From: Nathan Bossart <nathandbossart@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-hackers@postgresql.org
Subject: Re: pg_parameter_aclcheck() and trusted extensions
Date: Tue, 19 Jul 2022 14:41:42 -0700
Message-ID: <20220719214142.GA3720087@nathanxps13> (raw)
In-Reply-To: <1356977.1658262428@sss.pgh.pa.us>
References: <20220706224727.GA2158260@nathanxps13>
<YsYxEtX8zOYKf3Ru@paquier.xyz>
<2995921.1657212060@sss.pgh.pa.us>
<3126292.1657828950@sss.pgh.pa.us>
<20220714215225.GA3173833@nathanxps13>
<3159281.1657836225@sss.pgh.pa.us>
<20220714225735.GB3173833@nathanxps13>
<20220718215649.GA3699123@nathanxps13>
<1356977.1658262428@sss.pgh.pa.us>
On Tue, Jul 19, 2022 at 04:27:08PM -0400, Tom Lane wrote:
> Nathan Bossart <nathandbossart@gmail.com> writes:
>> However, I wonder if a
>> better way to fix this is to provide a way to stop set_config_option() from
>> throwing errors (e.g., setting elevel to -1). That way, we could remove
>> the manual permissions checks in favor of always using the real ones, which
>> might help prevent similar bugs in the future.
>
> I thought about that for a bit. You could almost do it today if you
> passed elevel == DEBUG5; the ensuing log chatter for failures would be
> down in the noise compared to everything else you would see with
> min_messages cranked down that far. However,
>
> (1) As things stand, set_config_option()'s result does not distinguish
> no-permissions failures from other problems, so we'd need some rejiggering
> of its API anyway.
>
> (2) As you mused upthread, it's possible that ACL_SET isn't what we should
> be checking here, but some more-specific privilege. So I'd just as soon
> keep this privilege check separate from set_config_option's.
I think we'd also need to keep the manual permissions checks for
placeholders, so it wouldn't save much, anyway.
> I'll push ahead with fixing it like this.
Sounds good.
--
Nathan Bossart
Amazon Web Services: https://aws.amazon.com
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: nathandbossart@gmail.com, tgl@sss.pgh.pa.us, michael@paquier.xyz
Subject: Re: pg_parameter_aclcheck() and trusted extensions
In-Reply-To: <20220719214142.GA3720087@nathanxps13>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox