Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit28b6095

Browse files
committed
Ban role pg_signal_backend from more superuser backend types.
Documentation says it cannot signal "a backend owned by a superuser".On the contrary, it could signal background workers, including thelogical replication launcher. It could signal autovacuum workers andthe autovacuum launcher. Block all that. Signaling autovacuum workersand those two launchers doesn't stall progress beyond what one couldachieve other ways. If a cluster uses a non-core extension with abackground worker that does not auto-restart, this could create a denialof service with respect to that background worker. A background workerwith bugs in its code for responding to terminations or cancellationscould experience those bugs at a time the pg_signal_backend memberchooses. Back-patch to v11 (all supported versions).Reviewed by Jelte Fennema-Nio. Reported by Hemanth Sandrana andMahendrakar Srinivasarao.Security:CVE-2023-5870
1 parent0f1f389 commit28b6095

File tree

3 files changed

+40
-2
lines changed

3 files changed

+40
-2
lines changed

‎src/backend/storage/ipc/signalfuncs.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -68,8 +68,13 @@ pg_signal_backend(int pid, int sig)
6868
returnSIGNAL_BACKEND_ERROR;
6969
}
7070

71-
/* Only allow superusers to signal superuser-owned backends. */
72-
if (superuser_arg(proc->roleId)&& !superuser())
71+
/*
72+
* Only allow superusers to signal superuser-owned backends. Any process
73+
* not advertising a role might have the importance of a superuser-owned
74+
* backend, so treat it that way.
75+
*/
76+
if ((!OidIsValid(proc->roleId)||superuser_arg(proc->roleId))&&
77+
!superuser())
7378
returnSIGNAL_BACKEND_NOSUPERUSER;
7479

7580
/* Users can signal backends they have role membership in. */

‎src/test/regress/expected/privileges.out

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1793,6 +1793,24 @@ SELECT * FROM pg_largeobject LIMIT 0;
17931793
SET SESSION AUTHORIZATION regress_priv_user1;
17941794
SELECT * FROM pg_largeobject LIMIT 0;-- to be denied
17951795
ERROR: permission denied for table pg_largeobject
1796+
-- pg_signal_backend can't signal superusers
1797+
RESET SESSION AUTHORIZATION;
1798+
BEGIN;
1799+
CREATE OR REPLACE FUNCTION terminate_nothrow(pid int) RETURNS bool
1800+
LANGUAGE plpgsql SECURITY DEFINER SET client_min_messages = error AS $$
1801+
BEGIN
1802+
RETURN pg_terminate_backend($1);
1803+
EXCEPTION WHEN OTHERS THEN
1804+
RETURN false;
1805+
END$$;
1806+
ALTER FUNCTION terminate_nothrow OWNER TO pg_signal_backend;
1807+
SELECT backend_type FROM pg_stat_activity
1808+
WHERE CASE WHEN COALESCE(usesysid, 10) = 10 THEN terminate_nothrow(pid) END;
1809+
backend_type
1810+
--------------
1811+
(0 rows)
1812+
1813+
ROLLBACK;
17961814
-- test default ACLs
17971815
\c -
17981816
CREATE SCHEMA testns;

‎src/test/regress/sql/privileges.sql

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1099,6 +1099,21 @@ SELECT * FROM pg_largeobject LIMIT 0;
10991099
SET SESSION AUTHORIZATION regress_priv_user1;
11001100
SELECT*FROM pg_largeobjectLIMIT0;-- to be denied
11011101

1102+
-- pg_signal_backend can't signal superusers
1103+
RESET SESSION AUTHORIZATION;
1104+
BEGIN;
1105+
CREATE OR REPLACEFUNCTIONterminate_nothrow(pidint) RETURNS bool
1106+
LANGUAGE plpgsql SECURITY DEFINERSET client_min_messages= errorAS $$
1107+
BEGIN
1108+
RETURN pg_terminate_backend($1);
1109+
EXCEPTION WHEN OTHERS THEN
1110+
RETURN false;
1111+
END$$;
1112+
ALTERFUNCTION terminate_nothrow OWNER TO pg_signal_backend;
1113+
SELECT backend_typeFROM pg_stat_activity
1114+
WHERE CASE WHEN COALESCE(usesysid,10)=10 THEN terminate_nothrow(pid) END;
1115+
ROLLBACK;
1116+
11021117
-- test default ACLs
11031118
\c-
11041119

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp