Restrict accesses to non-system views and foreign tables during pg_dump.

When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.

This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.

To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.

Back-patch to all supported branches.

Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 9f7d3441cff2d957b1e406799731d083887fdb7a..cf44b8b79e73da978d780fc2c6da31fe6bee29c0 100644 (file)
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -620,6 +620,15 @@ EXPLAIN (VERBOSE, COSTS OFF) SELECT * FROM ft_empty ORDER BY c1;
    Remote SQL: SELECT c1, c2 FROM public.loct_empty ORDER BY c1 ASC NULLS LAST
 (3 rows)
 
+-- test restriction on non-system foreign tables.
+SET restrict_nonsystem_relation_kind TO 'foreign-table';
+SELECT * from ft1 where c1 < 1; -- ERROR
+ERROR:  access to non-system foreign table is restricted
+INSERT INTO ft1 (c1) VALUES (1); -- ERROR
+ERROR:  access to non-system foreign table is restricted
+DELETE FROM ft1 WHERE c1 = 1; -- ERROR
+ERROR:  access to non-system foreign table is restricted
+RESET restrict_nonsystem_relation_kind;
 -- ===================================================================
 -- WHERE with remotely-executable conditions
 -- ===================================================================

diff --git a/contrib/postgres_fdw/sql/postgres_fdw.sql b/contrib/postgres_fdw/sql/postgres_fdw.sql
index 0e9a558a90d2225c8814772be21af2dcaddd4dda..a2aec91ab42881b9d23e208b6f2b3b971d6b23d2 100644 (file)
--- a/contrib/postgres_fdw/sql/postgres_fdw.sql
+++ b/contrib/postgres_fdw/sql/postgres_fdw.sql
@@ -310,6 +310,13 @@ DELETE FROM loct_empty;
 ANALYZE ft_empty;
 EXPLAIN (VERBOSE, COSTS OFF) SELECT * FROM ft_empty ORDER BY c1;
 
+-- test restriction on non-system foreign tables.
+SET restrict_nonsystem_relation_kind TO 'foreign-table';
+SELECT * from ft1 where c1 < 1; -- ERROR
+INSERT INTO ft1 (c1) VALUES (1); -- ERROR
+DELETE FROM ft1 WHERE c1 = 1; -- ERROR
+RESET restrict_nonsystem_relation_kind;
+
 -- ===================================================================
 -- WHERE with remotely-executable conditions
 -- ===================================================================

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index a5a0998ce80d33d741cac3ce22a087ff52f35c2a..7aa683c166f384c85db7c73f851ef1c5cdcc3ed3 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -8581,6 +8581,23 @@ SET XML OPTION { DOCUMENT | CONTENT };
       </listitem>
      </varlistentry>
 
+     <varlistentry id="guc-restrict-nonsystem-relation-kind" xreflabel="restrict_nonsystem_relation_kind">
+      <term><varname>restrict_nonsystem_relation_kind</varname> (<type>string</type>)
+      <indexterm>
+       <primary><varname>restrict_nonsystem_relation_kind</varname></primary>
+       <secondary>configuration parameter</secondary>
+     </indexterm>
+     </term>
+     <listitem>
+      <para>
+       This variable specifies relation kind to which access is restricted.
+       It contains a comma-separated list of relation kind.  Currently, the
+       supported relation kinds are <literal>view</literal> and
+       <literal>foreign-table</literal>.
+      </para>
+     </listitem>
+     </varlistentry>
+
      </variablelist>
     </sect2>
      <sect2 id="runtime-config-client-format">

diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml
index 023d82b2ef2f08be18abb3252861ccad17acf31c..bd9d21a0c6abca33fca55b51040d6b6989eabd86 100644 (file)
--- a/doc/src/sgml/ref/pg_dump.sgml
+++ b/doc/src/sgml/ref/pg_dump.sgml
@@ -793,6 +793,14 @@ PostgreSQL documentation
         The only exception is that an empty pattern is disallowed.
        </para>
 
+       <note>
+        <para>
+         Using wildcards in <option>--include-foreign-data</option> may result
+         in access to unexpected foreign servers. Also, to use this option securely,
+         make sure that the named server must have a trusted owner.
+        </para>
+       </note>
+
        <note>
         <para>
          When <option>--include-foreign-data</option> is specified,

diff --git a/src/backend/foreign/foreign.c b/src/backend/foreign/foreign.c
index 61e48ca3f87d79b3f9ae8b26e88622f1a91b2202..1b9cced5684c1a53f20c03937a78702cf87a2241 100644 (file)
--- a/src/backend/foreign/foreign.c
+++ b/src/backend/foreign/foreign.c
@@ -22,6 +22,7 @@
 #include "foreign/foreign.h"
 #include "lib/stringinfo.h"
 #include "miscadmin.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/memutils.h"
 #include "utils/rel.h"
@@ -321,6 +322,15 @@ GetFdwRoutine(Oid fdwhandler)
    Datum       datum;
    FdwRoutine *routine;
 
