pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications
4+ messages / 3 participants
[nested] [flat]
* BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications
@ 2024-09-06 16:28 PG Bug reporting form <noreply@postgresql.org>
2024-09-06 18:49 ` Re: BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications Tom Lane <tgl@sss.pgh.pa.us>
2024-09-06 19:07 ` Re: BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications Christophe Pettus <xof@thebuild.com>
2024-09-06 19:38 ` Re: BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications Christophe Pettus <xof@thebuild.com>
0 siblings, 3 replies; 4+ messages in thread
From: PG Bug reporting form @ 2024-09-06 16:28 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: basha@maxcontact.com
The following bug has been logged on the website:
Bug reference: 18604
Logged by: Aladin Basha
Email address: basha@maxcontact.com
PostgreSQL version: 16.4
Operating system: Ubuntu 22.04.4 LTS
Description:
In PostgreSQL 16.4, the recent security enhancement introduced by the commit
"Prevent unauthorized code execution during pg_dump (Masahiko Sawada)" has
introduced unintended side effects that severely impact multi-tenant
database environments. Specifically, this change blocks modifications to
system tables, even when allow_system_table_mods is explicitly enabled.
Our multi-tenant architecture relies on modifying system tables to ensure
database isolation for each customer. Each customer is assigned a dedicated
database, and by modifying system tables, we restrict their visibility of
other databases. This is a critical component of our security model, where
each customer only sees their own database within tools like pgAdmin, which
query the pg_database table.
However, after the PostgreSQL 16.4 update, pg_dump now fails due to these
system table modifications, leaving us in a precarious position where
essential backups cannot be performed. This restriction appears to apply
globally, without any option to bypass or disable it, even when the system
table modification flag is set.
Expected Behavior:
The security feature should allow system table modifications when
allow_system_table_mods is enabled.
The restriction on pg_dump should be optional or configurable, particularly
for environments where system table modifications are an intentional and
controlled part of the setup.
Actual Behavior:
pg_dump refuses to work when system table modifications are in place, even
when allow_system_table_mods is enabled.
Impact:
Our multi-tenant environment, which relies heavily on system table
modifications for tenant isolation, is unable to use pg_dump to perform
backups, thus compromising data safety.
This issue severely disrupts the workflow of environments where customer
isolation through system table modification is critical, leaving us with no
viable alternative for backups or data visibility management.
We believe that the new security feature should allow for more flexibility,
especially in controlled environments where allow_system_table_mods is
explicitly enabled. It should either provide an option to override this
restriction in pg_dump, or respect the configuration settings that allow
system table modifications.
PostgreSQL Version: PostgreSQL 16.4
Steps to Reproduce:
Enable allow_system_table_mods = true.
Modify system tables (e.g., pg_database) to restrict visibility in a
multi-tenant setup.
Attempt to run pg_dump for backup purposes.
pg_dump fails due to the recent security restriction.
Suggested Resolution:
Introduce a configurable option in pg_dump to allow it to work with modified
system tables when allow_system_table_mods is enabled.
Adjust the security enhancement to respect environments where system table
modifications are a necessary feature, or provide a safe, configurable
bypass for such use cases.
Thank you for your attention to this matter. We look forward to a resolution
that ensures both security and flexibility for diverse PostgreSQL use cases.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications
2024-09-06 16:28 BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications PG Bug reporting form <noreply@postgresql.org>
@ 2024-09-06 18:49 ` Tom Lane <tgl@sss.pgh.pa.us>
2 siblings, 0 replies; 4+ messages in thread
From: Tom Lane @ 2024-09-06 18:49 UTC (permalink / raw)
To: basha@maxcontact.com; +Cc: pgsql-bugs@lists.postgresql.org
PG Bug reporting form <noreply@postgresql.org> writes:
> Steps to Reproduce:
> Enable allow_system_table_mods = true.
> Modify system tables (e.g., pg_database) to restrict visibility in a
> multi-tenant setup.
> Attempt to run pg_dump for backup purposes.
> pg_dump fails due to the recent security restriction.
Without any details about what you did to the system catalogs,
this complaint is quite un-actionable.
I will note that we do not consider random manual changes to
system catalogs to be a supported feature.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications
2024-09-06 16:28 BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications PG Bug reporting form <noreply@postgresql.org>
@ 2024-09-06 19:07 ` Christophe Pettus <xof@thebuild.com>
2 siblings, 0 replies; 4+ messages in thread
From: Christophe Pettus @ 2024-09-06 19:07 UTC (permalink / raw)
To: basha@maxcontact.com; +Cc: PostgreSQL Bug List <pgsql-bugs@lists.postgresql.org>
> On Sep 6, 2024, at 09:28, PG Bug reporting form <noreply@postgresql.org> wrote:
> However, after the PostgreSQL 16.4 update, pg_dump now fails due to these
> system table modifications, leaving us in a precarious position where
> essential backups cannot be performed.
It should be noted that this change does not prevent PITR backups, so it is still entirely possible to back up your installation.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications
2024-09-06 16:28 BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications PG Bug reporting form <noreply@postgresql.org>
@ 2024-09-06 19:38 ` Christophe Pettus <xof@thebuild.com>
2 siblings, 0 replies; 4+ messages in thread
From: Christophe Pettus @ 2024-09-06 19:38 UTC (permalink / raw)
To: basha@maxcontact.com; +Cc: PostgreSQL Bug List <pgsql-bugs@lists.postgresql.org>
> On Sep 6, 2024, at 09:28, PG Bug reporting form <noreply@postgresql.org> wrote:
> In PostgreSQL 16.4, the recent security enhancement introduced by the commit
> "Prevent unauthorized code execution during pg_dump (Masahiko Sawada)" has
> introduced unintended side effects that severely impact multi-tenant
> database environments. Specifically, this change blocks modifications to
> system tables, even when allow_system_table_mods is explicitly enabled.
As Tom noted, you should describe what system catalog modifications you are making.
It should be noted that this admonition appears as the first sentence in the documentation on the page that includes `allow_system_table_mods`:
The following parameters are intended for developer testing, and should never be used on a production database.
"We adjusted a developer-only parameter on a production database, having been warned by the documentation not to, and now something that previously worked no longer does" is not really going to be considered a bug. It's better that a way is found to support your requirements without modifying system catalogs.
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2024-09-06 19:38 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2024-09-06 16:28 BUG #18604: Regression in PostgreSQL 16.4: pg_dump Prevents Essential System Table Modifications PG Bug reporting form <noreply@postgresql.org>
2024-09-06 18:49 ` Tom Lane <tgl@sss.pgh.pa.us>
2024-09-06 19:07 ` Christophe Pettus <xof@thebuild.com>
2024-09-06 19:38 ` Christophe Pettus <xof@thebuild.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox