Feedback-ID: i1ff147bf:Fastmail
From: =?utf-8?Q?Dagfinn_Ilmari_Manns=C3=A5ker?= <ilmari@ilmari.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Nathan Bossart <nathandbossart@gmail.com>,  Kyotaro Horiguchi
 <horikyota.ntt@gmail.com>,  michael@paquier.xyz,  gurjeet@singh.im,
  pgsql-hackers@postgresql.org
Subject: Re: Unprivileged user can induce crash by using an SUSET param in
 PGOPTIONS
References: 
 <CABwTF4WXCbjEpVRq+G+MZeJEXU=2evYMb_DVdzXpWap5cczkcQ@mail.gmail.com>
	<Ytn2ssEKdzPFM3Vf@paquier.xyz>
	<20220722.151600.1094104349120879204.horikyota.ntt@gmail.com>
	<729330.1658516182@sss.pgh.pa.us>
	<20220722223359.GB3998906@nathanxps13>
	<763512.1658529844@sss.pgh.pa.us>
	<20220722225615.GC3998906@nathanxps13>
	<954936.1658597004@sss.pgh.pa.us>
	<20220725034040.GA4085281@nathanxps13>
	<1834276.1658720963@sss.pgh.pa.us>
	<20220725043044.GC4085281@nathanxps13>
	<2015981.1658759562@sss.pgh.pa.us> <87ilnli57b.fsf@wibble.ilmari.org>
	<2062116.1658778378@sss.pgh.pa.us>
Date: Tue, 26 Jul 2022 17:02:40 +0100
In-Reply-To: <2062116.1658778378@sss.pgh.pa.us> (Tom Lane's message of "Mon,
	25 Jul 2022 15:46:18 -0400")
Message-ID: <87edy7j1zz.fsf@wibble.ilmari.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Archived-At: 
 <https://www.postgresql.org/message-id/87edy7j1zz.fsf%40wibble.ilmari.org>
Precedence: bulk

Tom Lane <tgl@sss.pgh.pa.us> writes:

> =?utf-8?Q?Dagfinn_Ilmari_Manns=C3=A5ker?= <ilmari@ilmari.org> writes:
>> Tom Lane <tgl@sss.pgh.pa.us> writes:
>>> I wonder if it'd be a good idea to convert
>>> auto_explain's TAP test to load auto_explain via session_preload_libraries
>>> instead of shared_preload_libraries, and then pass in the settings for
>>> each test via PGOPTIONS instead of constantly rewriting postgresql.conf.
>
>> That whole config-file rewriting did feel a bit icky when I added more
>> tests recently, but I completely forgot about PGOPTIONS and -c.
>> Something like the attached is indeed much nicer.
>
> Thanks!  I added a test to verify the permissions-checking issue
> and pushed it.

Thanks!  Just one minor nitpick: setting an %ENV entry to `undef`
doesn't unset the environment variable, it sets it to the empty string.
To unset a variable it needs to be deleted from %ENV, i.e. `delete
$ENV{PGUSER};`.  Alternatively, wrap the relevant tests in a block and
use `local`, like in the `query_log` function.

> 			regards, tom lane

- ilmari