+   /* Check if the access to foreign tables is restricted */
+   if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+   {
+       /* there must not be built-in FDW handler  */
+       ereport(ERROR,
+               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                errmsg("access to non-system foreign table is restricted")));
+   }
+
    datum = OidFunctionCall0(fdwhandler);
    routine = (FdwRoutine *) DatumGetPointer(datum);
 

diff --git a/src/backend/optimizer/plan/createplan.c b/src/backend/optimizer/plan/createplan.c
index 917713c163397d6e018ff3a1bd07a85f222306b8..4dc3b34188d6e31cc451ba99f95727b8770d8dde 100644 (file)
--- a/src/backend/optimizer/plan/createplan.c
+++ b/src/backend/optimizer/plan/createplan.c
@@ -40,6 +40,7 @@
 #include "parser/parse_clause.h"
 #include "parser/parsetree.h"
 #include "partitioning/partprune.h"
+#include "tcop/tcopprot.h"
 #include "utils/lsyscache.h"
 
 
@@ -6819,7 +6820,19 @@ make_modifytable(PlannerInfo *root,
 
            Assert(rte->rtekind == RTE_RELATION);
            if (rte->relkind == RELKIND_FOREIGN_TABLE)
+           {
+               /* Check if the access to foreign tables is restricted */
+               if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+               {
+                   /* there must not be built-in foreign tables */
+                   Assert(rte->relid >= FirstNormalObjectId);
+                   ereport(ERROR,
+                           (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                            errmsg("access to non-system foreign table is restricted")));
+               }
+
                fdwroutine = GetFdwRoutineByRelId(rte->relid);
+           }
            else
                fdwroutine = NULL;
        }

diff --git a/src/backend/optimizer/util/plancat.c b/src/backend/optimizer/util/plancat.c
index e7b12ffcce3b66e841ed1fe115f6e37262bb3bea..baeaf60187db3035ae48218f914d43d658564be7 100644 (file)
--- a/src/backend/optimizer/util/plancat.c
+++ b/src/backend/optimizer/util/plancat.c
@@ -46,6 +46,7 @@
 #include "rewrite/rewriteManip.h"
 #include "statistics/statistics.h"
 #include "storage/bufmgr.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/lsyscache.h"
 #include "utils/partcache.h"
@@ -463,6 +464,17 @@ get_relation_info(PlannerInfo *root, Oid relationObjectId, bool inhparent,
    /* Grab foreign-table info using the relcache, while we have it */
    if (relation->rd_rel->relkind == RELKIND_FOREIGN_TABLE)
    {
+       /* Check if the access to foreign tables is restricted */
+       if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+       {
+           /* there must not be built-in foreign tables */
+           Assert(RelationGetRelid(relation) >= FirstNormalObjectId);
+
+           ereport(ERROR,
+                   (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                    errmsg("access to non-system foreign table is restricted")));
+       }
+
        rel->serverid = GetForeignServerIdByRelId(RelationGetRelid(relation));
        rel->fdwroutine = GetFdwRoutineForRelation(relation, true);
    }

diff --git a/src/backend/rewrite/rewriteHandler.c b/src/backend/rewrite/rewriteHandler.c
index 57ded28bcfe3f6247a7884b1b999c855a2fc5256..a086256cd72879c91034717ac527c9286a9541da 100644 (file)
--- a/src/backend/rewrite/rewriteHandler.c
+++ b/src/backend/rewrite/rewriteHandler.c
@@ -40,6 +40,7 @@
 #include "rewrite/rewriteHandler.h"
 #include "rewrite/rewriteManip.h"
 #include "rewrite/rowsecurity.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -1678,6 +1679,14 @@ ApplyRetrieveRule(Query *parsetree,
    if (rule->qual != NULL)
        elog(ERROR, "cannot handle qualified ON SELECT rule");
 
+   /* Check if the expansion of non-system views are restricted */
+   if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_VIEW) != 0 &&
+                RelationGetRelid(relation) >= FirstNormalObjectId))
+       ereport(ERROR,
+               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                errmsg("access to non-system view \"%s\" is restricted",
+                       RelationGetRelationName(relation))));
+
    if (rt_index == parsetree->resultRelation)
    {
        /*
@@ -3055,6 +3064,14 @@ rewriteTargetView(Query *parsetree, Relation view)
        }
    }
 
+   /* Check if the expansion of non-system views are restricted */
+   if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_VIEW) != 0 &&
+                RelationGetRelid(view) >= FirstNormalObjectId))
+       ereport(ERROR,
+               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                errmsg("access to non-system view \"%s\" is restricted",
+                       RelationGetRelationName(view))));
+
    /*
     * For INSERT/UPDATE the modified columns must all be updatable.
     */

diff --git a/src/backend/tcop/postgres.c b/src/backend/tcop/postgres.c
index 1c8c7b95dad3a4dfc4564ce3b01596df6f54a5b6..ec630b449166fad5ac15a7354dcb017109c3523d 100644 (file)
--- a/src/backend/tcop/postgres.c
+++ b/src/backend/tcop/postgres.c
@@ -79,6 +79,7 @@
 #include "utils/snapmgr.h"
 #include "utils/timeout.h"
 #include "utils/timestamp.h"
+#include "utils/varlena.h"
 
 /* ----------------
  *     global variables
@@ -101,6 +102,8 @@ int         max_stack_depth = 100;
 int            PostAuthDelay = 0;
 
 
+/* flags for non-system relation kinds to restrict use */
+int            restrict_nonsystem_relation_kind;
 
 /* ----------------
  *     private variables
@@ -3441,6 +3444,66 @@ assign_max_stack_depth(int newval, void *extra)
    max_stack_depth_bytes = newval_bytes;
 }
 
+/*
+ * GUC check_hook for restrict_nonsystem_relation_kind
+ */
+bool
+check_restrict_nonsystem_relation_kind(char **newval, void **extra, GucSource source)
+{
+   char       *rawstring;
+   List       *elemlist;
+   ListCell   *l;
+   int         flags = 0;
+
+   /* Need a modifiable copy of string */
+   rawstring = pstrdup(*newval);
+
+   if (!SplitIdentifierString(rawstring, ',', &elemlist))
+   {
+       /* syntax error in list */
+       GUC_check_errdetail("List syntax is invalid.");
+       pfree(rawstring);
+       list_free(elemlist);
+       return false;
+   }
+
+   foreach(l, elemlist)
+   {
+       char       *tok = (char *) lfirst(l);
+
+       if (pg_strcasecmp(tok, "view") == 0)
+           flags |= RESTRICT_RELKIND_VIEW;
+       else if (pg_strcasecmp(tok, "foreign-table") == 0)
+           flags |= RESTRICT_RELKIND_FOREIGN_TABLE;
+       else
+       {
+           GUC_check_errdetail("Unrecognized key word: \"%s\".", tok);
+           pfree(rawstring);
+           list_free(elemlist);
+           return false;
+       }
+   }
+
+   pfree(rawstring);
+   list_free(elemlist);
+
+   /* Save the flags in *extra, for use by the assign function */
+   *extra = malloc(sizeof(int));
+   *((int *) *extra) = flags;
+
+   return true;
+}
+
+/*
+ * GUC assign_hook for restrict_nonsystem_relation_kind
+ */
+void
+assign_restrict_nonsystem_relation_kind(const char *newval, void *extra)
+{
+   int        *flags = (int *) extra;
+
+   restrict_nonsystem_relation_kind = *flags;
+}
 
 /*
  * set_debug_options --- apply "-d N" command line option

diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 025b8ccdc253528c0f9a190fb414e2daf4eed071..0ac30a859e0023a864dcff78d494aa754786c9dc 100644 (file)
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -620,6 +620,7 @@ static char *recovery_target_string;
 static char *recovery_target_xid_string;
 static char *recovery_target_name_string;
 static char *recovery_target_lsn_string;
+static char *restrict_nonsystem_relation_kind_string;
 
 
 /* should be static, but commands/variable.c needs to get at this */
@@ -4442,6 +4443,17 @@ static struct config_string ConfigureNamesString[] =
        check_backtrace_functions, assign_backtrace_functions, NULL
    },
 
