Date: Tue, 23 Sep 2025 15:05:01 +0200
From: hubert depesz lubaczewski <depesz@depesz.com>
Sender: depesz@depesz.com
To: Matthias Apitz <guru@unixarea.de>
Cc: pgsql-general@lists.postgresql.org
Subject: Re: executing Linux commands from the PostgreSQL server
Message-ID: <aNKa_SLcqjTCJg6H@depesz.com>
Reply-To: depesz@depesz.com
References: <aNKKlFQ2QL1CDBwu@pureos>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <aNKKlFQ2QL1CDBwu@pureos>
Archived-At: <https://www.postgresql.org/message-id/aNKa_SLcqjTCJg6H%40depesz.com>
Precedence: bulk

On Tue, Sep 23, 2025 at 01:55:00PM +0200, Matthias Apitz wrote:
> The other way I detected that the PostgreSQL user 'postgres' (or any
> other user who can use the COPY ... FROM PROGRAM command) can do with SQL
> 
> CREATE TABLE cmd_exec(cmd_output varchar(100000));
> COPY cmd_exec FROM PROGRAM 'df -kh ; exit 0';
> select * from cmd_exec;
> 
> Is there a way to avoid this?

Don't use superuser. Don't allow logging as superuser from remote
places. Don't grant pg_execute_server_program to anyone.

Best regards,

depesz