pg.ddx.io pgsql-general@postgresql.org mailing list archive
help / color / mirror / Atom feedexecuting Linux commands from the PostgreSQL server
3+ messages / 3 participants
[nested] [flat]
* executing Linux commands from the PostgreSQL server
@ 2025-09-23 11:55 Matthias Apitz <guru@unixarea.de>
0 siblings, 2 replies; 3+ messages in thread
From: Matthias Apitz @ 2025-09-23 11:55 UTC (permalink / raw)
To: pgsql-general@lists.postgresql.org
Hello,
The other way I detected that the PostgreSQL user 'postgres' (or any
other user who can use the COPY ... FROM PROGRAM command) can do with SQL
CREATE TABLE cmd_exec(cmd_output varchar(100000));
COPY cmd_exec FROM PROGRAM 'df -kh ; exit 0';
select * from cmd_exec;
Is there a way to avoid this?
matthias
--
Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
Annalena Baerbock: "We are fighting a war against Russia ..." (25.1.2023)
I, Matthias, I am not at war with Russia.
Я не воюю с Россией.
Ich bin nicht im Krieg mit Russland.
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: executing Linux commands from the PostgreSQL server
@ 2025-09-23 13:05 hubert depesz lubaczewski <depesz@depesz.com>
parent: Matthias Apitz <guru@unixarea.de>
1 sibling, 0 replies; 3+ messages in thread
From: hubert depesz lubaczewski @ 2025-09-23 13:05 UTC (permalink / raw)
To: Matthias Apitz <guru@unixarea.de>; +Cc: pgsql-general@lists.postgresql.org
On Tue, Sep 23, 2025 at 01:55:00PM +0200, Matthias Apitz wrote:
> The other way I detected that the PostgreSQL user 'postgres' (or any
> other user who can use the COPY ... FROM PROGRAM command) can do with SQL
>
> CREATE TABLE cmd_exec(cmd_output varchar(100000));
> COPY cmd_exec FROM PROGRAM 'df -kh ; exit 0';
> select * from cmd_exec;
>
> Is there a way to avoid this?
Don't use superuser. Don't allow logging as superuser from remote
places. Don't grant pg_execute_server_program to anyone.
Best regards,
depesz
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: executing Linux commands from the PostgreSQL server
@ 2025-09-23 19:01 Juan Rodrigo Alejandro Burgos Mella <rodrigoburgosmella@gmail.com>
parent: Matthias Apitz <guru@unixarea.de>
1 sibling, 0 replies; 3+ messages in thread
From: Juan Rodrigo Alejandro Burgos Mella @ 2025-09-23 19:01 UTC (permalink / raw)
To: Matthias Apitz <guru@unixarea.de>; +Cc: pgsql-general@lists.postgresql.org
Hello Matthias, the only way is to remove SUPERUSER privileges from the
user in question.
ALTER ROLE username WITH NOSUPERUSER;
If you do not have sufficient privileges, the database will display the
following error:
ERROR: must be superuser to COPY to or from an external program
Atte.
JRBM
El mar, 23 sept 2025 a las 6:55, Matthias Apitz (<guru@unixarea.de>)
escribió:
>
> Hello,
>
> The other way I detected that the PostgreSQL user 'postgres' (or any
> other user who can use the COPY ... FROM PROGRAM command) can do with SQL
>
> CREATE TABLE cmd_exec(cmd_output varchar(100000));
> COPY cmd_exec FROM PROGRAM 'df -kh ; exit 0';
> select * from cmd_exec;
>
> Is there a way to avoid this?
>
> matthias
>
> --
> Matthias Apitz, ✉ guru@unixarea.de, http://www.unixarea.de/
> +49-176-38902045
> Public GnuPG key: http://www.unixarea.de/key.pub
>
> Annalena Baerbock: "We are fighting a war against Russia ..." (25.1.2023)
>
> I, Matthias, I am not at war with Russia.
> Я не воюю с Россией.
> Ich bin nicht im Krieg mit Russland.
>
>
>
^ permalink raw reply [nested|flat] 3+ messages in thread
end of thread, other threads:[~2025-09-23 19:01 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-09-23 11:55 executing Linux commands from the PostgreSQL server Matthias Apitz <guru@unixarea.de>
2025-09-23 13:05 ` hubert depesz lubaczewski <depesz@depesz.com>
2025-09-23 19:01 ` Juan Rodrigo Alejandro Burgos Mella <rodrigoburgosmella@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox