Message-ID: <f53df2dbe11bb42764bcdd003a54aa29c9bb6137.camel@j-davis.com>
Subject: Re: pgsql: Fix search_path to a safe value during maintenance
 operations.
From: Jeff Davis <pgsql@j-davis.com>
To: Noah Misch <noah@leadboat.com>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: Jeff Davis <jdavis@postgresql.org>, pgsql-committers@lists.postgresql.org
Date: Mon, 12 Jun 2023 17:39:40 -0700
In-Reply-To: <20230612170510.GA201972@gust.leadboat.com>
References: <E1q7j7Y-000z1H-Hr@gemulon.postgresql.org>
	 <89a415b86d5421941e4281ba5bf6288934078624.camel@j-davis.com>
	 <d20864b929ff769a0ebf772359719f05bb6982cd.camel@j-davis.com>
	 <573014.1686375211@sss.pgh.pa.us>
	 <20230612170510.GA201972@gust.leadboat.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4-0ubuntu1 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/f53df2dbe11bb42764bcdd003a54aa29c9bb6137.camel%40j-davis.com>
Precedence: bulk

On Mon, 2023-06-12 at 13:05 -0400, Noah Misch wrote:
> The timing was not great, but this is fixing a purported defect in an
> older
> v16 feature.=C2=A0 If the MAINTAIN privilege is actually fine, we're all
> set for
> v16.=C2=A0 If MAINTAIN does have a material problem that $SUBJECT had
> fixed, we
> should either revert MAINTAIN, un-revert $SUBJECT, or fix the problem
> a
> different way.

Someone with the MAINTAIN privilege on a table can use search_path
tricks against the table owner, if the code is susceptible, because
maintenance code runs with the privileges of the table owner.

I was concerned enough to bring it up on the -security list, and then
to -hackers followed by a commit (too late). But perhaps that was
paranoia: the practical risk is probably quite low, because a user with
the MAINTAIN privilege is likely to be highly trusted.

I'd like to hear from others on the topic about the relative risks of
shipping with/without the search_path changes.

I don't think a full revert of the MAINTAIN privilege is the right
thing -- the predefined role is very valuable and many other predefined
roles are much more dangerous than pg_maintain is.

Regards,
	Jeff Davis