From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: michael@paquier.xyz
Cc: gurjeet@singh.im
Cc: pgsql-hackers@postgresql.org
Subject: Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS
Date: Fri, 22 Jul 2022 18:44:04 -0400
Message-ID: <763512.1658529844@sss.pgh.pa.us> (raw)
In-Reply-To: <20220722223359.GB3998906@nathanxps13>
References: <CABwTF4U9v4u3L2GWU6ZVxK-6NtvEMarrgAj2Vq8=wE_g1Tkncw@mail.gmail.com>
<CABwTF4WXCbjEpVRq+G+MZeJEXU=2evYMb_DVdzXpWap5cczkcQ@mail.gmail.com>
<Ytn2ssEKdzPFM3Vf@paquier.xyz>
<20220722.151600.1094104349120879204.horikyota.ntt@gmail.com>
<729330.1658516182@sss.pgh.pa.us>
<20220722223359.GB3998906@nathanxps13>
Nathan Bossart <nathandbossart@gmail.com> writes:
> On Fri, Jul 22, 2022 at 02:56:22PM -0400, Tom Lane wrote:
>> + if (!bootstrap &&
>> + !IsAutoVacuumWorkerProcess() &&
>> + !IsBackgroundWorker &&
>> + !am_walsender)
>> + process_session_preload_libraries();
> I worry that this will be easily missed when adding new types of
> non-interactive sessions, but I can't claim to have a better idea.
Yeah, that bothered me too. A variant that I'd considered is to
create a local variable "bool interactive" and set it properly
in each of the arms of the if-chain dealing with authentication
(starting about postinit.c:800). While that approach would cover
most of the tests shown above, it would not have exposed the issue
of needing to check am_walsender, so I'm not very convinced that
it'd be any better.
Another idea is to add a "bool interactive" parameter to InitPostgres,
thereby shoving the issue out to the call sites. Still wouldn't
expose the am_walsender angle, but conceivably it'd be more
future-proof anyway?
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, nathandbossart@gmail.com, horikyota.ntt@gmail.com, michael@paquier.xyz, gurjeet@singh.im
Subject: Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS
In-Reply-To: <763512.1658529844@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox