postgres.git / summary / log / commit / refs

commit    29dd6d8bc631eebc3e50493c115f7a215f03bd0a
Author:   Fujii Masao <fujii@postgresql.org>
Date:     Wed Aug 26 01:50:02 2020 +0000
First released in: 14.0

    Prevent non-superusers from reading pg_backend_memory_contexts, by default.
    
    pg_backend_memory_contexts view contains some internal information of
    memory contexts. Since exposing them to any users by default may cause
    security issue, this commit allows only superusers to read this view,
    by default, like we do for pg_shmem_allocations view.
    
    Bump catalog version.
    
    Author: Atsushi Torikoshi
    Reviewed-by: Michael Paquier, Fujii Masao
    Discussion: https://postgr.es/m/1414992.1597849297@sss.pgh.pa.us


 doc/src/sgml/catalogs.sgml           | 4 ++++
 src/backend/catalog/system_views.sql | 3 +++
 src/include/catalog/catversion.h     | 2 +-
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml
index 1232b24e74c..9fe260ecff7 100644
--- a/doc/src/sgml/catalogs.sgml
+++ b/doc/src/sgml/catalogs.sgml
@@ -9697,6 +9697,10 @@ SCRAM-SHA-256$<replaceable>&lt;iteration count&gt;</replaceable>:<replaceable>&l
    </tgroup>
   </table>
 
+  <para>
+   By default, the <structname>pg_backend_memory_contexts</structname> view can be
+   read only by superusers.
+  </para>
  </sect1>
 
  <sect1 id="view-pg-config">
diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql
index ba5a23ac252..a2d61302f9e 100644
--- a/src/backend/catalog/system_views.sql
+++ b/src/backend/catalog/system_views.sql
@@ -557,6 +557,9 @@ REVOKE EXECUTE ON FUNCTION pg_get_shmem_allocations() FROM PUBLIC;
 CREATE VIEW pg_backend_memory_contexts AS
     SELECT * FROM pg_get_backend_memory_contexts();
 
+REVOKE ALL ON pg_backend_memory_contexts FROM PUBLIC;
+REVOKE EXECUTE ON FUNCTION pg_get_backend_memory_contexts() FROM PUBLIC;
+
 -- Statistics views
 
 CREATE VIEW pg_stat_all_tables AS
diff --git a/src/include/catalog/catversion.h b/src/include/catalog/catversion.h
index 3e677976300..573f1841b73 100644
--- a/src/include/catalog/catversion.h
+++ b/src/include/catalog/catversion.h
@@ -53,6 +53,6 @@
  */
 
 /*							yyyymmddN */
-#define CATALOG_VERSION_NO	202008191
+#define CATALOG_VERSION_NO	202008261
 
 #endif


[parent: c34605daed56]