pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #17157: authorizaiton of dict_int and bloom extention
6+ messages / 5 participants
[nested] [flat]
* BUG #17157: authorizaiton of dict_int and bloom extention
@ 2021-08-24 06:59 PG Bug reporting form <noreply@postgresql.org>
2021-08-24 08:35 ` Re: BUG #17157: authorizaiton of dict_int and bloom extention Neil Chen <carpenter.nail.cz@gmail.com>
2021-08-25 03:48 ` RE: BUG #17157: authorizaiton of dict_int and bloom extention Li EF Zhang <bjzhangl@cn.ibm.com>
0 siblings, 2 replies; 6+ messages in thread
From: PG Bug reporting form @ 2021-08-24 06:59 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: bjzhangl@cn.ibm.com
The following bug has been logged on the website:
Bug reference: 17157
Logged by: Lily Zhang
Email address: bjzhangl@cn.ibm.com
PostgreSQL version: 13.3
Operating system: os390x
Description:
1. Since dict_int is trusted, we create extension of dict_int with normal
user. But when alter maxlen of intdict, it reports error. This is the
detail.
```
admin=> create extension dict_int;
CREATE EXTENSION
admin=> ALTER TEXT SEARCH DICTIONARY intdict (MAXLEN = 7);
ERROR: must be owner of text search dictionary intdict
```
2. Since pg13 supports trusted extension, we make bloom trusted by changing
control file. Everything runs well except drop extension with normal user
who creates this extension.
```
test=> create extension bloom;
CREATE EXTENSION
test=> drop extension bloom;
ERROR: must be superuser to drop access methods
```
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: BUG #17157: authorizaiton of dict_int and bloom extention
2021-08-24 06:59 BUG #17157: authorizaiton of dict_int and bloom extention PG Bug reporting form <noreply@postgresql.org>
@ 2021-08-24 08:35 ` Neil Chen <carpenter.nail.cz@gmail.com>
1 sibling, 0 replies; 6+ messages in thread
From: Neil Chen @ 2021-08-24 08:35 UTC (permalink / raw)
To: bjzhangl@cn.ibm.com; pgsql-bugs@lists.postgresql.org
On Tue, Aug 24, 2021 at 4:19 PM PG Bug reporting form <
noreply@postgresql.org> wrote:
> The following bug has been logged on the website:
>
> Bug reference: 17157
> Logged by: Lily Zhang
> Email address: bjzhangl@cn.ibm.com
> PostgreSQL version: 13.3
> Operating system: os390x
> Description:
>
> 1. Since dict_int is trusted, we create extension of dict_int with normal
> user. But when alter maxlen of intdict, it reports error. This is the
> detail.
> ```
> admin=> create extension dict_int;
> CREATE EXTENSION
> admin=> ALTER TEXT SEARCH DICTIONARY intdict (MAXLEN = 7);
> ERROR: must be owner of text search dictionary intdict
> ```
> 2. Since pg13 supports trusted extension, we make bloom trusted by changing
> control file. Everything runs well except drop extension with normal user
> who creates this extension.
> ```
> test=> create extension bloom;
> CREATE EXTENSION
> test=> drop extension bloom;
> ERROR: must be superuser to drop access methods
> ```
>
>
Hi, here are some of my understanding, hope it can help you:
For (1), if we set an extension "trust", the database will execute the
"create" action as a superuser, so the owner of the created object is the
superuser. I think this is a "feature", not a "bug".
For (2), it was already been fixed in commit:
b1d32d3e3230f00b5baba08f75b4f665c7d6dac6.
--
There is no royal road to learning.
HighGo Software Co.
^ permalink raw reply [nested|flat] 6+ messages in thread
* RE: BUG #17157: authorizaiton of dict_int and bloom extention
2021-08-24 06:59 BUG #17157: authorizaiton of dict_int and bloom extention PG Bug reporting form <noreply@postgresql.org>
@ 2021-08-25 03:48 ` Li EF Zhang <bjzhangl@cn.ibm.com>
2021-08-25 09:11 ` Re: BUG #17157: authorizaiton of dict_int and bloom extention Neil Chen <carpenter.nail.cz@gmail.com>
2021-08-26 07:21 ` Re: BUG #17157: authorizaiton of dict_int and bloom extention Masahiko Sawada <sawada.mshk@gmail.com>
1 sibling, 2 replies; 6+ messages in thread
From: Li EF Zhang @ 2021-08-25 03:48 UTC (permalink / raw)
To: carpenter.nail.cz@gmail.com; +Cc: pgsql-bugs@lists.postgresql.org
<div class="socmaildefaultfont" dir="ltr" style="font-family:Arial, Helvetica, sans-serif;font-size:10pt" ><div dir="ltr" >Got it! Thanks!</div>
<div dir="ltr" >My question:</div>
<div dir="ltr" >1. If an ordinary user create the extension, my understanding is that the object created in the extension should be the user who create the extension?</div>
<div dir="ltr" >2. Will the fix for bloom be applied on pg13?</div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<div dir="ltr" > </div>
<blockquote data-history-content-modified="1" dir="ltr" style="border-left:solid #aaaaaa 2px; margin-left:5px; padding-left:5px; direction:ltr; margin-right:0px" >----- Original message -----<br>From: "Neil Chen" <carpenter.nail.cz@gmail.com><br>To: bjzhangl@cn.ibm.com, pgsql-bugs@lists.postgresql.org<br>Cc:<br>Subject: [EXTERNAL] Re: BUG #17157: authorizaiton of dict_int and bloom extention<br>Date: Tue, Aug 24, 2021 4:38 PM<br> <br>
<div dir="ltr" ><div dir="ltr" > </div>
<div><div dir="ltr" >On Tue, Aug 24, 2021 at 4:19 PM PG Bug reporting form <<a href="mailto:noreply@postgresql.org" target="_blank" >noreply@postgresql.org</a>> wrote:</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" >The following bug has been logged on the website:<br><br>Bug reference: 17157<br>Logged by: Lily Zhang<br>Email address: <a href="mailto:bjzhangl@cn.ibm.com" target="_blank" >bjzhangl@cn.ibm.com</a><br>PostgreSQL version: 13.3<br>Operating system: os390x<br>Description: <br><br>1. Since dict_int is trusted, we create extension of dict_int with normal<br>user. But when alter maxlen of intdict, it reports error. This is the<br>detail.<br>```<br>admin=> create extension dict_int;<br>CREATE EXTENSION<br>admin=> ALTER TEXT SEARCH DICTIONARY intdict (MAXLEN = 7);<br>ERROR: must be owner of text search dictionary intdict<br>```<br>2. Since pg13 supports trusted extension, we make bloom trusted by changing<br>control file. Everything runs well except drop extension with normal user<br>who creates this extension.<br>```<br>test=> create extension bloom;<br>CREATE EXTENSION<br>test=> drop extension bloom;<br>ERROR: must be superuser to drop access methods<br>```<br> </blockquote></div>
<div> </div>Hi, here are some of my understanding, hope it can help you:
<div> </div>
<div>For (1), if we set an extension "trust", the database will execute the "create" action as a superuser, so the owner of the created object is the superuser. I think this is a "feature", not a "bug".
<div> </div>
<div>For (2), it was already been fixed in commit: <span style="color:rgb(36,41,46);font-family:ui-monospace,SFMono-Regular,"SF Mono",Menlo,Consolas,"Liberation Mono",monospace;font-size:12px;text-align:right;white-space:nowrap" >b1d32d3e3230f00b5baba08f75b4f665c7d6dac6.</span>
<div> </div>--
<div dir="ltr" ><div dir="ltr" >There is no royal road to learning.
<div>HighGo Software Co.</div></div></div></div></div></div></blockquote>
<div dir="ltr" > </div></div><BR>
<BR>
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: BUG #17157: authorizaiton of dict_int and bloom extention
2021-08-24 06:59 BUG #17157: authorizaiton of dict_int and bloom extention PG Bug reporting form <noreply@postgresql.org>
2021-08-25 03:48 ` RE: BUG #17157: authorizaiton of dict_int and bloom extention Li EF Zhang <bjzhangl@cn.ibm.com>
@ 2021-08-25 09:11 ` Neil Chen <carpenter.nail.cz@gmail.com>
1 sibling, 0 replies; 6+ messages in thread
From: Neil Chen @ 2021-08-25 09:11 UTC (permalink / raw)
To: Li EF Zhang <bjzhangl@cn.ibm.com>; +Cc: pgsql-bugs@lists.postgresql.org
Hi, IMHO, these problems are not data errors or crashes, but rules that are
inconsistent with expectations. As for what is the "correct" expectation, I
think we need more opinions from other hackers.
On Wed, Aug 25, 2021 at 11:48 AM Li EF Zhang <bjzhangl@cn.ibm.com> wrote:
> Got it! Thanks!
> My question:
> 1. If an ordinary user create the extension, my understanding is that the
> object created in the extension should be the user who create the extension?
> 2. Will the fix for bloom be applied on pg13?
>
>
--
There is no royal road to learning.
HighGo Software Co.
^ permalink raw reply [nested|flat] 6+ messages in thread
* Re: BUG #17157: authorizaiton of dict_int and bloom extention
2021-08-24 06:59 BUG #17157: authorizaiton of dict_int and bloom extention PG Bug reporting form <noreply@postgresql.org>
2021-08-25 03:48 ` RE: BUG #17157: authorizaiton of dict_int and bloom extention Li EF Zhang <bjzhangl@cn.ibm.com>
@ 2021-08-26 07:21 ` Masahiko Sawada <sawada.mshk@gmail.com>
2021-08-26 14:04 ` Re: BUG #17157: authorizaiton of dict_int and bloom extention David G. Johnston <david.g.johnston@gmail.com>
1 sibling, 1 reply; 6+ messages in thread
From: Masahiko Sawada @ 2021-08-26 07:21 UTC (permalink / raw)
To: Li EF Zhang <bjzhangl@cn.ibm.com>; +Cc: carpenter.nail.cz@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
w
On Wed, Aug 25, 2021 at 12:48 PM Li EF Zhang <bjzhangl@cn.ibm.com> wrote:
>
> Got it! Thanks!
> My question:
> 1. If an ordinary user create the extension, my understanding is that the object created in the extension should be the user who create the extension?
The doc says:
If the extension is marked trusted in its control file, then it can be
installed by any user who has CREATE privilege on the current
database. In this case the extension object itself will be owned by
the calling user, but the contained objects will be owned by the
bootstrap superuser (unless the extension's script explicitly assigns
them to the calling user).
So in your case, the extension dict_int itself is owned by the user
who created it (i.g., executed CREATE EXTENSION) whereas the objects
of the extension such as intdict are owned by the superuser.
> 2. Will the fix for bloom be applied on pg13?
I think that the commit b1d32d3e3 won't be backpatched to PG13 but
this behavior seems like a bug to me. I would expect that "DROP
EXTENSION trusted-bloom" by non-superuser owner succeeds if it’s a
trusted extension. (“trusted-bloom” here means “bloom” extension you
made trusted by changing the control file)
Looking at the commit b1d32d3e3, the fact that that "DROP EXTENSION
trusted-bloom” by non-superuser can drop the access method belonging
to the extension seems like a side effect of this commit.
Previously, since we did the superuser check in
RemoveAccessMethodById() that drops an access method object from the
catalog, even if a non-superuser reaches this function (e.g., when
dropping a trusted extension), it ended up an error. By this commit,
we removed this function along with the superuser check and used
DropObjectById() instead for unifying similar purpose functions.
Therefore, "DROP EXTENSION trusted-bloom” by non-superuser succeeds.
I’m not sure whether the removal of superuser check by this commit is
intentional, but IIUC it’s okay the fact that we don’t do superuser
check at DropObjectById() or RemoveAccessMethodById(). We do the
superuser check at a higher layer (see RemoveObjects() and
check_object_ownership()). And an access method always is owned by
superuser even if it belongs to a trusted extension. The only path
where a non-super user attempts to drop an access method without the
superuser check is when dropping the trusted extension by
non-superuser owner, which is a legitimate operation.
If my understanding is correct, I wonder if we can remove the
superuser check from RemoveAccessMethodById() in PG13 (see the
attached patch), making “DROP EXTENSION trusted-bloom” by
non-superuser owner work.
On the other hand if not correct, that is, if there is another path
where non-superuser attempts to drop an access method by calling
DropObjectById() without the prior superuser check, I think we should
fix HEAD and PG14 by bringing RemoveAccessMethodById() back to the
code.
Regards,
--
Masahiko Sawada
EDB: https://www.enterprisedb.com/
Attachments:
remove_superuser_check_from_RemoveAccessMethodById.patch (application/octet-stream, 551B) download
diff --git a/src/backend/commands/amcmds.c b/src/backend/commands/amcmds.c
index b884bfa0b0..881ced411d 100644
--- a/src/backend/commands/amcmds.c
+++ b/src/backend/commands/amcmds.c
@@ -124,11 +124,6 @@ RemoveAccessMethodById(Oid amOid)
Relation relation;
HeapTuple tup;
- if (!superuser())
- ereport(ERROR,
- (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
- errmsg("must be superuser to drop access methods")));
-
relation = table_open(AccessMethodRelationId, RowExclusiveLock);
tup = SearchSysCache1(AMOID, ObjectIdGetDatum(amOid));
* Re: BUG #17157: authorizaiton of dict_int and bloom extention
2021-08-24 06:59 BUG #17157: authorizaiton of dict_int and bloom extention PG Bug reporting form <noreply@postgresql.org>
2021-08-25 03:48 ` RE: BUG #17157: authorizaiton of dict_int and bloom extention Li EF Zhang <bjzhangl@cn.ibm.com>
2021-08-26 07:21 ` Re: BUG #17157: authorizaiton of dict_int and bloom extention Masahiko Sawada <sawada.mshk@gmail.com>
@ 2021-08-26 14:04 ` David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 0 replies; 6+ messages in thread
From: David G. Johnston @ 2021-08-26 14:04 UTC (permalink / raw)
To: Masahiko Sawada <sawada.mshk@gmail.com>; +Cc: Li EF Zhang <bjzhangl@cn.ibm.com>; carpenter.nail.cz@gmail.com, PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Thu, Aug 26, 2021 at 12:22 AM Masahiko Sawada <sawada.mshk@gmail.com>
wrote:
>
> > 2. Will the fix for bloom be applied on pg13?
>
> I think that the commit b1d32d3e3 won't be backpatched to PG13 but
> this behavior seems like a bug to me. I would expect that "DROP
> EXTENSION trusted-bloom" by non-superuser owner succeeds if it’s a
> trusted extension. (“trusted-bloom” here means “bloom” extension you
> made trusted by changing the control file)
>
> Looking at the commit b1d32d3e3, the fact that that "DROP EXTENSION
> trusted-bloom” by non-superuser can drop the access method belonging
> to the extension seems like a side effect of this commit.
>
>
Yeah, I said much the same thing on the adjacent thread on this topic.
https://www.postgresql.org/message-id/CAKFQuwaEiW0QbDHS0qxmGRcqZQw6O_ieV-14CWY1QG2k0zaWBw%40mail.gma...
David J.
^ permalink raw reply [nested|flat] 6+ messages in thread
end of thread, other threads:[~2021-08-26 14:04 UTC | newest]
Thread overview: 6+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-08-24 06:59 BUG #17157: authorizaiton of dict_int and bloom extention PG Bug reporting form <noreply@postgresql.org>
2021-08-24 08:35 ` Neil Chen <carpenter.nail.cz@gmail.com>
2021-08-25 03:48 ` Li EF Zhang <bjzhangl@cn.ibm.com>
2021-08-25 09:11 ` Neil Chen <carpenter.nail.cz@gmail.com>
2021-08-26 07:21 ` Masahiko Sawada <sawada.mshk@gmail.com>
2021-08-26 14:04 ` David G. Johnston <david.g.johnston@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox