Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitab3f008

Browse files
committed
postgres_fdw: Judge password use by run-as user, not session user.
This is a backward incompatibility which should be noted in therelease notes for PostgreSQL 11.For security reasons, we require that a postgres_fdw foreign table usepassword authentication when accessing a remote server, so that anunprivileged user cannot usurp the server's credentials. Superusersare exempt from this requirement, because we assume they are entitledto usurp the server's credentials or, at least, can find some otherway to do it.But what should happen when the foreign table is accessed by a viewowned by a user different from the session user? Is it the view ownerthat must be a superuser in order to avoid the requirement of using apassword, or the session user? Historically it was the latter, butthis requirement makes it the former instead. This allows superusersto delegate to other users the right to select from a foreign tablethat doesn't use password authentication by creating a view over theforeign table and handing out rights to the view. It is also moreconsistent with the idea that access to a view should use the viewowner's privileges rather than the session user's privileges.The upshot of this change is that a superuser selecting from a viewcreated by a non-superuser may now get an error complaining that nopassword was used, while a non-superuser selecting from a viewcreated by a superuser will no longer receive such an error.No documentation changes are present in this patch because thewording of the documentation already suggests that it works thisway. We should perhaps adjust the documentation in the back-branches,but that's a task for another patch.Originally proposed by Jeff Janes, but with different semantics;adjusted to work like this by me per discussion.Discussion:http://postgr.es/m/CA+TgmoaY4HsVZJv5SqEjCKLDwtCTSwXzKpRftgj50wmMMBwciA@mail.gmail.com
1 parentc572599 commitab3f008

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

‎contrib/postgres_fdw/connection.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,7 +75,7 @@ static bool xact_got_connection = false;
7575
/* prototypes of private functions */
7676
staticPGconn*connect_pg_server(ForeignServer*server,UserMapping*user);
7777
staticvoiddisconnect_pg_server(ConnCacheEntry*entry);
78-
staticvoidcheck_conn_params(constchar**keywords,constchar**values);
78+
staticvoidcheck_conn_params(constchar**keywords,constchar**values,UserMapping*user);
7979
staticvoidconfigure_remote_session(PGconn*conn);
8080
staticvoiddo_sql_command(PGconn*conn,constchar*sql);
8181
staticvoidbegin_remote_xact(ConnCacheEntry*entry);
@@ -261,7 +261,7 @@ connect_pg_server(ForeignServer *server, UserMapping *user)
261261
keywords[n]=values[n]=NULL;
262262

263263
/* verify connection parameters and make connection */
264-
check_conn_params(keywords,values);
264+
check_conn_params(keywords,values,user);
265265

266266
conn=PQconnectdbParams(keywords,values, false);
267267
if (!conn||PQstatus(conn)!=CONNECTION_OK)
@@ -276,7 +276,7 @@ connect_pg_server(ForeignServer *server, UserMapping *user)
276276
* otherwise, he's piggybacking on the postgres server's user
277277
* identity. See also dblink_security_check() in contrib/dblink.
278278
*/
279-
if (!superuser()&& !PQconnectionUsedPassword(conn))
279+
if (!superuser_arg(user->userid)&& !PQconnectionUsedPassword(conn))
280280
ereport(ERROR,
281281
(errcode(ERRCODE_S_R_E_PROHIBITED_SQL_STATEMENT_ATTEMPTED),
282282
errmsg("password is required"),
@@ -322,12 +322,12 @@ disconnect_pg_server(ConnCacheEntry *entry)
322322
* contrib/dblink.)
323323
*/
324324
staticvoid
325-
check_conn_params(constchar**keywords,constchar**values)
325+
check_conn_params(constchar**keywords,constchar**values,UserMapping*user)
326326
{
327327
inti;
328328

329329
/* no check required if superuser */
330-
if (superuser())
330+
if (superuser_arg(user->userid))
331331
return;
332332

333333
/* ok if params contain a non-empty password */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp