MIME-Version: 1.0
References: <aNKKlFQ2QL1CDBwu@pureos>
In-Reply-To: <aNKKlFQ2QL1CDBwu@pureos>
From: Juan Rodrigo Alejandro Burgos Mella <rodrigoburgosmella@gmail.com>
Date: Tue, 23 Sep 2025 14:01:52 -0500
Message-ID: <CAHbZ42yK+BjWdAM8eezXG12qC4RtmbNo4scYPthXCHS0ynuKQQ@mail.gmail.com>
Subject: Re: executing Linux commands from the PostgreSQL server
To: Matthias Apitz <guru@unixarea.de>
Cc: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000584ebd063f7c92b6"
Archived-At: <https://www.postgresql.org/message-id/CAHbZ42yK%2BBjWdAM8eezXG12qC4RtmbNo4scYPthXCHS0ynuKQQ%40mail.gmail.com>
Precedence: bulk

--000000000000584ebd063f7c92b6
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

Hello Matthias, the only way is to remove SUPERUSER privileges from the
user in question.

ALTER ROLE username WITH NOSUPERUSER;

If you do not have sufficient privileges, the database will display the
following error:

ERROR: must be superuser to COPY to or from an external program

Atte.
JRBM

El mar, 23 sept 2025 a las 6:55, Matthias Apitz (<guru@unixarea.de>)
escribi=C3=B3:

>
> Hello,
>
> The other way I detected that the PostgreSQL user 'postgres' (or any
> other user who can use the COPY ... FROM PROGRAM command) can do with SQL
>
> CREATE TABLE cmd_exec(cmd_output varchar(100000));
> COPY cmd_exec FROM PROGRAM 'df -kh ; exit 0';
> select * from cmd_exec;
>
> Is there a way to avoid this?
>
>         matthias
>
> --
> Matthias Apitz, =E2=9C=89 guru@unixarea.de, http://www.unixarea.de/
> +49-176-38902045
> Public GnuPG key: http://www.unixarea.de/key.pub
>
> Annalena Baerbock: "We are fighting a war against Russia ..." (25.1.2023)
>
> I, Matthias, I am not at war with Russia.
> =D0=AF =D0=BD=D0=B5 =D0=B2=D0=BE=D1=8E=D1=8E =D1=81 =D0=A0=D0=BE=D1=81=D1=
=81=D0=B8=D0=B5=D0=B9.
> Ich bin nicht im Krieg mit Russland.
>
>
>

--000000000000584ebd063f7c92b6
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">Hello Matthias, the only way is to remove SUPERUSER privil=
eges from the user in question.<br><br><div>ALTER ROLE username WITH NOSUPE=
RUSER;</div><div><br></div><div>If you do not have sufficient privileges, t=
he database will display the following error:<br><br>ERROR: must be superus=
er to COPY to or from an external program</div><div><br></div><div>Atte.</d=
iv><div>JRBM</div></div><br><div class=3D"gmail_quote gmail_quote_container=
"><div dir=3D"ltr" class=3D"gmail_attr">El mar, 23 sept 2025 a las 6:55, Ma=
tthias Apitz (&lt;<a href=3D"mailto:guru@unixarea.de">guru@unixarea.de</a>&=
gt;) escribi=C3=B3:<br></div><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1=
ex"><br>
Hello,<br>
<br>
The other way I detected that the PostgreSQL user &#39;postgres&#39; (or an=
y<br>
other user who can use the COPY ... FROM PROGRAM command) can do with SQL<b=
r>
<br>
CREATE TABLE cmd_exec(cmd_output varchar(100000));<br>
COPY cmd_exec FROM PROGRAM &#39;df -kh ; exit 0&#39;;<br>
select * from cmd_exec;<br>
<br>
Is there a way to avoid this?<br>
<br>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 matthias<br>
<br>
-- <br>
Matthias Apitz, =E2=9C=89 <a href=3D"mailto:guru@unixarea.de" target=3D"_bl=
ank">guru@unixarea.de</a>, <a href=3D"http://www.unixarea.de/" rel=3D"noref=
errer" target=3D"_blank">http://www.unixarea.de/</a> +49-176-38902045<br>
Public GnuPG key: <a href=3D"http://www.unixarea.de/key.pub" rel=3D"norefer=
rer" target=3D"_blank">http://www.unixarea.de/key.pub</a><br>
<br>
Annalena Baerbock: &quot;We are fighting a war against Russia ...&quot; (25=
.1.2023)<br>
<br>
I, Matthias, I am not at war with Russia.<br>
=D0=AF =D0=BD=D0=B5 =D0=B2=D0=BE=D1=8E=D1=8E =D1=81 =D0=A0=D0=BE=D1=81=D1=
=81=D0=B8=D0=B5=D0=B9.<br>
Ich bin nicht im Krieg mit Russland.<br>
<br>
<br>
</blockquote></div>

--000000000000584ebd063f7c92b6--