Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit537cbd3

Browse files
committed
Prevent privilege escalation in explicit calls to PL validators.
The primary role of PL validators is to be called implicitly duringCREATE FUNCTION, but they are also normal functions that a user can callexplicitly. Add a permissions check to each validator to ensure that auser cannot use explicit validator calls to achieve things he could nototherwise achieve. Back-patch to 8.4 (all supported versions).Non-core procedural language extensions ought to make the same two-linechange to their own validators.Andres Freund, reviewed by Tom Lane and Noah Misch.Security:CVE-2014-0061
1 parentfea164a commit537cbd3

File tree

8 files changed

+109
-2
lines changed

8 files changed

+109
-2
lines changed

‎doc/src/sgml/plhandler.sgml‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,10 @@ CREATE LANGUAGE plsample
178178
or updated a function written in the procedural language.
179179
The passed-in OID is the OID of the function's <classname>pg_proc</>
180180
row. The validator must fetch this row in the usual way, and do
181-
whatever checking is appropriate. Typical checks include verifying
181+
whatever checking is appropriate.
182+
First, call <function>CheckFunctionValidatorAccess()</> to diagnose
183+
explicit calls to the validator that the user could not achieve through
184+
<command>CREATE FUNCTION</>. Typical checks then include verifying
182185
that the function's argument and result types are supported by the
183186
language, and that the function's body is syntactically correct
184187
in the language. If the validator finds the function to be okay,

‎src/backend/catalog/pg_proc.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -723,6 +723,9 @@ fmgr_internal_validator(PG_FUNCTION_ARGS)
723723
Datumtmp;
724724
char*prosrc;
725725

726+
if (!CheckFunctionValidatorAccess(fcinfo->flinfo->fn_oid,funcoid))
727+
PG_RETURN_VOID();
728+
726729
/*
727730
* We do not honor check_function_bodies since it's unlikely the function
728731
* name will be found later if it isn't there now.
@@ -768,6 +771,9 @@ fmgr_c_validator(PG_FUNCTION_ARGS)
768771
char*prosrc;
769772
char*probin;
770773

774+
if (!CheckFunctionValidatorAccess(fcinfo->flinfo->fn_oid,funcoid))
775+
PG_RETURN_VOID();
776+
771777
/*
772778
* It'd be most consistent to skip the check if !check_function_bodies,
773779
* but the purpose of that switch is to be helpful for pg_dump loading,
@@ -819,6 +825,9 @@ fmgr_sql_validator(PG_FUNCTION_ARGS)
819825
boolhaspolyarg;
820826
inti;
821827

828+
if (!CheckFunctionValidatorAccess(fcinfo->flinfo->fn_oid,funcoid))
829+
PG_RETURN_VOID();
830+
822831
tuple=SearchSysCache1(PROCOID,ObjectIdGetDatum(funcoid));
823832
if (!HeapTupleIsValid(tuple))
824833
elog(ERROR,"cache lookup failed for function %u",funcoid);

‎src/backend/commands/functioncmds.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1017,7 +1017,6 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString)
10171017
prorows);
10181018
}
10191019

1020-
10211020
/*
10221021
* Guts of function deletion.
10231022
*

‎src/backend/utils/fmgr/fmgr.c‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
#include"miscadmin.h"
2525
#include"nodes/nodeFuncs.h"
2626
#include"pgstat.h"
27+
#include"utils/acl.h"
2728
#include"utils/builtins.h"
2829
#include"utils/fmgrtab.h"
2930
#include"utils/guc.h"
@@ -2468,3 +2469,86 @@ get_fn_expr_variadic(FmgrInfo *flinfo)
24682469
else
24692470
return false;
24702471
}
2472+
2473+
/*-------------------------------------------------------------------------
2474+
*Support routines for procedural language implementations
2475+
*-------------------------------------------------------------------------
2476+
*/
2477+
2478+
/*
2479+
* Verify that a validator is actually associated with the language of a
2480+
* particular function and that the user has access to both the language and
2481+
* the function. All validators should call this before doing anything
2482+
* substantial. Doing so ensures a user cannot achieve anything with explicit
2483+
* calls to validators that he could not achieve with CREATE FUNCTION or by
2484+
* simply calling an existing function.
2485+
*
2486+
* When this function returns false, callers should skip all validation work
2487+
* and call PG_RETURN_VOID(). This never happens at present; it is reserved
2488+
* for future expansion.
2489+
*
2490+
* In particular, checking that the validator corresponds to the function's
2491+
* language allows untrusted language validators to assume they process only
2492+
* superuser-chosen source code. (Untrusted language call handlers, by
2493+
* definition, do assume that.) A user lacking the USAGE language privilege
2494+
* would be unable to reach the validator through CREATE FUNCTION, so we check
2495+
* that to block explicit calls as well. Checking the EXECUTE privilege on
2496+
* the function is often superfluous, because most users can clone the
2497+
* function to get an executable copy. It is meaningful against users with no
2498+
* database TEMP right and no permanent schema CREATE right, thereby unable to
2499+
* create any function. Also, if the function tracks persistent state by
2500+
* function OID or name, validating the original function might permit more
2501+
* mischief than creating and validating a clone thereof.
2502+
*/
2503+
bool
2504+
CheckFunctionValidatorAccess(OidvalidatorOid,OidfunctionOid)
2505+
{
2506+
HeapTupleprocTup;
2507+
HeapTuplelangTup;
2508+
Form_pg_procprocStruct;
2509+
Form_pg_languagelangStruct;
2510+
AclResultaclresult;
2511+
2512+
/* Get the function's pg_proc entry */
2513+
procTup=SearchSysCache1(PROCOID,ObjectIdGetDatum(functionOid));
2514+
if (!HeapTupleIsValid(procTup))
2515+
elog(ERROR,"cache lookup failed for function %u",functionOid);
2516+
procStruct= (Form_pg_proc)GETSTRUCT(procTup);
2517+
2518+
/*
2519+
* Fetch pg_language entry to know if this is the correct validation
2520+
* function for that pg_proc entry.
2521+
*/
2522+
langTup=SearchSysCache1(LANGOID,ObjectIdGetDatum(procStruct->prolang));
2523+
if (!HeapTupleIsValid(langTup))
2524+
elog(ERROR,"cache lookup failed for language %u",procStruct->prolang);
2525+
langStruct= (Form_pg_language)GETSTRUCT(langTup);
2526+
2527+
if (langStruct->lanvalidator!=validatorOid)
2528+
ereport(ERROR,
2529+
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
2530+
errmsg("language validation function %u called for language %u instead of %u",
2531+
validatorOid,procStruct->prolang,
2532+
langStruct->lanvalidator)));
2533+
2534+
/* first validate that we have permissions to use the language */
2535+
aclresult=pg_language_aclcheck(procStruct->prolang,GetUserId(),
2536+
ACL_USAGE);
2537+
if (aclresult!=ACLCHECK_OK)
2538+
aclcheck_error(aclresult,ACL_KIND_LANGUAGE,
2539+
NameStr(langStruct->lanname));
2540+
2541+
/*
2542+
* Check whether we are allowed to execute the function itself. If we can
2543+
* execute it, there should be no possible side-effect of
2544+
* compiling/validation that execution can't have.
2545+
*/
2546+
aclresult=pg_proc_aclcheck(functionOid,GetUserId(),ACL_EXECUTE);
2547+
if (aclresult!=ACLCHECK_OK)
2548+
aclcheck_error(aclresult,ACL_KIND_PROC,NameStr(procStruct->proname));
2549+
2550+
ReleaseSysCache(procTup);
2551+
ReleaseSysCache(langTup);
2552+
2553+
return true;
2554+
}

‎src/include/fmgr.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -629,6 +629,7 @@ extern Oidget_call_expr_argtype(fmNodePtr expr, int argnum);
629629
externboolget_fn_expr_arg_stable(FmgrInfo*flinfo,intargnum);
630630
externboolget_call_expr_arg_stable(fmNodePtrexpr,intargnum);
631631
externboolget_fn_expr_variadic(FmgrInfo*flinfo);
632+
externboolCheckFunctionValidatorAccess(OidvalidatorOid,OidfunctionOid);
632633

633634
/*
634635
* Routines in dfmgr.c

‎src/pl/plperl/plperl.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1883,6 +1883,9 @@ plperl_validator(PG_FUNCTION_ARGS)
18831883
boolis_event_trigger= false;
18841884
inti;
18851885

1886+
if (!CheckFunctionValidatorAccess(fcinfo->flinfo->fn_oid,funcoid))
1887+
PG_RETURN_VOID();
1888+
18861889
/* Get the new function's pg_proc entry */
18871890
tuple=SearchSysCache1(PROCOID,ObjectIdGetDatum(funcoid));
18881891
if (!HeapTupleIsValid(tuple))
@@ -1964,6 +1967,7 @@ PG_FUNCTION_INFO_V1(plperlu_validator);
19641967
Datum
19651968
plperlu_validator(PG_FUNCTION_ARGS)
19661969
{
1970+
/* call plperl validator with our fcinfo so it gets our oid */
19671971
returnplperl_validator(fcinfo);
19681972
}
19691973

‎src/pl/plpgsql/src/pl_handler.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -290,6 +290,9 @@ plpgsql_validator(PG_FUNCTION_ARGS)
290290
boolis_event_trigger= false;
291291
inti;
292292

293+
if (!CheckFunctionValidatorAccess(fcinfo->flinfo->fn_oid,funcoid))
294+
PG_RETURN_VOID();
295+
293296
/* Get the new function's pg_proc entry */
294297
tuple=SearchSysCache1(PROCOID,ObjectIdGetDatum(funcoid));
295298
if (!HeapTupleIsValid(tuple))

‎src/pl/plpython/plpy_main.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,9 @@ plpython_validator(PG_FUNCTION_ARGS)
160160
Form_pg_procprocStruct;
161161
boolis_trigger;
162162

163+
if (!CheckFunctionValidatorAccess(fcinfo->flinfo->fn_oid,funcoid))
164+
PG_RETURN_VOID();
165+
163166
if (!check_function_bodies)
164167
{
165168
PG_RETURN_VOID();
@@ -185,6 +188,7 @@ plpython_validator(PG_FUNCTION_ARGS)
185188
Datum
186189
plpython2_validator(PG_FUNCTION_ARGS)
187190
{
191+
/* call plpython validator with our fcinfo so it gets our oid */
188192
returnplpython_validator(fcinfo);
189193
}
190194
#endif/* PY_MAJOR_VERSION < 3 */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp