public inbox for [email protected]
help / color / mirror / Atom feedexecuting Linux commands from the PostgreSQL server
2+ messages / 2 participants
[nested] [flat]
* executing Linux commands from the PostgreSQL server
@ 2025-09-23 11:55 Matthias Apitz <[email protected]>
2025-09-23 13:05 ` Re: executing Linux commands from the PostgreSQL server hubert depesz lubaczewski <[email protected]>
0 siblings, 1 reply; 2+ messages in thread
From: Matthias Apitz @ 2025-09-23 11:55 UTC (permalink / raw)
To: [email protected]
Hello,
The other way I detected that the PostgreSQL user 'postgres' (or any
other user who can use the COPY ... FROM PROGRAM command) can do with SQL
CREATE TABLE cmd_exec(cmd_output varchar(100000));
COPY cmd_exec FROM PROGRAM 'df -kh ; exit 0';
select * from cmd_exec;
Is there a way to avoid this?
matthias
--
Matthias Apitz, ✉ [email protected], http://www.unixarea.de/ +49-176-38902045
Public GnuPG key: http://www.unixarea.de/key.pub
Annalena Baerbock: "We are fighting a war against Russia ..." (25.1.2023)
I, Matthias, I am not at war with Russia.
Я не воюю с Россией.
Ich bin nicht im Krieg mit Russland.
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: executing Linux commands from the PostgreSQL server
2025-09-23 11:55 executing Linux commands from the PostgreSQL server Matthias Apitz <[email protected]>
@ 2025-09-23 13:05 ` hubert depesz lubaczewski <[email protected]>
0 siblings, 0 replies; 2+ messages in thread
From: hubert depesz lubaczewski @ 2025-09-23 13:05 UTC (permalink / raw)
To: Matthias Apitz <[email protected]>; +Cc: [email protected]
On Tue, Sep 23, 2025 at 01:55:00PM +0200, Matthias Apitz wrote:
> The other way I detected that the PostgreSQL user 'postgres' (or any
> other user who can use the COPY ... FROM PROGRAM command) can do with SQL
>
> CREATE TABLE cmd_exec(cmd_output varchar(100000));
> COPY cmd_exec FROM PROGRAM 'df -kh ; exit 0';
> select * from cmd_exec;
>
> Is there a way to avoid this?
Don't use superuser. Don't allow logging as superuser from remote
places. Don't grant pg_execute_server_program to anyone.
Best regards,
depesz
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2025-09-23 13:05 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2025-09-23 11:55 executing Linux commands from the PostgreSQL server Matthias Apitz <[email protected]>
2025-09-23 13:05 ` hubert depesz lubaczewski <[email protected]>
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox