Message-ID: <8964dda4-3f25-0876-c098-77cede904413@oss.nttdata.com>
Date: Tue, 25 Jan 2022 15:55:49 +0900
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.5.0
Subject: Re: CREATEROLE and role ownership hierarchies
Content-Language: en-US
To: Mark Dilger <mark.dilger@enterprisedb.com>,
 Stephen Frost <sfrost@snowman.net>
Cc: Robert Haas <robertmhaas@gmail.com>, Andrew Dunstan
 <andrew@dunslane.net>, "Bossart, Nathan" <bossartn@amazon.com>,
 Jeff Davis <pgsql@j-davis.com>,
 Joshua Brindle <joshua.brindle@crunchydata.com>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>,
 Shinya Kato <Shinya11.Kato@oss.nttdata.com>
References: <301022EA-01F9-424A-B788-44B6FCF6AB34@enterprisedb.com>
 <20220122212033.GO10577@tamriel.snowman.net>
 <CA+TgmoY0aCi+WBjqQzfa5MV+DHqK9FGNkscvsJnwSPabqzs5nQ@mail.gmail.com>
 <CAOuzzgrG5-GgxLhhjhL67LFRK-g9=K6gtugAM170cqT-55=yQg@mail.gmail.com>
 <CA+Tgmob+1GxGOW48msfp0hiVmYdgZq7+-pn1KXk3Kp+kSR8YVw@mail.gmail.com>
 <CAOuzzgq_j9ycUfQ89G1tr9n+Rs74G==OoNbZWJbAq=mNiArT6w@mail.gmail.com>
 <8043E300-4968-4284-9A3C-84532C8F47BE@enterprisedb.com>
From: Fujii Masao <masao.fujii@oss.nttdata.com>
In-Reply-To: <8043E300-4968-4284-9A3C-84532C8F47BE@enterprisedb.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/8964dda4-3f25-0876-c098-77cede904413%40oss.nttdata.com>
Precedence: bulk


On 2022/01/25 8:18, Mark Dilger wrote:
> 
> 
>> On Jan 24, 2022, at 2:21 PM, Stephen Frost <sfrost@snowman.net> wrote:
>>
>> Superuser is a problem specifically because it gives people access to do absolutely anything, both for security and safety concerns. Disallowing a way to curtail that same risk when it comes to role ownership invites exactly those same problems.
> 
> Before the patch, users with CREATEROLE can do mischief.  After the patch, users with CREATEROLE can do mischief.  The difference is that the mischief that can be done after the patch is a proper subset of the mischief that can be done before the patch.  (Counter-examples highly welcome.)
> 
> Specifically, I claim that before the patch, non-superuser "bob" with CREATEROLE can interfere with *any* non-superuser.  After the patch, non-superuser "bob" with CREATEROLE can interfere with *some* non-superusers; specifically, with non-superusers he created himself, or which have had ownership transferred to him.
> 
> Restricting the scope of bob's mischief is a huge win, in my view.

+1

One of "mischiefs" I'm thinking problematic is that users with CREATEROLE can give any predefined role that they don't have, to other users including themselves. For example, users with CREATEROLE can give pg_execute_server_program to themselves and run any OS commands by COPY PROGRAM. This would be an issue when providing something like PostgreSQL cloud service that wants to prevent end users from running OS commands but allow them to create/drop roles. Does the proposed patch fix also this issue?

Regards,

-- 
Fujii Masao
Advanced Computing Technology Center
Research and Development Headquarters
NTT DATA CORPORATION