CREATE LANGUAGE plpythonu;
- which seems not to be the case for the rest of OpenERP processes
my dbuser has only dbcreate rights

2) after "CREATE LANGUAGE plpythonu;" as superuser - an error is issued
......
execute
    res = self._obj.execute(query, params)
ProgrammingError: permission denied for language plpythonu

any hint?

[Albert Cervera i Areny - http://www.NaN-tic.com (albert-nan)]

A Dimarts, 7 de juliol de 2009, Ferdinand @ ChriCar va escriure:
> Public bug reported:
>
> 1) the db user must be superuser to issue CREATE LANGUAGE plpythonu;
> - which seems not to be the case for the rest of OpenERP processes
> my dbuser has only dbcreate rights

Yes, but there's no way we can workaround this. As you've seen in this version
we try to create the language automatically, but there's now way of doing that
if the user which is used to access the database is not a superuser. Which is
the right thing to do if you have security in mind.

> 2) after "CREATE LANGUAGE plpythonu;" as superuser - an error is issued
> ......
> execute
> res = self._obj.execute(query, params)
> ProgrammingError: permission denied for language plpythonu
>
> any hint?

Please try:

GRANT ALL ON LANGUAGE plpythonu TO your_openerp_user;

>
> ** Affects: openobject-client-kde
> Importance: Undecided
> Status: New

--
Albert Cervera i Areny
http://www.NaN-tic.com
Mòbil: [phone]

[Ferdinand (office-chricar)]

Now I tried

CREATE trusted LANGUAGE plpythonu;

GRANT ALL ON trusted LANGUAGE plpythonu TO openerpuser;
                             ^
blau5=# GRANT ALL ON LANGUAGE plpythonu TO openerpuser;
ERROR: language "plpythonu" is not trusted
HINT: Only superusers can use untrusted languages.
blau5=#

so it seems that the db-user must be superuser.
But I do not understand your comment that openerp user being superuser should increase security ?

[Albert Cervera i Areny - http://www.NaN-tic.com (albert-nan)]

A Dimarts, 7 de juliol de 2009, Ferdinand @ ChriCar va escriure:
> Now I tried
>
> CREATE trusted LANGUAGE plpythonu;
>
> GRANT ALL ON trusted LANGUAGE plpythonu TO openerpuser;
> ^
> blau5=# GRANT ALL ON LANGUAGE plpythonu TO openerpuser;
> ERROR: language "plpythonu" is not trusted
> HINT: Only superusers can use untrusted languages.
> blau5=#
>
> so it seems that the db-user must be superuser.
> But I do not understand your comment that openerp user being superuser
> should increase security ?

No. It's the other way round. I mean it should _not_ be superuser. The problem
as you said is that for using PL/PythonU it should be superuser. The only
possibility would be to reimplement the trigger in a trusted language such as
SQL or PL/SQL, if the administrator doesn't want to use a database superuser.

--
Albert Cervera i Areny
http://www.NaN-tic.com
Mòbil: [phone]

[Albert Cervera i Areny - http://www.NaN-tic.com (albert-nan)]

By now I've documented this in module's description.

[Ferdinand (office-chricar)]

Hint
login as superuser using psql (as user postgres)
* psql -d <database>
* alter user <database user> superuser;

the following is also done by the fts install script
login as <database user>
* psql -d <database> -U <database user>
* CREATE LANGUAGE plpythonu;