+   {
+       {"restrict_nonsystem_relation_kind", PGC_USERSET, CLIENT_CONN_STATEMENT,
+           gettext_noop("Sets relation kinds of non-system relation to restrict use"),
+           NULL,
+           GUC_LIST_INPUT | GUC_NOT_IN_SAMPLE
+       },
+       &restrict_nonsystem_relation_kind_string,
+       "",
+       check_restrict_nonsystem_relation_kind, assign_restrict_nonsystem_relation_kind, NULL
+   },
+
    /* End-of-list marker */
    {
        {NULL, 0, 0, NULL, NULL}, NULL, NULL, NULL, NULL, NULL

diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c
index 6576efaeeec80730b5627ec3394d1c0fc1d97cbf..3dbc2c4ff17c571b684cf41dc73d0a1043624471 100644 (file)
--- a/src/bin/pg_dump/pg_dump.c
+++ b/src/bin/pg_dump/pg_dump.c
@@ -291,6 +291,7 @@ static void appendReloptionsArrayAH(PQExpBuffer buffer, const char *reloptions,
 static char *get_synchronized_snapshot(Archive *fout);
 static void setupDumpWorker(Archive *AHX);
 static TableInfo *getRootTableInfo(TableInfo *tbinfo);
+static void set_restrict_relation_kind(Archive *AH, const char *value);
 static bool forcePartitionRootLoad(const TableInfo *tbinfo);
 
 
@@ -1178,6 +1179,13 @@ setup_connection(Archive *AH, const char *dumpencoding,
            ExecuteSqlStatement(AH, "SET row_security = off");
    }
 
+   /*
+    * For security reasons, we restrict the expansion of non-system views and
+    * access to foreign tables during the pg_dump process. This restriction
+    * is adjusted when dumping foreign table data.
+    */
+   set_restrict_relation_kind(AH, "view, foreign-table");
+
    /*
     * Start transaction-snapshot mode transaction to dump consistent data.
     */
@@ -1900,6 +1908,10 @@ dumpTableData_copy(Archive *fout, void *dcontext)
     */
    if (tdinfo->filtercond || tbinfo->relkind == RELKIND_FOREIGN_TABLE)
    {
+       /* Temporary allows to access to foreign tables to dump data */
+       if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+           set_restrict_relation_kind(fout, "view");
+
        /* Note: this syntax is only supported in 8.2 and up */
        appendPQExpBufferStr(q, "COPY (SELECT ");
        /* klugery to get rid of parens in column list */
@@ -2012,6 +2024,11 @@ dumpTableData_copy(Archive *fout, void *dcontext)
                       classname);
 
    destroyPQExpBuffer(q);
+
+   /* Revert back the setting */
+   if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+       set_restrict_relation_kind(fout, "view, foreign-table");
+
    return 1;
 }
 
@@ -2038,6 +2055,10 @@ dumpTableData_insert(Archive *fout, void *dcontext)
    int         rows_per_statement = dopt->dump_inserts;
    int         rows_this_statement = 0;
 
+   /* Temporary allows to access to foreign tables to dump data */
+   if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+       set_restrict_relation_kind(fout, "view");
+
    /*
     * If we're going to emit INSERTs with column names, the most efficient
     * way to deal with generated columns is to exclude them entirely.  For
@@ -2277,6 +2298,10 @@ dumpTableData_insert(Archive *fout, void *dcontext)
        destroyPQExpBuffer(insertStmt);
    free(attgenerated);
 
+   /* Revert back the setting */
+   if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+       set_restrict_relation_kind(fout, "view, foreign-table");
+
    return 1;
 }
 
@@ -4306,6 +4331,28 @@ is_superuser(Archive *fout)
    return false;
 }
 
+/*
+ * Set the given value to restrict_nonsystem_relation_kind value. Since
+ * restrict_nonsystem_relation_kind is introduced in minor version releases,
+ * the setting query is effective only where available.
+ */
+static void
+set_restrict_relation_kind(Archive *AH, const char *value)
+{
+   PQExpBuffer query = createPQExpBuffer();
+   PGresult   *res;
+
+   appendPQExpBuffer(query,
+                     "SELECT set_config(name, '%s', false) "
+                     "FROM pg_settings "
+                     "WHERE name = 'restrict_nonsystem_relation_kind'",
+                     value);
+   res = ExecuteSqlQuery(AH, query->data, PGRES_TUPLES_OK);
+
+   PQclear(res);
+   destroyPQExpBuffer(query);
+}
+
 /*
  * getSubscriptions
  *   get information about subscriptions

diff --git a/src/include/tcop/tcopprot.h b/src/include/tcop/tcopprot.h
index bd30607b070f485af95456efefdb13b1a302d80f..2c2fb59ab8e130e08f07aa8cc93f7e959d3c2f52 100644 (file)
--- a/src/include/tcop/tcopprot.h
+++ b/src/include/tcop/tcopprot.h
@@ -42,6 +42,12 @@ typedef enum
 
 extern PGDLLIMPORT int log_statement;
 
+/* Flags for restrict_nonsystem_relation_kind value */
+#define RESTRICT_RELKIND_VIEW          0x01
+#define RESTRICT_RELKIND_FOREIGN_TABLE 0x02
+
+extern PGDLLIMPORT int restrict_nonsystem_relation_kind;
+
 extern List *pg_parse_query(const char *query_string);
 extern List *pg_analyze_and_rewrite(RawStmt *parsetree,
                                    const char *query_string,
@@ -61,6 +67,9 @@ extern List *pg_plan_queries(List *querytrees, const char *query_string,
 
 extern bool check_max_stack_depth(int *newval, void **extra, GucSource source);
 extern void assign_max_stack_depth(int newval, void *extra);
+extern bool check_restrict_nonsystem_relation_kind(char **newval, void **extra,
+                                                  GucSource source);
+extern void assign_restrict_nonsystem_relation_kind(const char *newval, void *extra);
 
 extern void die(SIGNAL_ARGS);
 extern void quickdie(SIGNAL_ARGS) pg_attribute_noreturn();

diff --git a/src/test/regress/expected/create_view.out b/src/test/regress/expected/create_view.out
index b3158afd6d4ae9677ff26073bb0344f568ad67bb..5b0f2ba1e54a0788aada719fe3703693bc049400 100644 (file)
--- a/src/test/regress/expected/create_view.out
+++ b/src/test/regress/expected/create_view.out
@@ -1921,6 +1921,21 @@ CREATE RULE "_RETURN" AS ON SELECT TO tt28 DO INSTEAD SELECT * FROM tt26;
 CREATE RULE "_RETURN" AS ON SELECT TO tt28 DO INSTEAD SELECT * FROM tt26;
 ERROR:  "tt28" is already a view
 ROLLBACK;
+-- test restriction on non-system view expansion.
+create table tt27v_tbl (a int);
+create view tt27v as select a from tt27v_tbl;
+set restrict_nonsystem_relation_kind to 'view';
+select a from tt27v where a > 0; -- Error
+ERROR:  access to non-system view "tt27v" is restricted
+insert into tt27v values (1); -- Error
+ERROR:  access to non-system view "tt27v" is restricted
+select viewname from pg_views where viewname = 'tt27v'; -- Ok to access a system view.
+ viewname 
+----------
+ tt27v
+(1 row)
+
+reset restrict_nonsystem_relation_kind;
 -- clean up all the random objects we made above
 DROP SCHEMA temp_view_test CASCADE;
 NOTICE:  drop cascades to 27 other objects
@@ -1952,7 +1967,7 @@ drop cascades to view aliased_view_2
 drop cascades to view aliased_view_3
 drop cascades to view aliased_view_4
 DROP SCHEMA testviewschm2 CASCADE;
-NOTICE:  drop cascades to 69 other objects
+NOTICE:  drop cascades to 71 other objects
 DETAIL:  drop cascades to table t1
 drop cascades to view temporal1
 drop cascades to view temporal2
@@ -2022,3 +2037,5 @@ drop cascades to view tt24v
 drop cascades to view tt25v
 drop cascades to view tt26v
 drop cascades to table tt26
+drop cascades to table tt27v_tbl
+drop cascades to view tt27v

diff --git a/src/test/regress/sql/create_view.sql b/src/test/regress/sql/create_view.sql
index ccbf2ec79c149039a849adb81ea42b36b740e390..7353aa9ed19848ee7aa9c44e03851a9a910df5fc 100644 (file)
--- a/src/test/regress/sql/create_view.sql
+++ b/src/test/regress/sql/create_view.sql
@@ -671,6 +671,14 @@ CREATE RULE "_RETURN" AS ON SELECT TO tt28 DO INSTEAD SELECT * FROM tt26;
 CREATE RULE "_RETURN" AS ON SELECT TO tt28 DO INSTEAD SELECT * FROM tt26;
 ROLLBACK;
 
+-- test restriction on non-system view expansion.
+create table tt27v_tbl (a int);
+create view tt27v as select a from tt27v_tbl;
+set restrict_nonsystem_relation_kind to 'view';
+select a from tt27v where a > 0; -- Error
+insert into tt27v values (1); -- Error
+select viewname from pg_views where viewname = 'tt27v'; -- Ok to access a system view.
+reset restrict_nonsystem_relation_kind;
 
 -- clean up all the random objects we made above
 DROP SCHEMA temp_view_test CASCADE;