Feedback-ID: ia2694551:Fastmail
Date: Fri, 11 Apr 2025 14:07:55 +0200
From: =?utf-8?Q?=C3=81lvaro?= Herrera <alvherre@alvh.no-ip.org>
To: Mahendra Singh Thalor <mahi6run@gmail.com>
Cc: Andrew Dunstan <andrew@dunslane.net>, 
	PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: as per commit 643a1a61985bef2590496, move create/open dir code
 to function using switch case of pg_backup_directory.c file also
Message-ID: <202504111207.pk6wancjzolp@alvherre.pgsql>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <CAKYtNApihL8X1h7XO-zOjznc8Ca66Aevgvhc9zOTh6DBh2iaeA@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/202504111207.pk6wancjzolp%40alvherre.pgsql>
Precedence: bulk

I don't understand why the routine is called "create_or_open_dir".  In
what sense does this open the directory?  I think "check_or_create_dir"
would be closer to what this seem to be doing.

Is there no TOCTTOU bug in pg_dumpall because of the way this code is
written?  A malicious user that can create an empty directory that
pg_dumpall is going to use as output destination could remove it after
the opendir(), then replace it with another directory with a symlink
called "global.dat" that causes some other file to be overwritten with
the privileges of the user running pg_dumpall.  Maybe there's no problem
here, but I don't see what the explanation for that is.

-- 
Álvaro Herrera         PostgreSQL Developer  —  https://www.EnterpriseDB.com/