Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6b87d42

Browse files
committed
Lock down regression testing temporary clusters on Windows.
Use SSPI authentication to allow connections exclusively from the OSuser that launched the test suite. This closes on Windows thevulnerability that commitbe76a6dclosed on other platforms. Users of "make installcheck" or custom testharnesses can run "pg_regress --config-auth=DATADIR" to activate thesame authentication configuration that "make check" would use.Back-patch to 9.0 (all supported versions).Security:CVE-2014-0067
1 parent3f63b38 commit6b87d42

File tree

11 files changed

+213
-28
lines changed

11 files changed

+213
-28
lines changed

‎contrib/dblink/Makefile

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@ EXTENSION = dblink
99
DATA = dblink--1.1.sql dblink--1.0--1.1.sql dblink--unpackaged--1.0.sql
1010

1111
REGRESS = paths dblink
12-
REGRESS_OPTS = --dlpath=$(top_builddir)/src/test/regress
12+
REGRESS_OPTS = --dlpath=$(top_builddir)/src/test/regress\
13+
--create-role=dblink_regression_test
1314
EXTRA_CLEAN = sql/paths.sql expected/paths.out
1415

1516
# the db name is hard-coded in the tests

‎contrib/dblink/expected/dblink.out

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -809,7 +809,6 @@ SELECT dblink_disconnect('dtest1');
809809
(1 row)
810810

811811
-- test foreign data wrapper functionality
812-
CREATE USER dblink_regression_test;
813812
CREATE SERVER fdtest FOREIGN DATA WRAPPER dblink_fdw
814813
OPTIONS (dbname 'contrib_regression');
815814
CREATE USER MAPPING FOR public SERVER fdtest
@@ -851,7 +850,6 @@ SELECT * FROM dblink('myconn','SELECT * FROM foo') AS t(a int, b text, c text[])
851850
\c - :ORIGINAL_USER
852851
REVOKE USAGE ON FOREIGN SERVER fdtest FROM dblink_regression_test;
853852
REVOKE EXECUTE ON FUNCTION dblink_connect_u(text, text) FROM dblink_regression_test;
854-
DROP USER dblink_regression_test;
855853
DROP USER MAPPING FOR public SERVER fdtest;
856854
DROP SERVER fdtest;
857855
-- test asynchronous notifications

‎contrib/dblink/sql/dblink.sql

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -387,7 +387,6 @@ SELECT dblink_error_message('dtest1');
387387
SELECT dblink_disconnect('dtest1');
388388

389389
-- test foreign data wrapper functionality
390-
CREATEUSERdblink_regression_test;
391390
CREATE SERVER fdtest FOREIGN DATA WRAPPER dblink_fdw
392391
OPTIONS (dbname'contrib_regression');
393392
CREATEUSERMAPPING FOR public SERVER fdtest
@@ -408,7 +407,6 @@ SELECT * FROM dblink('myconn','SELECT * FROM foo') AS t(a int, b text, c text[])
408407
\c- :ORIGINAL_USER
409408
REVOKE USAGEON FOREIGN SERVER fdtestFROM dblink_regression_test;
410409
REVOKE EXECUTEON FUNCTION dblink_connect_u(text,text)FROM dblink_regression_test;
411-
DROPUSER dblink_regression_test;
412410
DROPUSER MAPPING FOR public SERVER fdtest;
413411
DROP SERVER fdtest;
414412

‎contrib/pg_upgrade/test.sh

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,20 @@ set -e
1717
unset MAKEFLAGS
1818
unset MAKELEVEL
1919

20+
# Run a given "initdb" binary and overlay the regression testing
21+
# authentication configuration.
22+
standard_initdb() {
23+
"$1" -N
24+
../../src/test/regress/pg_regress --config-auth"$PGDATA"
25+
}
26+
2027
# Establish how the server will listen for connections
2128
testhost=`uname -s`
2229

2330
case$testhostin
2431
MINGW*)
2532
LISTEN_ADDRESSES="localhost"
26-
PGHOST="";unset PGHOST
33+
PGHOST=localhost
2734
;;
2835
*)
2936
LISTEN_ADDRESSES=""
@@ -49,11 +56,11 @@ case $testhost in
4956
trap'rm -rf "$PGHOST"' 0
5057
trap'exit 3' 1 2 13 15
5158
fi
52-
export PGHOST
5359
;;
5460
esac
5561

5662
POSTMASTER_OPTS="-F -c listen_addresses=$LISTEN_ADDRESSES -k\"$PGHOST\""
63+
export PGHOST
5764

5865
temp_root=$PWD/tmp_check
5966

@@ -141,7 +148,7 @@ export EXTRA_REGRESS_OPTS
141148
# enable echo so the user can see what is being executed
142149
set -x
143150

144-
$oldbindir/initdb -N
151+
standard_initdb"$oldbindir"/initdb
145152
$oldbindir/pg_ctl start -l"$logdir/postmaster1.log" -o"$POSTMASTER_OPTS" -w
146153
if"$MAKE" -C"$oldsrc" installcheck;then
147154
pg_dumpall -f"$temp_root"/dump1.sql|| pg_dumpall1_status=$?
@@ -181,7 +188,7 @@ fi
181188

182189
PGDATA=$BASE_PGDATA
183190

184-
initdb -N
191+
standard_initdb'initdb'
185192

186193
pg_upgrade$PG_UPGRADE_OPTS -d"${PGDATA}.old" -D"${PGDATA}" -b"$oldbindir" -B"$bindir" -p"$PGPORT" -P"$PGPORT"
187194

‎doc/src/sgml/regress.sgml

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -56,19 +56,6 @@ make check
5656
<quote>failure</> represents a serious problem.
5757
</para>
5858

59-
<warning>
60-
<para>
61-
On systems lacking Unix-domain sockets, notably Windows, this test method
62-
starts a temporary server configured to accept any connection originating
63-
on the local machine. Any local user can gain database superuser
64-
privileges when connecting to this server, and could in principle exploit
65-
all privileges of the operating-system user running the tests. Therefore,
66-
it is not recommended that you use <literal>make check</> on an affected
67-
system shared with untrusted users. Instead, run the tests after
68-
completing the installation, as described in the next section.
69-
</para>
70-
</warning>
71-
7259
<para>
7360
Because this test method runs a temporary server, it will not work
7461
if you did the build as the root user, since the server will not start as

‎src/Makefile.global.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -323,7 +323,7 @@ endef
323323
defineprove_check
324324
$(MKDIR_P) tmp_check/log
325325
$(MAKE) -C$(top_builddir) DESTDIR='$(CURDIR)'/tmp_check/install install >'$(CURDIR)'/tmp_check/log/install.log 2>&1
326-
cd$(srcdir) && TESTDIR='$(CURDIR)' PATH="$(CURDIR)/tmp_check/install$(bindir):$$PATH"$(call add_to_path,$(ld_library_path_var),$(CURDIR)/tmp_check/install$(libdir)) PGPORT='6$(DEF_PGPORT)'$(PROVE)$(PG_PROVE_FLAGS)$(PROVE_FLAGS) t/*.pl
326+
cd$(srcdir) && TESTDIR='$(CURDIR)' PATH="$(CURDIR)/tmp_check/install$(bindir):$$PATH"$(call add_to_path,$(ld_library_path_var),$(CURDIR)/tmp_check/install$(libdir))top_srcdir='$(top_srcdir)'PGPORT='6$(DEF_PGPORT)'$(PROVE)$(PG_PROVE_FLAGS)$(PROVE_FLAGS) t/*.pl
327327
endef
328328

329329
else

‎src/bin/pg_ctl/t/001_start_stop.pl

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
use strict;
22
use warnings;
33
use TestLib;
4-
use Test::Moretests=>15;
4+
use Test::Moretests=>16;
55

66
my$tempdir = TestLib::tempdir;
77
my$tempdir_short = TestLib::tempdir_short;
@@ -11,6 +11,10 @@
1111
program_options_handling_ok('pg_ctl');
1212

1313
command_ok(['pg_ctl','initdb','-D',"$tempdir/data" ],'pg_ctl initdb');
14+
command_ok(
15+
["$ENV{top_srcdir}/src/test/regress/pg_regress",'--config-auth',
16+
"$tempdir/data" ],
17+
'configure authentication');
1418
open CONF,">>$tempdir/data/postgresql.conf";
1519
print CONF"listen_addresses = ''\n";
1620
print CONF"unix_socket_directories = '$tempdir_short'\n";

‎src/bin/pg_ctl/t/002_status.pl

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
my$tempdir = TestLib::tempdir;
77
my$tempdir_short = TestLib::tempdir_short;
88

9-
system_or_bail"initdb -D '$tempdir'/data -A trust >/dev/null";
9+
standard_initdb"$tempdir/data";
1010
open CONF,">>$tempdir/data/postgresql.conf";
1111
print CONF"listen_addresses = ''\n";
1212
print CONF"unix_socket_directories = '$tempdir_short'\n";

‎src/test/perl/TestLib.pm

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ use Exporter 'import';
77
our@EXPORT =qw(
88
tempdir
99
tempdir_short
10+
standard_initdb
1011
start_test_server
1112
restart_test_server
1213
psql
@@ -69,6 +70,14 @@ sub tempdir_short
6970
return File::Temp::tempdir(CLEANUP=> 1);
7071
}
7172

73+
substandard_initdb
74+
{
75+
my$pgdata =shift;
76+
system_or_bail("initdb -D '$pgdata' -A trust -N >/dev/null");
77+
system_or_bail("$ENV{top_srcdir}/src/test/regress/pg_regress",
78+
'--config-auth',$pgdata);
79+
}
80+
7281
my ($test_server_datadir,$test_server_logfile);
7382

7483
substart_test_server
@@ -78,7 +87,7 @@ sub start_test_server
7887

7988
my$tempdir_short = tempdir_short;
8089

81-
system"initdb -D '$tempdir'/pgdata -A trust -N >/dev/null";
90+
standard_initdb"$tempdir/pgdata";
8291
$ret =system'pg_ctl','-D',"$tempdir/pgdata",'-s','-w','-l',
8392
"$tempdir/logfile",'-o',
8493
"--fsync=off -k$tempdir_short --listen-addresses='' --log-statement=all",

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp