Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2893f2f

Browse files
committed
Ban role pg_signal_backend from more superuser backend types.
Documentation says it cannot signal "a backend owned by a superuser".On the contrary, it could signal background workers, including thelogical replication launcher. It could signal autovacuum workers andthe autovacuum launcher. Block all that. Signaling autovacuum workersand those two launchers doesn't stall progress beyond what one couldachieve other ways. If a cluster uses a non-core extension with abackground worker that does not auto-restart, this could create a denialof service with respect to that background worker. A background workerwith bugs in its code for responding to terminations or cancellationscould experience those bugs at a time the pg_signal_backend memberchooses. Back-patch to v11 (all supported versions).Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana andMahendrakar Srinivasarao.Security:CVE-2023-5870
1 parent1cfa442 commit2893f2f

File tree

3 files changed

+40
-2
lines changed

3 files changed

+40
-2
lines changed

‎src/backend/storage/ipc/signalfuncs.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,13 @@ pg_signal_backend(int pid, int sig)
6868
returnSIGNAL_BACKEND_ERROR;
6969
}
7070

71-
/* Only allow superusers to signal superuser-owned backends. */
72-
if (superuser_arg(proc->roleId)&& !superuser())
71+
/*
72+
* Only allow superusers to signal superuser-owned backends. Any process
73+
* not advertising a role might have the importance of a superuser-owned
74+
* backend, so treat it that way.
75+
*/
76+
if ((!OidIsValid(proc->roleId)||superuser_arg(proc->roleId))&&
77+
!superuser())
7378
returnSIGNAL_BACKEND_NOSUPERUSER;
7479

7580
/* Users can signal backends they have role membership in. */

‎src/test/regress/expected/privileges.out

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1713,6 +1713,24 @@ SELECT * FROM pg_largeobject LIMIT 0;
17131713
SET SESSION AUTHORIZATION regress_priv_user1;
17141714
SELECT * FROM pg_largeobject LIMIT 0;-- to be denied
17151715
ERROR: permission denied for table pg_largeobject
1716+
-- pg_signal_backend can't signal superusers
1717+
RESET SESSION AUTHORIZATION;
1718+
BEGIN;
1719+
CREATE OR REPLACE FUNCTION terminate_nothrow(pid int) RETURNS bool
1720+
LANGUAGE plpgsql SECURITY DEFINER SET client_min_messages = error AS $$
1721+
BEGIN
1722+
RETURN pg_terminate_backend($1);
1723+
EXCEPTION WHEN OTHERS THEN
1724+
RETURN false;
1725+
END$$;
1726+
ALTER FUNCTION terminate_nothrow OWNER TO pg_signal_backend;
1727+
SELECT backend_type FROM pg_stat_activity
1728+
WHERE CASE WHEN COALESCE(usesysid, 10) = 10 THEN terminate_nothrow(pid) END;
1729+
backend_type
1730+
--------------
1731+
(0 rows)
1732+
1733+
ROLLBACK;
17161734
-- test default ACLs
17171735
\c -
17181736
CREATE SCHEMA testns;

‎src/test/regress/sql/privileges.sql

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1053,6 +1053,21 @@ SELECT * FROM pg_largeobject LIMIT 0;
10531053
SET SESSION AUTHORIZATION regress_priv_user1;
10541054
SELECT*FROM pg_largeobjectLIMIT0;-- to be denied
10551055

1056+
-- pg_signal_backend can't signal superusers
1057+
RESET SESSION AUTHORIZATION;
1058+
BEGIN;
1059+
CREATE OR REPLACEFUNCTIONterminate_nothrow(pidint) RETURNS bool
1060+
LANGUAGE plpgsql SECURITY DEFINERSET client_min_messages= errorAS $$
1061+
BEGIN
1062+
RETURN pg_terminate_backend($1);
1063+
EXCEPTION WHEN OTHERS THEN
1064+
RETURN false;
1065+
END$$;
1066+
ALTERFUNCTION terminate_nothrow OWNER TO pg_signal_backend;
1067+
SELECT backend_typeFROM pg_stat_activity
1068+
WHERE CASE WHEN COALESCE(usesysid,10)=10 THEN terminate_nothrow(pid) END;
1069+
ROLLBACK;
1070+
10561071
-- test default ACLs
10571072
\c-
10581073

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp