Parameter · Client Connection Defaults / Statement Behavior
restrict_nonsystem_relation_kind
Prohibits access to non-system relations of specified kinds.
- Default:
'' (empty) - Type: string
- Applies: Session (any user)
In plain words
A safety switch: when set, any query that touches a non-system view or foreign table is refused. Tools like pg_dump use it so that dumping a database can never run code hidden in a view or reach out through a foreign table.
For DBAs and operators
Value: a comma-separated list of view and/or foreign-table; empty (default) allows everything. System catalogs and system views are always allowed.
It was added as part of the fix for CVE-2024-7348 (released in August 2024 for all supported branches, and included in PostgreSQL 17.0): pg_dump sets it so that an attacker who can create objects cannot make pg_dump execute arbitrary SQL by swapping a table for a view during the dump. pg_dump sends SET restrict_nonsystem_relation_kind = … at the start of its session (visible in the server log with log_statement = all).
Errors:
ERROR: access to non-system view "my_view" is restricted
ERROR: access to non-system foreign table is restricted
Can also be used to harden maintenance scripts that should only touch plain tables.
How to change it
Any user can change it for their session with SET.