pg.ddx.io pgsql-committers@postgresql.org mailing list archive
help / color / mirror / Atom feedpgsql: Restrict accesses to non-system views and foreign tables during
14+ messages / 4 participants
[nested] [flat]
Commits from this thread:
2024-08-30 6f2525c775 187d8bb1a3 44ad6523ed 886549fb10 f3a3311110 0776724050 d7613ea72f Clarify restrict_nonsystem_relation_kind description.
* pgsql: Restrict accesses to non-system views and foreign tables during
@ 2024-08-05 13:07 Masahiko Sawada <msawada@postgresql.org>
0 siblings, 0 replies; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-05 13:07 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Restrict accesses to non-system views and foreign tables during pg_dump.
When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.
This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.
To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.
Back-patch to all supported branches.
Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12
Branch
------
REL_12_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/79c7a7e29695a32fef2e65682be224b8d61ec972
Modified Files
--------------
contrib/postgres_fdw/expected/postgres_fdw.out | 9 ++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 7 +++
doc/src/sgml/config.sgml | 17 +++++++
src/backend/foreign/foreign.c | 10 ++++
src/backend/optimizer/plan/createplan.c | 13 ++++++
src/backend/optimizer/util/plancat.c | 12 +++++
src/backend/rewrite/rewriteHandler.c | 17 +++++++
src/backend/tcop/postgres.c | 63 ++++++++++++++++++++++++++
src/backend/utils/misc/guc.c | 12 +++++
src/bin/pg_dump/pg_dump.c | 47 +++++++++++++++++++
src/include/tcop/tcopprot.h | 9 ++++
src/test/regress/expected/create_view.out | 19 +++++++-
src/test/regress/sql/create_view.sql | 8 ++++
13 files changed, 242 insertions(+), 1 deletion(-)
^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: Restrict accesses to non-system views and foreign tables during
@ 2024-08-05 13:07 Masahiko Sawada <msawada@postgresql.org>
0 siblings, 0 replies; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-05 13:07 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Restrict accesses to non-system views and foreign tables during pg_dump.
When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.
This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.
To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.
Back-patch to all supported branches.
Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12
Branch
------
REL_13_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/bbc94abf66407ebfe14d186812674896f85375d9
Modified Files
--------------
contrib/postgres_fdw/expected/postgres_fdw.out | 9 ++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 7 +++
doc/src/sgml/config.sgml | 17 +++++++
doc/src/sgml/ref/pg_dump.sgml | 8 ++++
src/backend/foreign/foreign.c | 10 ++++
src/backend/optimizer/plan/createplan.c | 13 ++++++
src/backend/optimizer/util/plancat.c | 12 +++++
src/backend/rewrite/rewriteHandler.c | 17 +++++++
src/backend/tcop/postgres.c | 63 ++++++++++++++++++++++++++
src/backend/utils/misc/guc.c | 12 +++++
src/bin/pg_dump/pg_dump.c | 47 +++++++++++++++++++
src/include/tcop/tcopprot.h | 9 ++++
src/test/regress/expected/create_view.out | 19 +++++++-
src/test/regress/sql/create_view.sql | 8 ++++
14 files changed, 250 insertions(+), 1 deletion(-)
^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: Restrict accesses to non-system views and foreign tables during
@ 2024-08-05 13:07 Masahiko Sawada <msawada@postgresql.org>
0 siblings, 0 replies; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-05 13:07 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Restrict accesses to non-system views and foreign tables during pg_dump.
When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.
This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.
To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.
Back-patch to all supported branches.
Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12
Branch
------
REL_14_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/72ef1675e2bc502b31854b1c31ccf22fde7cde47
Modified Files
--------------
contrib/postgres_fdw/expected/postgres_fdw.out | 11 +++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 8 ++++
doc/src/sgml/config.sgml | 17 +++++++
doc/src/sgml/ref/pg_dump.sgml | 8 ++++
src/backend/foreign/foreign.c | 10 ++++
src/backend/optimizer/plan/createplan.c | 13 ++++++
src/backend/optimizer/util/plancat.c | 12 +++++
src/backend/rewrite/rewriteHandler.c | 17 +++++++
src/backend/tcop/postgres.c | 64 ++++++++++++++++++++++++++
src/backend/utils/misc/guc.c | 12 +++++
src/bin/pg_dump/pg_dump.c | 47 +++++++++++++++++++
src/include/tcop/tcopprot.h | 9 ++++
src/test/regress/expected/create_view.out | 19 +++++++-
src/test/regress/sql/create_view.sql | 8 ++++
14 files changed, 254 insertions(+), 1 deletion(-)
^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: Restrict accesses to non-system views and foreign tables during
@ 2024-08-05 13:07 Masahiko Sawada <msawada@postgresql.org>
0 siblings, 0 replies; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-05 13:07 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Restrict accesses to non-system views and foreign tables during pg_dump.
