From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Tomas Vondra <tomas.vondra@enterprisedb.com>
To: pgsql-hackers@lists.postgresql.org
Subject: Re: Wrong security context for deferred triggers?
Date: Mon, 06 Nov 2023 21:00:43 +0100
Message-ID: <05225cbe3f8b60dcce8b8eca61d06f0953762d41.camel@cybertec.at> (raw)
In-Reply-To: <dede297a-3d24-7029-dfd9-06aeef8b9766@enterprisedb.com>
References: <77ee784cf248e842f74588418f55c2931e47bd78.camel@cybertec.at>
<dede297a-3d24-7029-dfd9-06aeef8b9766@enterprisedb.com>
On Mon, 2023-11-06 at 18:29 +0100, Tomas Vondra wrote:
> On 11/6/23 14:23, Laurenz Albe wrote:
> > This behavior looks buggy to me. What do you think?
> > I cannot imagine that it is a security problem, though.
>
> How could code getting executed under the wrong role not be a security
> issue? Also, does this affect just the role, or are there some other
> settings that may unexpectedly change (e.g. search_path)?
Perhaps it is a security issue, and I am just lacking imagination.
Yes, changes to "search_path" should also have an effect.
Yours,
Laurenz Albe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: laurenz.albe@cybertec.at, tomas.vondra@enterprisedb.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Wrong security context for deferred triggers?
In-Reply-To: <05225cbe3f8b60dcce8b8eca61d06f0953762d41.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox