MIME-Version: 1.0
From: Pavlo Golub <pavlo.golub@cybertec.at>
Date: Fri, 9 Feb 2024 16:01:58 +0100
Message-ID: <CAK7ymcLmEYWyQkiCZ64WC-HCzXAB0omM=Ypj9B3rXe8vUAFMqw@mail.gmail.com>
Subject: [PATCH] allow pg_current_logfile() execution under pg_monitor role
To: pgsql-hackers <pgsql-hackers@postgresql.org>
Content-Type: multipart/mixed; boundary="00000000000055b5290610f43650"
Archived-At: <https://www.postgresql.org/message-id/CAK7ymcLmEYWyQkiCZ64WC-HCzXAB0omM%3DYpj9B3rXe8vUAFMqw%40mail.gmail.com>
Precedence: bulk

--00000000000055b5290610f43650
Content-Type: multipart/alternative; boundary="00000000000055b5270610f4364e"

--00000000000055b5270610f4364e
Content-Type: text/plain; charset="UTF-8"

Hello,

The patch attached fixes an oversight/inconsistency of disallowing the
pg_monitor system role to execute pg_current_logfile([text]).

pgwatch3=# create user joe;
CREATE ROLE
pgwatch3=# set role joe;
SET
pgwatch3=> select pg_current_logfile();
ERROR:  permission denied for function pg_current_logfile
pgwatch3=> reset role;
RESET
pgwatch3=# grant pg_monitor to joe;
GRANT ROLE
pgwatch3=# set role joe;
SET
pgwatch3=> select pg_current_logfile();
ERROR:  permission denied for function pg_current_logfile
pgwatch3=> select * FROM pg_ls_logdir();
               name               |   size   |      modification
----------------------------------+----------+------------------------
 postgresql-2024-02-08_130906.log |      652 | 2024-02-08 13:10:04+01
(5 rows)

Best regards,
Pavlo Golub

--00000000000055b5270610f4364e
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Hello,</div><div><br></div><div>The patch attached fi=
xes an oversight/inconsistency of disallowing the pg_monitor system role to=
 execute pg_current_logfile([text]). <br><br>pgwatch3=3D# create user joe;<=
br>CREATE ROLE<br>pgwatch3=3D# set role joe;<br>SET<br>pgwatch3=3D&gt; sele=
ct pg_current_logfile();<br>ERROR: =C2=A0permission denied for function pg_=
current_logfile<br>pgwatch3=3D&gt; reset role;<br>RESET<br>pgwatch3=3D# gra=
nt pg_monitor to joe;<br>GRANT ROLE<br>pgwatch3=3D# set role joe;<br>SET<br=
>pgwatch3=3D&gt; select pg_current_logfile();<br>ERROR: =C2=A0permission de=
nied for function pg_current_logfile<br>pgwatch3=3D&gt; select * FROM pg_ls=
_logdir();<br>=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0name =
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 | =C2=A0 size =C2=A0 | =C2=
=A0 =C2=A0 =C2=A0modification<br>----------------------------------+-------=
---+------------------------<br>=C2=A0postgresql-2024-02-08_130906.log | =
=C2=A0 =C2=A0 =C2=A0652 | 2024-02-08 13:10:04+01<br>(5 rows)</div><div><br>=
</div><div>Best regards,<br></div><div>Pavlo Golub<br></div></div>

--00000000000055b5270610f4364e--
--00000000000055b5290610f43650
Content-Type: application/octet-stream; 
	name="0001-allow-pg_current_logfile-execution-under-pg_monitor-.patch"
Content-Disposition: attachment; 
	filename="0001-allow-pg_current_logfile-execution-under-pg_monitor-.patch"
Content-Transfer-Encoding: base64
Content-ID: <f_lservwky0>
X-Attachment-Id: f_lservwky0

RnJvbSA5MTQyY2ZkMmM5YzdhMjFhN2I3M2E0Yzg1ZmY2NjJkYWRlM2M0MWUyIE1vbiBTZXAgMTcg
MDA6MDA6MDAgMjAwMQpGcm9tOiBQYXZsbyBHb2x1YiA8cGF2bG8uZ29sdWJAZ21haWwuY29tPgpE
YXRlOiBGcmksIDkgRmViIDIwMjQgMTU6NDI6NDMgKzAxMDAKU3ViamVjdDogW1BBVENIXSBhbGxv
dyBwZ19jdXJyZW50X2xvZ2ZpbGUoKSBleGVjdXRpb24gdW5kZXIgcGdfbW9uaXRvciByb2xlCgot
LS0KIHNyYy9iYWNrZW5kL2NhdGFsb2cvc3lzdGVtX2Z1bmN0aW9ucy5zcWwgfCA0ICsrKysKIDEg
ZmlsZSBjaGFuZ2VkLCA0IGluc2VydGlvbnMoKykKCmRpZmYgLS1naXQgYS9zcmMvYmFja2VuZC9j
YXRhbG9nL3N5c3RlbV9mdW5jdGlvbnMuc3FsIGIvc3JjL2JhY2tlbmQvY2F0YWxvZy9zeXN0ZW1f
ZnVuY3Rpb25zLnNxbAppbmRleCAzNDZjZmI5OGEwLi4zN2I4OTc3NjcwIDEwMDY0NAotLS0gYS9z
cmMvYmFja2VuZC9jYXRhbG9nL3N5c3RlbV9mdW5jdGlvbnMuc3FsCisrKyBiL3NyYy9iYWNrZW5k
L2NhdGFsb2cvc3lzdGVtX2Z1bmN0aW9ucy5zcWwKQEAgLTc2MSw2ICs3NjEsMTAgQEAgUkVWT0tF
IEVYRUNVVEUgT04gRlVOQ1RJT04gcGdfbHNfcmVwbHNsb3RkaXIodGV4dCkgRlJPTSBQVUJMSUM7
CiAtLSBXZSBhbHNvIHNldCB1cCBzb21lIHRoaW5ncyBhcyBhY2Nlc3NpYmxlIHRvIHN0YW5kYXJk
IHJvbGVzLgogLS0KIAorR1JBTlQgRVhFQ1VURSBPTiBGVU5DVElPTiBwZ19jdXJyZW50X2xvZ2Zp
bGUoKSBUTyBwZ19tb25pdG9yOworCitHUkFOVCBFWEVDVVRFIE9OIEZVTkNUSU9OIHBnX2N1cnJl
bnRfbG9nZmlsZSh0ZXh0KSBUTyBwZ19tb25pdG9yOworCiBHUkFOVCBFWEVDVVRFIE9OIEZVTkNU
SU9OIHBnX2xzX2xvZ2RpcigpIFRPIHBnX21vbml0b3I7CiAKIEdSQU5UIEVYRUNVVEUgT04gRlVO
Q1RJT04gcGdfbHNfd2FsZGlyKCkgVE8gcGdfbW9uaXRvcjsKLS0gCjIuMzQuMQoK
--00000000000055b5290610f43650--