pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: David G. Johnston <david.g.johnston@gmail.com>
Cc: Joseph Koshakow <koshy44@gmail.com>
Cc: Tomas Vondra <tomas.vondra@enterprisedb.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Wrong security context for deferred triggers?
Date: Wed, 26 Jun 2024 17:53:02 +0200
Message-ID: <fa0124428f6715143ba01ee669b0591dfe958817.camel@cybertec.at> (raw)
In-Reply-To: <CAKFQuwYsXRUbTphQeWf6u-ZdwV563nnjTVY1j9FoAS+x1BSQLA@mail.gmail.com>
References: <77ee784cf248e842f74588418f55c2931e47bd78.camel@cybertec.at>
	<dede297a-3d24-7029-dfd9-06aeef8b9766@enterprisedb.com>
	<6f27f51bc98354d7254bbde1c171fa13aca03f28.camel@cybertec.at>
	<CAAvxfHeZzH=UeK4euOPC9vHAHh4k0eK09-89vvpY45cGnox4RA@mail.gmail.com>
	<CAKFQuwbJnKm9qSmOpWEebbww4mHw4LLFLMbgZO3sept9veUapg@mail.gmail.com>
	<CAAvxfHcb_Wijv7s6FvqVCeNSDjg+UDNx9MuT=-3ZkMbbwvH=cQ@mail.gmail.com>
	<CAKFQuwaojWrn5TOF6SByzpGmUOC=kY_NHOPp_sp_fBRaosb2-g@mail.gmail.com>
	<8e8ef9739bdcc99d4e58916578a2d0a7b5c4268b.camel@cybertec.at>
	<CAKFQuwYsXRUbTphQeWf6u-ZdwV563nnjTVY1j9FoAS+x1BSQLA@mail.gmail.com>

On Wed, 2024-06-26 at 07:38 -0700, David G. Johnston wrote:
> We have a few choices then:
> 1. Status quo + documentation backpatch
> 2. Change v18 narrowly + documentation backpatch
> 3. Backpatch narrowly (one infers the new behavior after reading the existing documentation)
> 4. Option 1, plus a new v18 owner-execution mode in lieu of the narrow change to fix the POLA violation
> 
> I've been presenting option 4.
> 
> Pondering further, I see now that having the owner-execution mode be the only way to avoid
> the POLA violation in deferred triggers isn't great since many triggers benefit from the
> implied security of being able to run in the invoker's execution context - especially if
> the trigger doesn't do anything that PUBLIC cannot already do.
> 
> So, I'm on board with option 2 at this point.

Nice.

I think we can safely rule out option 3.
Even if it is a bug, it is not one that has bothered anybody so far that a backpatch
is indicated.

Yours,
Laurenz Albe





view thread (44+ messages)  latest in thread

Message-ID: <fa0124428f6715143ba01ee669b0591dfe958817.camel@cybertec.at>
Permalink:  ../fa0124428f6715143ba01ee669b0591dfe958817.camel@cybertec.at/
Also on:    postgresql.org/message-id/fa0124428f6715143ba01ee669b0591dfe958817.camel@cybertec.at

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: laurenz.albe@cybertec.at, david.g.johnston@gmail.com, koshy44@gmail.com, tomas.vondra@enterprisedb.com, pgsql-hackers@lists.postgresql.org
  Subject: Re: Wrong security context for deferred triggers?
  In-Reply-To: <fa0124428f6715143ba01ee669b0591dfe958817.camel@cybertec.at>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox