From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nathan Bossart <nathandbossart@gmail.com>
cc: Michael Paquier <michael@paquier.xyz>, pgsql-hackers@postgresql.org
Subject: Re: pg_parameter_aclcheck() and trusted extensions
In-reply-to: <20220718215649.GA3699123@nathanxps13>
References: <20220706224727.GA2158260@nathanxps13>
 <YsYxEtX8zOYKf3Ru@paquier.xyz> <2995921.1657212060@sss.pgh.pa.us>
 <3126292.1657828950@sss.pgh.pa.us> <20220714215225.GA3173833@nathanxps13>
 <3159281.1657836225@sss.pgh.pa.us> <20220714225735.GB3173833@nathanxps13>
 <20220718215649.GA3699123@nathanxps13>
Comments: In-reply-to Nathan Bossart <nathandbossart@gmail.com>
	message dated "Mon, 18 Jul 2022 14:56:49 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1356976.1658262428.1@sss.pgh.pa.us>
Date: Tue, 19 Jul 2022 16:27:08 -0400
Message-ID: <1356977.1658262428@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1356977.1658262428%40sss.pgh.pa.us>
Precedence: bulk

Nathan Bossart <nathandbossart@gmail.com> writes:
>> I think this is because GUCArrayReset() is the only caller of
>> validate_option_array_item() that sets skipIfNoPermissions to true.  The
>> others fall through to set_config_option(), which does a
>> pg_parameter_aclcheck().  So, you are right.

> Here's a small patch that seems to fix this case.

Yeah, this is more or less what I was thinking of.

> However, I wonder if a
> better way to fix this is to provide a way to stop set_config_option() from
> throwing errors (e.g., setting elevel to -1).  That way, we could remove
> the manual permissions checks in favor of always using the real ones, which
> might help prevent similar bugs in the future.

I thought about that for a bit.  You could almost do it today if you
passed elevel == DEBUG5; the ensuing log chatter for failures would be
down in the noise compared to everything else you would see with
min_messages cranked down that far.  However,

(1) As things stand, set_config_option()'s result does not distinguish
no-permissions failures from other problems, so we'd need some rejiggering
of its API anyway.

(2) As you mused upthread, it's possible that ACL_SET isn't what we should
be checking here, but some more-specific privilege.  So I'd just as soon
keep this privilege check separate from set_config_option's.

I'll push ahead with fixing it like this.

			regards, tom lane