pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Wolfgang Walther <walther@technowledgy.de>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: User with BYPASSRLS privilege can't change password
Date: Tue, 3 Nov 2020 19:26:13 +0100
Message-ID: <be39bd26-4024-0bf5-eb28-31984a887265@technowledgy.de> (raw)
In-Reply-To: <958492.1604427541@sss.pgh.pa.us>
References: <a5548a9f-89ee-3167-129d-162b5985fcf8@technowledgy.de>
	<923005.1604420579@sss.pgh.pa.us>
	<956994.1604425451@sss.pgh.pa.us>
	<3e771893-1ed1-97e7-6c4a-7b0d00992103@technowledgy.de>
	<958492.1604427541@sss.pgh.pa.us>

Tom Lane:
> How do you figure that?  This is in an "else" path after
> 
> 	else if (authform->rolreplication || isreplication >= 0)
> 
> so AFAICS it's impossible to get there.  If it isn't impossible,
> we have a much bigger hole with respect to issuper.

Yes, you're right. I read the || as &&. And also missed the ! in else if 
(!have_createrole_privilege()) btw. :)

I guess the error message "must be superuser to alter replication users" 
led me on the wrong path. I would be more precise as "must be superuser 
to alter replication users or change replication attribute" to cover the 
change-non-replication-to-replication user case, I think. The same thing 
for superusers.

Best

Wolfgang





view thread (14+ messages)  latest in thread

Message-ID: <be39bd26-4024-0bf5-eb28-31984a887265@technowledgy.de>
Permalink:  ../be39bd26-4024-0bf5-eb28-31984a887265@technowledgy.de/
Also on:    postgresql.org/message-id/be39bd26-4024-0bf5-eb28-31984a887265@technowledgy.de

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: walther@technowledgy.de, tgl@sss.pgh.pa.us, sfrost@snowman.net, pgsql-bugs@lists.postgresql.org
  Subject: Re: User with BYPASSRLS privilege can't change password
  In-Reply-To: <be39bd26-4024-0bf5-eb28-31984a887265@technowledgy.de>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox