public inbox for [email protected]  

help / color / mirror / Atom feed

From: Juan Rodrigo Alejandro Burgos Mella <[email protected]>
To: Matthias Apitz <[email protected]>
Cc: [email protected]
Subject: Re: executing Linux commands from the PostgreSQL server
Date: Tue, 23 Sep 2025 14:01:52 -0500
Message-ID: <CAHbZ42yK+BjWdAM8eezXG12qC4RtmbNo4scYPthXCHS0ynuKQQ@mail.gmail.com> (raw)
In-Reply-To: <aNKKlFQ2QL1CDBwu@pureos>
References: <aNKKlFQ2QL1CDBwu@pureos>

Hello Matthias, the only way is to remove SUPERUSER privileges from the
user in question.

ALTER ROLE username WITH NOSUPERUSER;

If you do not have sufficient privileges, the database will display the
following error:

ERROR: must be superuser to COPY to or from an external program

Atte.
JRBM

El mar, 23 sept 2025 a las 6:55, Matthias Apitz (<[email protected]>)
escribió:

>
> Hello,
>
> The other way I detected that the PostgreSQL user 'postgres' (or any
> other user who can use the COPY ... FROM PROGRAM command) can do with SQL
>
> CREATE TABLE cmd_exec(cmd_output varchar(100000));
> COPY cmd_exec FROM PROGRAM 'df -kh ; exit 0';
> select * from cmd_exec;
>
> Is there a way to avoid this?
>
>         matthias
>
> --
> Matthias Apitz, ✉ [email protected], http://www.unixarea.de/
> +49-176-38902045
> Public GnuPG key: http://www.unixarea.de/key.pub
>
> Annalena Baerbock: "We are fighting a war against Russia ..." (25.1.2023)
>
> I, Matthias, I am not at war with Russia.
> Я не воюю с Россией.
> Ich bin nicht im Krieg mit Russland.
>
>
>

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: executing Linux commands from the PostgreSQL server
  In-Reply-To: <CAHbZ42yK+BjWdAM8eezXG12qC4RtmbNo4scYPthXCHS0ynuKQQ@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox