From: Tom Lane <tgl@sss.pgh.pa.us>
To: Dean Rasheed <dean.a.rasheed@gmail.com>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Tomas Vondra <tomas.vondra@2ndquadrant.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Subject: Re: Multivariate MCV stats can leak data to unprivileged users
Date: Sun, 19 May 2019 10:12:28 -0400
Message-ID: <23229.1558275148@sss.pgh.pa.us> (raw)
In-Reply-To: <CAEZATCUcoAKrn-1NFkDN7md-wt6CQev0JXa+Tv31T9Jjkxgx5Q@mail.gmail.com>
References: <20190517202938.lkx6q2u6woiptrsa@alap3.anarazel.de>
<CAEZATCX9yU2eKL7-dCWTv1pMMi1hb+PsZyM6gjBxupDnMuEzRw@mail.gmail.com>
<CAEZATCV5fo2E6K5EVN2uytGjMvhTKTizP_rOW67nPqNK8jHAAg@mail.gmail.com>
<21269.1558192388@sss.pgh.pa.us>
<CAEZATCW3iAJnU8opUCXb2i_-8syU7on4cdXLWHBeWr04v67HoQ@mail.gmail.com>
<4E0E0C14-C476-446A-835F-CC3558709DA9@anarazel.de>
<20190518190042.2y33h4toxk4fxv5t@development>
<568.1558208711@sss.pgh.pa.us>
<20190518232812.qpnjmydlx3uzzsj7@development>
<20866.1558223060@sss.pgh.pa.us>
<20190518234841.GE6197@tamriel.snowman.net>
<CAEZATCUcoAKrn-1NFkDN7md-wt6CQev0JXa+Tv31T9Jjkxgx5Q@mail.gmail.com>
Dean Rasheed <dean.a.rasheed@gmail.com> writes:
> I think we shouldn't risk trying to get this into beta1, but let's try
> to get it done as soon as possible after that.
Agreed.
> \d pg_statistic_ext
> Table "pg_catalog.pg_statistic_ext"
> Column | Type | Collation | Nullable | Default
> --------------+------------+-----------+----------+---------
> oid | oid | | not null |
> stxrelid | oid | | not null |
> stxname | name | | not null |
> stxnamespace | oid | | not null |
> stxowner | oid | | not null |
> stxkeys | int2vector | | not null |
> stxkind | "char"[] | | not null |
> Indexes:
> "pg_statistic_ext_name_index" UNIQUE, btree (stxname, stxnamespace)
> "pg_statistic_ext_oid_index" UNIQUE, btree (oid)
> "pg_statistic_ext_relid_index" btree (stxrelid)
Check.
> \d pg_statistic_ext_data
> Table "pg_catalog.pg_statistic_ext_data"
> Column | Type | Collation | Nullable | Default
> -----------------+-----------------+-----------+----------+---------
> stxoid | oid | | not null |
> stxndistinct | pg_ndistinct | C | |
> stxdependencies | pg_dependencies | C | |
> stxmcv | pg_mcv_list | C | |
> Indexes:
> "pg_statistic_ext_data_stxoid_index" UNIQUE, btree (stxoid)
I wonder ... another way we could potentially do this is
create table pg_statistic_ext_data(
stxoid oid, -- OID of owning pg_statistic_ext entry
stxkind char, -- what kind of data
stxdata bytea -- the data, in some format or other
);
The advantage of this way is that we'd not have to rejigger the
catalog's rowtype every time we think of a new kind of extended
stats. The disadvantage is that manual inspection of the contents
of an entry would become much harder, for lack of any convenient
output function. However, this whole exercise is mostly to prevent
casual manual inspection anyway :-(, so I wonder how much we care
about that.
Also, I assume there's going to be a user-accessible view that shows
a join of these tables, but only those rows that correspond to columns
the current user can read all of. Should we give that view the name
pg_statistic_ext for maximum backward compatibility? I'm not sure.
pg_dump would probably prefer it if the view is what has a new name,
but other clients might like the other way.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, dean.a.rasheed@gmail.com, sfrost@snowman.net, tomas.vondra@2ndquadrant.com, andres@anarazel.de
Subject: Re: Multivariate MCV stats can leak data to unprivileged users
In-Reply-To: <23229.1558275148@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox