pg.ddx.io  pgsql-committers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jeff Davis <pgsql@j-davis.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Noah Misch <noah@leadboat.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: Nathan Bossart <nathandbossart@gmail.com>
Subject: Re: pgsql: Fix search_path to a safe value during maintenance operations.
Date: Thu, 29 Jun 2023 20:53:56 -0400
Message-ID: <1659699.1688086436@sss.pgh.pa.us> (raw)
In-Reply-To: <43bbc9f7318057f51552d5986830908cb018dadf.camel@j-davis.com>
References: <E1q7j7Y-000z1H-Hr@gemulon.postgresql.org>
	<89a415b86d5421941e4281ba5bf6288934078624.camel@j-davis.com>
	<d20864b929ff769a0ebf772359719f05bb6982cd.camel@j-davis.com>
	<573014.1686375211@sss.pgh.pa.us>
	<20230612170510.GA201972@gust.leadboat.com>
	<f53df2dbe11bb42764bcdd003a54aa29c9bb6137.camel@j-davis.com>
	<20230613182920.GA259321@gust.leadboat.com>
	<1799839.1686687804@sss.pgh.pa.us>
	<4df537f5a0d8c0ceac3eec3809d1144880b8e76d.camel@j-davis.com>
	<CA+TgmoYtJU0KknWr11W--wK=4eJtdHOgupyT=beZVPC8P=o+YA@mail.gmail.com>
	<578fb4be80247570e6a05924908765a0b345971e.camel@j-davis.com>
	<CA+TgmoZVCHERUkXhAMT2Er-sKBc5C6_iX+TpxxivBevDHzq2TQ@mail.gmail.com>
	<43bbc9f7318057f51552d5986830908cb018dadf.camel@j-davis.com>

Jeff Davis <pgsql@j-davis.com> writes:
> On Thu, 2023-06-29 at 11:19 -0400, Robert Haas wrote:
>> We shouldn't ship a new feature with a built-in
>> security hole like that.

> Let's take David's suggestion[1] then, and only restrict the search
> path for those without owner privileges on the object.

I think that's a seriously awful kluge.  It will mean that things behave
differently for the owner than for MAINTAIN grantees, which pretty much
destroys the use-case for that privilege, as well as being very confusing
and hard to debug.  Yes, *if* you're careful about search path cleanliness
then you can make it work, but that will be a foot-gun forevermore.

(I'm also less than convinced that this is sufficient to remove all
security hazards.  One pretty obvious question is do we really want
superusers to be treated as owners, rather than MAINTAIN grantees,
for this purpose.)

I'm leaning to Robert's thought that we need to revert this for now,
and think harder about how to make it work cleanly and safely.

			regards, tom lane





view thread (59+ messages)  latest in thread

Message-ID: <1659699.1688086436@sss.pgh.pa.us>
Permalink:  ../1659699.1688086436@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/1659699.1688086436@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-committers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, pgsql@j-davis.com, robertmhaas@gmail.com, noah@leadboat.com, pgsql-hackers@postgresql.org, nathandbossart@gmail.com
  Subject: Re: pgsql: Fix search_path to a safe value during maintenance operations.
  In-Reply-To: <1659699.1688086436@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox