From: Nathan Bossart <nathandbossart@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-hackers@postgresql.org
Subject: Re: pg_parameter_aclcheck() and trusted extensions
Date: Thu, 7 Jul 2022 09:49:21 -0700
Message-ID: <20220707164921.GA2251016@nathanxps13> (raw)
In-Reply-To: <YsYxEtX8zOYKf3Ru@paquier.xyz>
References: <20220706224727.GA2158260@nathanxps13>
<YsYxEtX8zOYKf3Ru@paquier.xyz>
On Thu, Jul 07, 2022 at 10:04:18AM +0900, Michael Paquier wrote:
> On Wed, Jul 06, 2022 at 03:47:27PM -0700, Nathan Bossart wrote:
>> I think the call to superuser_arg() in pg_parameter_aclmask() is causing
>> set_config_option() to bypass the normal privilege checks, as
>> execute_extension_script() will have set the user ID to the bootstrap
>> superuser for trusted extensions like plperl. I don't have a patch or a
>> proposal at the moment, but I thought it was worth starting the discussion.
>
> Looks like a bug to me, so I have added an open item assigned to Tom.
Thanks. I've been thinking about this one a bit. For simple cases like
plperl, it would be easy enough to temporarily revert the superuser switch
when calling _PG_init() or one of the DefineCustomXXXVariable functions.
Unfortunately, I think there are more complicated scenarios. For example,
what role should pg_parameter_aclmask() use when a trusted extension script
loads a library after SET ROLE? The original user might not ordinarily be
able to assume this role, so the trusted extension script could still be a
way to set parameters you don't have privileges for. Should we just always
use the role that's calling CREATE EXTENSION?
--
Nathan Bossart
Amazon Web Services: https://aws.amazon.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: nathandbossart@gmail.com, michael@paquier.xyz
Subject: Re: pg_parameter_aclcheck() and trusted extensions
In-Reply-To: <20220707164921.GA2251016@nathanxps13>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox