Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite082734

Browse files
committed
Ban role pg_signal_backend from more superuser backend types.
Documentation says it cannot signal "a backend owned by a superuser".On the contrary, it could signal background workers, including thelogical replication launcher. It could signal autovacuum workers andthe autovacuum launcher. Block all that. Signaling autovacuum workersand those two launchers doesn't stall progress beyond what one couldachieve other ways. If a cluster uses a non-core extension with abackground worker that does not auto-restart, this could create a denialof service with respect to that background worker. A background workerwith bugs in its code for responding to terminations or cancellationscould experience those bugs at a time the pg_signal_backend memberchooses. Back-patch to v11 (all supported versions).Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana andMahendrakar Srinivasarao.Security:CVE-2023-5870
1 parentb29af71 commite082734

File tree

3 files changed

+40
-2
lines changed

3 files changed

+40
-2
lines changed

‎src/backend/utils/adt/misc.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -242,8 +242,13 @@ pg_signal_backend(int pid, int sig)
242242
returnSIGNAL_BACKEND_ERROR;
243243
}
244244

245-
/* Only allow superusers to signal superuser-owned backends. */
246-
if (superuser_arg(proc->roleId)&& !superuser())
245+
/*
246+
* Only allow superusers to signal superuser-owned backends. Any process
247+
* not advertising a role might have the importance of a superuser-owned
248+
* backend, so treat it that way.
249+
*/
250+
if ((!OidIsValid(proc->roleId)||superuser_arg(proc->roleId))&&
251+
!superuser())
247252
returnSIGNAL_BACKEND_NOSUPERUSER;
248253

249254
/* Users can signal backends they have role membership in. */

‎src/test/regress/expected/privileges.out

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1718,6 +1718,24 @@ SELECT * FROM pg_largeobject LIMIT 0;
17181718
SET SESSION AUTHORIZATION regress_priv_user1;
17191719
SELECT * FROM pg_largeobject LIMIT 0;-- to be denied
17201720
ERROR: permission denied for table pg_largeobject
1721+
-- pg_signal_backend can't signal superusers
1722+
RESET SESSION AUTHORIZATION;
1723+
BEGIN;
1724+
CREATE OR REPLACE FUNCTION terminate_nothrow(pid int) RETURNS bool
1725+
LANGUAGE plpgsql SECURITY DEFINER SET client_min_messages = error AS $$
1726+
BEGIN
1727+
RETURN pg_terminate_backend($1);
1728+
EXCEPTION WHEN OTHERS THEN
1729+
RETURN false;
1730+
END$$;
1731+
ALTER FUNCTION terminate_nothrow OWNER TO pg_signal_backend;
1732+
SELECT backend_type FROM pg_stat_activity
1733+
WHERE CASE WHEN COALESCE(usesysid, 10) = 10 THEN terminate_nothrow(pid) END;
1734+
backend_type
1735+
--------------
1736+
(0 rows)
1737+
1738+
ROLLBACK;
17211739
-- test default ACLs
17221740
\c -
17231741
CREATE SCHEMA testns;

‎src/test/regress/sql/privileges.sql

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1053,6 +1053,21 @@ SELECT * FROM pg_largeobject LIMIT 0;
10531053
SET SESSION AUTHORIZATION regress_priv_user1;
10541054
SELECT*FROM pg_largeobjectLIMIT0;-- to be denied
10551055

1056+
-- pg_signal_backend can't signal superusers
1057+
RESET SESSION AUTHORIZATION;
1058+
BEGIN;
1059+
CREATE OR REPLACEFUNCTIONterminate_nothrow(pidint) RETURNS bool
1060+
LANGUAGE plpgsql SECURITY DEFINERSET client_min_messages= errorAS $$
1061+
BEGIN
1062+
RETURN pg_terminate_backend($1);
1063+
EXCEPTION WHEN OTHERS THEN
1064+
RETURN false;
1065+
END$$;
1066+
ALTERFUNCTION terminate_nothrow OWNER TO pg_signal_backend;
1067+
SELECT backend_typeFROM pg_stat_activity
1068+
WHERE CASE WHEN COALESCE(usesysid,10)=10 THEN terminate_nothrow(pid) END;
1069+
ROLLBACK;
1070+
10561071
-- test default ACLs
10571072
\c-
10581073

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp