public inbox for [email protected]  

help / color / mirror / Atom feed

From: Andrew Gierth <[email protected]>
To: [email protected]
Subject: Re: [Pljava-dev] Should creating a new base type require superuser status?
Date: Sat, 02 Aug 2008 00:51:47 +0100
Message-ID: <[email protected]> (raw)
References: <[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>

>>>>> "Tom" == Tom Lane <[email protected]> writes:

 >> Tom, could you please elaborate where you see a security hole?

 Tom> The problem that we've seen in the past shows up when the user
 Tom> lies in the CREATE TYPE command, specifying type representation
 Tom> properties that are different from what the underlying functions
 Tom> expect.  In particular, if it's possible to pass a pass-by-value
 Tom> integer to a function that's expecting a pass-by-reference
 Tom> datum, you can misuse the function to access backend memory.

It strikes me that type output functions are routinely invoked by
superusers (e.g. during pg_dump), and therefore if a non-superuser can
create a type, that seems to imply that there's no way for a superuser
to safely examine or dump the content of the database without risking
the execution of untrusted code, correct?

-- 
Andrew (irc:RhodiumToad)

view thread (21+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected]
  Subject: Re: [Pljava-dev] Should creating a new base type require superuser status?
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox