Date: Sun, 24 Jul 2022 21:30:44 -0700
From: Nathan Bossart <nathandbossart@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>, michael@paquier.xyz,
	gurjeet@singh.im, pgsql-hackers@postgresql.org
Subject: Re: Unprivileged user can induce crash by using an SUSET param in
 PGOPTIONS
Message-ID: <20220725043044.GC4085281@nathanxps13>
References: 
 <CABwTF4WXCbjEpVRq+G+MZeJEXU=2evYMb_DVdzXpWap5cczkcQ@mail.gmail.com>
 <Ytn2ssEKdzPFM3Vf@paquier.xyz>
 <20220722.151600.1094104349120879204.horikyota.ntt@gmail.com>
 <729330.1658516182@sss.pgh.pa.us>
 <20220722223359.GB3998906@nathanxps13>
 <763512.1658529844@sss.pgh.pa.us>
 <20220722225615.GC3998906@nathanxps13>
 <954936.1658597004@sss.pgh.pa.us>
 <20220725034040.GA4085281@nathanxps13>
 <1834276.1658720963@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1834276.1658720963@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/20220725043044.GC4085281%40nathanxps13>
Precedence: bulk

On Sun, Jul 24, 2022 at 11:49:23PM -0400, Tom Lane wrote:
> Nathan Bossart <nathandbossart@gmail.com> writes:
>> I noticed that a couple of places check whether whereToSendOutput is set to
>> DestRemote to determine if this is an interactive session.
> 
> IIRC, that would end in not loading the preload libraries in a standalone
> backend.  Perhaps that's what we want, but I'd supposed not.  Discuss.

Ah, I see.  There was a recent change to make sure shared_preload_libraries
are loaded in single-user mode (6c31ac0), but those are for load at "server
start" instead of "connection start."  However, AFAICT
session_preload_libraries is loaded in single-user mode today, and
single-user mode is arguably a connection, so my instinct is that we should
continue to process it in single-user mode.  I suppose we might be able to
add more hacks to load it in single-user mode without a new argument, but
at that point, we're probably not too far from your original proposal.
Given all this, I think I'm inclined for the new argument.

-- 
Nathan Bossart
Amazon Web Services: https://aws.amazon.com