When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.
This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.
To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.
Back-patch to all supported branches.
Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12
Branch
------
REL_15_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/e81e53a0c1faf2b8f5fe8822d7218c91aeebea52
Modified Files
--------------
contrib/postgres_fdw/expected/postgres_fdw.out | 11 +++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 8 ++++
doc/src/sgml/config.sgml | 17 +++++++
doc/src/sgml/ref/pg_dump.sgml | 8 ++++
src/backend/foreign/foreign.c | 10 ++++
src/backend/optimizer/plan/createplan.c | 13 ++++++
src/backend/optimizer/util/plancat.c | 12 +++++
src/backend/rewrite/rewriteHandler.c | 17 +++++++
src/backend/tcop/postgres.c | 64 ++++++++++++++++++++++++++
src/backend/utils/misc/guc.c | 12 +++++
src/bin/pg_dump/pg_dump.c | 47 +++++++++++++++++++
src/include/tcop/tcopprot.h | 9 ++++
src/test/regress/expected/create_view.out | 19 +++++++-
src/test/regress/sql/create_view.sql | 8 ++++
14 files changed, 254 insertions(+), 1 deletion(-)
^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: Restrict accesses to non-system views and foreign tables during
@ 2024-08-05 13:07 Masahiko Sawada <msawada@postgresql.org>
0 siblings, 0 replies; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-05 13:07 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Restrict accesses to non-system views and foreign tables during pg_dump.
When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.
This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.
To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.
Back-patch to all supported branches.
Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12
Branch
------
REL_16_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/6aba85a4b0a0e60126cc7c598b3e010e272516ec
Modified Files
--------------
contrib/postgres_fdw/expected/postgres_fdw.out | 11 +++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 8 ++++
doc/src/sgml/config.sgml | 17 +++++++
doc/src/sgml/ref/pg_dump.sgml | 8 ++++
src/backend/foreign/foreign.c | 10 ++++
src/backend/optimizer/plan/createplan.c | 13 ++++++
src/backend/optimizer/util/plancat.c | 12 +++++
src/backend/rewrite/rewriteHandler.c | 17 +++++++
src/backend/tcop/postgres.c | 64 ++++++++++++++++++++++++++
src/backend/utils/misc/guc_tables.c | 12 +++++
src/bin/pg_dump/pg_dump.c | 47 +++++++++++++++++++
src/include/tcop/tcopprot.h | 6 +++
src/include/utils/guc_hooks.h | 3 ++
src/test/regress/expected/create_view.out | 19 +++++++-
src/test/regress/sql/create_view.sql | 9 ++++
15 files changed, 255 insertions(+), 1 deletion(-)
^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: Restrict accesses to non-system views and foreign tables during
@ 2024-08-05 13:07 Masahiko Sawada <msawada@postgresql.org>
0 siblings, 0 replies; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-05 13:07 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Restrict accesses to non-system views and foreign tables during pg_dump.
When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.
This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.
To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.
Back-patch to all supported branches.
Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12
Branch
------
REL_17_STABLE
Details
-------
https://git.postgresql.org/pg/commitdiff/fdf218f1d52b2c93145f16b28b8374703ae4ef19
Modified Files
--------------
contrib/postgres_fdw/expected/postgres_fdw.out | 11 +++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 8 ++++
doc/src/sgml/config.sgml | 17 +++++++
doc/src/sgml/ref/pg_dump.sgml | 8 ++++
src/backend/foreign/foreign.c | 10 ++++
src/backend/optimizer/plan/createplan.c | 13 ++++++
src/backend/optimizer/util/plancat.c | 12 +++++
src/backend/rewrite/rewriteHandler.c | 17 +++++++
src/backend/tcop/postgres.c | 64 ++++++++++++++++++++++++++
src/backend/utils/misc/guc_tables.c | 12 +++++
src/bin/pg_dump/pg_dump.c | 47 +++++++++++++++++++
src/include/tcop/tcopprot.h | 6 +++
src/include/utils/guc_hooks.h | 3 ++
src/test/regress/expected/create_view.out | 19 +++++++-
src/test/regress/sql/create_view.sql | 9 ++++
15 files changed, 255 insertions(+), 1 deletion(-)
^ permalink raw reply [nested|flat] 14+ messages in thread
* pgsql: Restrict accesses to non-system views and foreign tables during
@ 2024-08-05 13:07 Masahiko Sawada <msawada@postgresql.org>
2024-08-26 14:14 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
0 siblings, 1 reply; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-05 13:07 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Restrict accesses to non-system views and foreign tables during pg_dump.
When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.
This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.
To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.
Back-patch to all supported branches.
Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/66e94448abec3aad04faf0a79cab4881ae08e08a
Modified Files
--------------
contrib/postgres_fdw/expected/postgres_fdw.out | 11 +++++
contrib/postgres_fdw/sql/postgres_fdw.sql | 8 ++++
doc/src/sgml/config.sgml | 17 +++++++
doc/src/sgml/ref/pg_dump.sgml | 8 ++++
src/backend/foreign/foreign.c | 10 ++++
src/backend/optimizer/plan/createplan.c | 13 ++++++
src/backend/optimizer/util/plancat.c | 12 +++++
src/backend/rewrite/rewriteHandler.c | 17 +++++++
src/backend/tcop/postgres.c | 64 ++++++++++++++++++++++++++
src/backend/utils/misc/guc_tables.c | 12 +++++
src/bin/pg_dump/pg_dump.c | 47 +++++++++++++++++++
src/include/tcop/tcopprot.h | 6 +++
src/include/utils/guc_hooks.h | 3 ++
src/test/regress/expected/create_view.out | 19 +++++++-
src/test/regress/sql/create_view.sql | 9 ++++
15 files changed, 255 insertions(+), 1 deletion(-)
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: pgsql: Restrict accesses to non-system views and foreign tables during
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
@ 2024-08-26 14:14 ` Peter Eisentraut <peter@eisentraut.org>
2024-08-26 19:05 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
0 siblings, 1 reply; 14+ messages in thread
From: Peter Eisentraut @ 2024-08-26 14:14 UTC (permalink / raw)
To: Masahiko Sawada <msawada@postgresql.org>; pgsql-committers@lists.postgresql.org
On 05.08.24 15:07, Masahiko Sawada wrote:
> To address this, pg_dump now utilizes the newly introduced
> restrict_nonsystem_relation_kind GUC parameter to restrict the
> accesses to non-system views and foreign tables during the dump
> process. This new GUC parameter is added to back branches too, but
> these changes do not require cluster recreation.
This documentation of this new parameter is a bit hard to understand.
The description in guc_tables.c is
"Sets relation kinds of non-system relation to restrict use"
which is hard to understand even knowing what this setting is supposed
to do.
In config.sgml it says
+ This variable specifies relation kind to which access is restricted.
+ It contains a comma-separated list of relation kind. Currently, the
+ supported relation kinds are <literal>view</literal> and
+ <literal>foreign-table</literal>.
This does not mention "system" or "non-system" at all.
Also, the phrase "to which access is restricted" can be interpreted in
two opposite ways:
- access to those relations is prohibited
- access is limited to those relations
Also nothing anywhere clarifies what "restricted" means here, and the
term introduces unnecessary ambiguity.
Can we come up with some more precise and easier-to-understand language?
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: pgsql: Restrict accesses to non-system views and foreign tables during
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-26 14:14 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
@ 2024-08-26 19:05 ` Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-27 12:41 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
0 siblings, 1 reply; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-26 19:05 UTC (permalink / raw)
To: Peter Eisentraut <peter@eisentraut.org>; +Cc: Masahiko Sawada <msawada@postgresql.org>; pgsql-committers@lists.postgresql.org
On Mon, Aug 26, 2024 at 7:14 AM Peter Eisentraut <peter@eisentraut.org> wrote:
>
> On 05.08.24 15:07, Masahiko Sawada wrote:
> > To address this, pg_dump now utilizes the newly introduced
> > restrict_nonsystem_relation_kind GUC parameter to restrict the
> > accesses to non-system views and foreign tables during the dump
> > process. This new GUC parameter is added to back branches too, but
> > these changes do not require cluster recreation.
>
> This documentation of this new parameter is a bit hard to understand.
> The description in guc_tables.c is
>
> "Sets relation kinds of non-system relation to restrict use"
>
> which is hard to understand even knowing what this setting is supposed
> to do.
>
> In config.sgml it says
>
> + This variable specifies relation kind to which access is restricted.
> + It contains a comma-separated list of relation kind. Currently, the
> + supported relation kinds are <literal>view</literal> and
> + <literal>foreign-table</literal>.
>
> This does not mention "system" or "non-system" at all.
>
> Also, the phrase "to which access is restricted" can be interpreted in
> two opposite ways:
>
> - access to those relations is prohibited
> - access is limited to those relations
>
> Also nothing anywhere clarifies what "restricted" means here, and the
> term introduces unnecessary ambiguity.
>
> Can we come up with some more precise and easier-to-understand language?
>
Maybe using the word "prohibit" makes it a bit clear? For example,
In guc_tables.c:
Prohibits access to non-system relations of specified kinds
In doc:
Set relation kinds of non-system relations to which access is
prohibited. It takes a comma-separated list of relation kinds.
Currently, the supported relation kinds are view and foreign-table.
Regards,
--
Masahiko Sawada
Amazon Web Services: https://aws.amazon.com
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: pgsql: Restrict accesses to non-system views and foreign tables during
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-26 14:14 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
2024-08-26 19:05 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
@ 2024-08-27 12:41 ` Peter Eisentraut <peter@eisentraut.org>
2024-08-27 13:29 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 14+ messages in thread
From: Peter Eisentraut @ 2024-08-27 12:41 UTC (permalink / raw)
To: Masahiko Sawada <sawada.mshk@gmail.com>; +Cc: pgsql-committers@lists.postgresql.org
On 26.08.24 21:05, Masahiko Sawada wrote:
> Maybe using the word "prohibit" makes it a bit clear? For example,
I think that would be much clearer, yes.
> In guc_tables.c:
> Prohibits access to non-system relations of specified kinds
End with period.
> In doc:
> Set relation kinds of non-system relations to which access is
> prohibited.
Still a bit awkward. Maybe "Set relation kinds for which access to
non-system relations is prohibited."
> It takes a comma-separated list of relation kinds.
> Currently, the supported relation kinds are view and foreign-table.
Maybe in the documentation it would also be appropriate to mention that
this is meant to be used by pg_dump, not for general use -- unless it is?
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: pgsql: Restrict accesses to non-system views and foreign tables during
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-26 14:14 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
2024-08-26 19:05 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-27 12:41 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
@ 2024-08-27 13:29 ` Tom Lane <tgl@sss.pgh.pa.us>
2024-08-27 20:02 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
0 siblings, 1 reply; 14+ messages in thread
From: Tom Lane @ 2024-08-27 13:29 UTC (permalink / raw)
To: Peter Eisentraut <peter@eisentraut.org>; +Cc: Masahiko Sawada <sawada.mshk@gmail.com>; pgsql-committers@lists.postgresql.org
Peter Eisentraut <peter@eisentraut.org> writes:
> Maybe in the documentation it would also be appropriate to mention that
> this is meant to be used by pg_dump, not for general use -- unless it is?
I'd vote against that. I think other catalog-scanning tools might
like to use this too.
regards, tom lane
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: pgsql: Restrict accesses to non-system views and foreign tables during
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-26 14:14 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
2024-08-26 19:05 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-27 12:41 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
2024-08-27 13:29 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Tom Lane <tgl@sss.pgh.pa.us>
@ 2024-08-27 20:02 ` Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-29 12:29 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
0 siblings, 1 reply; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-27 20:02 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Peter Eisentraut <peter@eisentraut.org>; pgsql-committers@lists.postgresql.org
On Tue, Aug 27, 2024 at 6:29 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>
> Peter Eisentraut <peter@eisentraut.org> writes:
> > Maybe in the documentation it would also be appropriate to mention that
> > this is meant to be used by pg_dump, not for general use -- unless it is?
>
> I'd vote against that. I think other catalog-scanning tools might
> like to use this too.
>
I've attached the patch to improve the descriptions while leaving this part.
Regards,
--
Masahiko Sawada
Amazon Web Services: https://aws.amazon.com
Attachments:
improve_description.patch (application/octet-stream, 1.3K) download
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 2937384b00..b6eaab4d8e 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -9822,9 +9822,9 @@ SET XML OPTION { DOCUMENT | CONTENT };
</term>
<listitem>
<para>
- This variable specifies relation kind to which access is restricted.
- It contains a comma-separated list of relation kind. Currently, the
- supported relation kinds are <literal>view</literal> and
+ Set relation kinds for which access to non-system relations is prohibited.
+ The value takes the form of a comma-separated list of relation kinds.
+ Currently, the supported relation kinds are <literal>view</literal> and
<literal>foreign-table</literal>.
</para>
</listitem>
diff --git a/src/backend/utils/misc/guc_tables.c b/src/backend/utils/misc/guc_tables.c
index af227b1f24..5cf7abedf8 100644
--- a/src/backend/utils/misc/guc_tables.c
+++ b/src/backend/utils/misc/guc_tables.c
@@ -4774,7 +4774,7 @@ struct config_string ConfigureNamesString[] =
{
{"restrict_nonsystem_relation_kind", PGC_USERSET, CLIENT_CONN_STATEMENT,
- gettext_noop("Sets relation kinds of non-system relation to restrict use"),
+ gettext_noop("Prohibits access to non-system relations of specified kinds."),
NULL,
GUC_LIST_INPUT | GUC_NOT_IN_SAMPLE
},
* Re: pgsql: Restrict accesses to non-system views and foreign tables during
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-26 14:14 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
2024-08-26 19:05 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-27 12:41 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
2024-08-27 13:29 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Tom Lane <tgl@sss.pgh.pa.us>
2024-08-27 20:02 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
@ 2024-08-29 12:29 ` Peter Eisentraut <peter@eisentraut.org>
2024-08-29 16:04 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
0 siblings, 1 reply; 14+ messages in thread
From: Peter Eisentraut @ 2024-08-29 12:29 UTC (permalink / raw)
To: Masahiko Sawada <sawada.mshk@gmail.com>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-committers@lists.postgresql.org
On 27.08.24 22:02, Masahiko Sawada wrote:
> On Tue, Aug 27, 2024 at 6:29 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>>
>> Peter Eisentraut <peter@eisentraut.org> writes:
>>> Maybe in the documentation it would also be appropriate to mention that
>>> this is meant to be used by pg_dump, not for general use -- unless it is?
>>
>> I'd vote against that. I think other catalog-scanning tools might
>> like to use this too.
>>
>
> I've attached the patch to improve the descriptions while leaving this part.
Thanks, I find this clearer.
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: pgsql: Restrict accesses to non-system views and foreign tables during
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-26 14:14 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
2024-08-26 19:05 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-27 12:41 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
2024-08-27 13:29 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Tom Lane <tgl@sss.pgh.pa.us>
2024-08-27 20:02 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-29 12:29 ` Re: pgsql: Restrict accesses to non-system views and foreign tables during Peter Eisentraut <peter@eisentraut.org>
@ 2024-08-29 16:04 ` Masahiko Sawada <sawada.mshk@gmail.com>
0 siblings, 0 replies; 14+ messages in thread
From: Masahiko Sawada @ 2024-08-29 16:04 UTC (permalink / raw)
To: Peter Eisentraut <peter@eisentraut.org>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; pgsql-committers@lists.postgresql.org
On Thu, Aug 29, 2024 at 7:29 AM Peter Eisentraut <peter@eisentraut.org> wrote:
>
> On 27.08.24 22:02, Masahiko Sawada wrote:
> > On Tue, Aug 27, 2024 at 6:29 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> >>
> >> Peter Eisentraut <peter@eisentraut.org> writes:
> >>> Maybe in the documentation it would also be appropriate to mention that
> >>> this is meant to be used by pg_dump, not for general use -- unless it is?
> >>
> >> I'd vote against that. I think other catalog-scanning tools might
> >> like to use this too.
> >>
> >
> > I've attached the patch to improve the descriptions while leaving this part.
>
> Thanks, I find this clearer.
Thank you for checking. I'm going to push it for all branches unless
there are other comments.
BTW I'd like to revisit to improve the error message for the new GUC
parameter. I've drafted the patch.We have the check in three places
and the check in GetFdwRoutine() covers the TRUNCATE command case. The
patch adds the check to ExecuteTruncateGuts() and adds the relation
name to the all log messages for that check. I'm slightly concerned
about having the check in more places, so get feedback.
Regards,
--
Masahiko Sawada
Amazon Web Services: https://aws.amazon.com
Attachments:
improve_error_message.patch (application/x-patch, 3.3K) download
diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index f3eb055e2c..f5cdc87d0c 100644
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -640,13 +640,13 @@ EXPLAIN (VERBOSE, COSTS OFF) SELECT * FROM ft_empty ORDER BY c1;
-- test restriction on non-system foreign tables.
SET restrict_nonsystem_relation_kind TO 'foreign-table';
SELECT * from ft1 where c1 < 1; -- ERROR
-ERROR: access to non-system foreign table is restricted
+ERROR: access to non-system foreign table "ft1" is restricted
INSERT INTO ft1 (c1) VALUES (1); -- ERROR
-ERROR: access to non-system foreign table is restricted
+ERROR: access to non-system foreign table "ft1" is restricted
DELETE FROM ft1 WHERE c1 = 1; -- ERROR
-ERROR: access to non-system foreign table is restricted
+ERROR: access to non-system foreign table "ft1" is restricted
TRUNCATE ft1; -- ERROR
-ERROR: access to non-system foreign table is restricted
+ERROR: access to non-system foreign table "ft1" is restricted
RESET restrict_nonsystem_relation_kind;
-- ===================================================================
-- WHERE with remotely-executable conditions
diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c
index b3cc6f8f69..9221acec39 100644
--- a/src/backend/commands/tablecmds.c
+++ b/src/backend/commands/tablecmds.c
@@ -2057,6 +2057,17 @@ ExecuteTruncateGuts(List *explicit_rels,
bool found;
ForeignTruncateInfo *ft_info;
+ if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+ {
+ /* there must not be built-in foreign tables */
+ Assert(RelationGetRelid(rel) >= FirstNormalObjectId);
+
+ ereport(ERROR,
+ (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+ errmsg("access to non-system foreign table \"%s\" is restricted",
+ RelationGetRelationName(rel))));
+ }
+
/* First time through, initialize hashtable for foreign tables */
if (!ft_htab)
{
diff --git a/src/backend/optimizer/plan/createplan.c b/src/backend/optimizer/plan/createplan.c
index 8e0e5977a9..5cf64c4a39 100644
--- a/src/backend/optimizer/plan/createplan.c
+++ b/src/backend/optimizer/plan/createplan.c
@@ -7151,7 +7151,8 @@ make_modifytable(PlannerInfo *root, Plan *subplan,
Assert(rte->relid >= FirstNormalObjectId);
ereport(ERROR,
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
- errmsg("access to non-system foreign table is restricted")));
+ errmsg("access to non-system foreign table \"%s\" is restricted",
+ get_rel_name(rte->relid))));
}
fdwroutine = GetFdwRoutineByRelId(rte->relid);
diff --git a/src/backend/optimizer/util/plancat.c b/src/backend/optimizer/util/plancat.c
index 78a3cfafde..b37c2b184c 100644
--- a/src/backend/optimizer/util/plancat.c
+++ b/src/backend/optimizer/util/plancat.c
@@ -537,7 +537,8 @@ get_relation_info(PlannerInfo *root, Oid relationObjectId, bool inhparent,
ereport(ERROR,
(errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
- errmsg("access to non-system foreign table is restricted")));
+ errmsg("access to non-system foreign table \"%s\" is restricted",
+ RelationGetRelationName(relation))));
}
rel->serverid = GetForeignServerIdByRelId(RelationGetRelid(relation));
end of thread, other threads:[~2024-08-29 16:04 UTC | newest]
Thread overview: 14+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-05 13:07 pgsql: Restrict accesses to non-system views and foreign tables during Masahiko Sawada <msawada@postgresql.org>
2024-08-26 14:14 ` Peter Eisentraut <peter@eisentraut.org>
2024-08-26 19:05 ` Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-27 12:41 ` Peter Eisentraut <peter@eisentraut.org>
2024-08-27 13:29 ` Tom Lane <tgl@sss.pgh.pa.us>
2024-08-27 20:02 ` Masahiko Sawada <sawada.mshk@gmail.com>
2024-08-29 12:29 ` Peter Eisentraut <peter@eisentraut.org>
2024-08-29 16:04 ` Masahiko Sawada <sawada.mshk@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox