Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit48a257d

Browse files
committed
Make ALTER DEFAULT PRIVILEGES require privileges, not membership.
If role A is a direct or indirect member of role B but does not inheritB's privileges (because at least one relevant grant was created WITHINHERIT FALSE) then A should not be permitted to bypass privilegechecks that require the privileges of B. For example, A can't changethe privileges of objects owned by B, nor can A drop those objects.However, up until now, it's been possible for A to change defaultprivileges for role B. That doesn't seem to be correct, because anon-inherited role grant is only supposed to permit you to assumethe identity of the granted role via SET ROLE, and should nototherwise permit you to exercise the privileges of that role. Mostplaces followed that rule, but this case was an exception.This could be construed as a security vulnerability, but it does notseem entirely clear cut, since older branches were fuzzy about thedistinction between is_member_of_role() and has_privs_of_role() ina number of other ways as well. Because of this, and becauseuser-visible behavior changes in minor releases are to be avoidedwhenever possible, no back-patch.Discussion:http://postgr.es/m/CA+TgmobG_YUP06R_PM_2Z7wR0qv_52gQPHD8CYXbJva0cf0E+A@mail.gmail.com
1 parentebfb814 commit48a257d

File tree

1 file changed

+4
-7
lines changed

1 file changed

+4
-7
lines changed

‎src/backend/catalog/aclchk.c

Lines changed: 4 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1117,13 +1117,10 @@ ExecAlterDefaultPrivilegesStmt(ParseState *pstate, AlterDefaultPrivilegesStmt *s
11171117

11181118
iacls.roleid=get_rolespec_oid(rolespec, false);
11191119

1120-
/*
1121-
* We insist that calling user be a member of each target role. If
1122-
* he has that, he could become that role anyway via SET ROLE, so
1123-
* FOR ROLE is just a syntactic convenience and doesn't give any
1124-
* special privileges.
1125-
*/
1126-
check_is_member_of_role(GetUserId(),iacls.roleid);
1120+
if (!has_privs_of_role(GetUserId(),iacls.roleid))
1121+
ereport(ERROR,
1122+
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
1123+
errmsg("permission denied to change default privileges")));
11271124

11281125
SetDefaultACLsInSchemas(&iacls,nspnames);
11291126
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp