pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: vignesh C <vignesh21@gmail.com>
Cc: Bharath Rupireddy <bharath.rupireddyforpostgres@gmail.com>
Cc: Andres Freund <andres@anarazel.de>
Cc: Craig Ringer <craig.ringer@enterprisedb.com>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Cc: PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Printing backtrace of postgres processes
Date: Wed, 03 Feb 2021 02:30:26 -0500
Message-ID: <3886673.1612337426@sss.pgh.pa.us> (raw)
In-Reply-To: <CALDaNm3HHMxUpYYbUFM3=RYBYZjQGgnULxdDrqwaH=DovuYMSQ@mail.gmail.com>
References: <20210115201011.noomcygirzge43ir@alap3.anarazel.de>
	<CALDaNm2wjFrizmy+yvNbedYKxorZBcGYXNMaoPC6zwSaLsmwLg@mail.gmail.com>
	<3537.1610828491@sss.pgh.pa.us>
	<CA+TgmobpOhhm0poFsShjoM=sOxkbzc78f2TdNyZpGz4GSJHh6g@mail.gmail.com>
	<492025.1611078655@sss.pgh.pa.us>
	<CA+TgmoZ8XeQVCCqfq826kAr804a1ZnYy46FnQB9r2n_iOofh8Q@mail.gmail.com>
	<523589.1611091371@sss.pgh.pa.us>
	<CAGRY4nxmyaGs4-o4JSMwsUmqe++y-9zPEmJTeRn5ZOOdNzxi5w@mail.gmail.com>
	<799340.1611194209@sss.pgh.pa.us>
	<CALDaNm1ig4dKFW1658YBH9338Oysc-MT6-YzeKU-ojv87MhhMQ@mail.gmail.com>
	<20210127170958.vzo33jzmqwhmn7z6@alap3.anarazel.de>
	<CALDaNm1uWKn8KGD0q8HqCPhxSUDKWCEW55aidOiJwd+vfaB+gg@mail.gmail.com>
	<CALj2ACXfXefmdUWiF0twoYEfgJ6Xk4saXctoYyzXtzkjizCdBw@mail.gmail.com>
	<CALDaNm0aEUNLZeiDAXvPsgm4nFUjUhtfeztGofmVJU--irSD8Q@mail.gmail.com>
	<CALj2ACXybys_tzWeatb9htVTuxKp29VErc6iJQYJBbdBZXv2fg@mail.gmail.com>
	<CALj2ACUhgagr-nLcte2+61khpO6uxvERvZA28hQpxtTzbz3U2g@mail.gmail.com>
	<CALDaNm3HHMxUpYYbUFM3=RYBYZjQGgnULxdDrqwaH=DovuY! MSQ@mail.gmail.com>

vignesh C <vignesh21@gmail.com> writes:
> On Mon, Feb 1, 2021 at 11:04 AM Bharath Rupireddy
> <bharath.rupireddyforpostgres@gmail.com> wrote:
>> Are these superuser and permission checks enough from a security
>> standpoint that we don't expose some sensitive information to the
>> user?

> This will just print the backtrace of the current backend. Users
> cannot get password information from this.

Really?

A backtrace normally exposes the text of the current query, for
instance, which could contain very sensitive data (passwords in ALTER
USER, customer credit card numbers in ordinary data, etc etc).  We
don't allow the postmaster log to be seen by any but very privileged
users; it's not sane to think that this data is any less
security-critical than the postmaster log.

This point is entirely separate from the question of whether
triggering stack traces at inopportune moments could cause system
malfunctions, but that question is also not to be ignored.

TBH, I'm leaning to the position that this should be superuser
only.  I do NOT agree with the idea that ordinary users should
be able to trigger it, even against backends theoretically
belonging to their own userid.  (Do I need to point out that
some levels of the call stack might be from security-definer
functions with more privilege than the session's nominal user?)

			regards, tom lane





view thread (135+ messages)  latest in thread

Message-ID: <3886673.1612337426@sss.pgh.pa.us>
Permalink:  ../3886673.1612337426@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/3886673.1612337426@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, vignesh21@gmail.com, bharath.rupireddyforpostgres@gmail.com, andres@anarazel.de, craig.ringer@enterprisedb.com, robertmhaas@gmail.com, peter.eisentraut@enterprisedb.com, pgsql-hackers@lists.postgresql.org
  Subject: Re: Printing backtrace of postgres processes
  In-Reply-To: <3886673.1612337426@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox