postgres.git / summary / log / commit / refs

commit    73c9f91a1b6d3753451993c5f06ba4b5ccc1f127
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Mon Nov 11 22:05:53 2024 +0000
First released in: master (reverted before release), 12.21, 13.17, 14.14, 15.9, 16.5, 17.1
Reverted by: 70d067ceccf0 (in 13.19), c58b0c43d36f (in 14.16), 3d1ecc92a0d1 (in 15.11), 41a252c2ca68 (in 16.7), 15b4c46c328b (in 17.3), 34486b6092e7 (in 18.0)

    Parallel workers use AuthenticatedUserId for connection privilege checks.
    
    Commit 5a2fed911 had an unexpected side-effect: the parallel worker
    launched for the new test case would fail if it couldn't use a
    superuser-reserved connection slot.  The reason that test failed
    while all our pre-existing ones worked is that the connection
    privilege tests in InitPostgres had been based on the superuserness
    of the leader's AuthenticatedUserId, but after the rearrangements
    of 5a2fed911 we were testing the superuserness of CurrentUserId,
    which the new test case deliberately made to be a non-superuser.
    
    This all seems very accidental and probably not the behavior we really
    want, but a security patch is no time to be redesigning things.
    Pending some discussion about desirable semantics, hack it so that
    InitPostgres continues to pay attention to the superuserness of
    AuthenticatedUserId when starting a parallel worker.
    
    Nathan Bossart and Tom Lane, per buildfarm member sawshark.
    
    Security: CVE-2024-10978


 src/backend/utils/init/postinit.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index a024b1151d0..5b657a3f135 100644
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -22,6 +22,7 @@
 #include "access/genam.h"
 #include "access/heapam.h"
 #include "access/htup_details.h"
+#include "access/parallel.h"
 #include "access/session.h"
 #include "access/tableam.h"
 #include "access/xact.h"
@@ -875,7 +876,23 @@ InitPostgres(const char *in_dbname, Oid dboid,
 		{
 			InitializeSessionUserId(username, useroid,
 									(flags & INIT_PG_OVERRIDE_ROLE_LOGIN) != 0);
-			am_superuser = superuser();
+
+			/*
+			 * In a parallel worker, set am_superuser based on the
+			 * authenticated user ID, not the current role.  This is pretty
+			 * dubious but it matches our historical behavior.  Note that this
+			 * value of am_superuser is used only for connection-privilege
+			 * checks here and in CheckMyDatabase (we won't reach
+			 * process_startup_options in a background worker).
+			 *
+			 * In other cases, there's been no opportunity for the current
+			 * role to diverge from the authenticated user ID yet, so we can
+			 * just rely on superuser() and avoid an extra catalog lookup.
+			 */
+			if (InitializingParallelWorker)
+				am_superuser = superuser_arg(GetAuthenticatedUserId());
+			else
+				am_superuser = superuser();
 		}
 	}
 	else


[parent: c4252c9ef0af]