Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitad0009e

Browse files
committed
Force PL and range-type support functions to be owned by a superuser.
We allow non-superusers to create procedural languages (with restrictions)and range datatypes. Previously, the automatically-created supportfunctions for these objects ended up owned by the creating user. Thisrepresents a rather considerable security hazard, because the owning usermight be able to alter a support function's definition in such a way as tocrash the server, inject trojan-horse SQL code, or even execute arbitraryC code directly. It appears that right now the only actually exploitableproblem is the infinite-recursion bug fixed in the previous patch forCVE-2012-2655. However, it's not hard to imagine that future additions ofmore ALTER FUNCTION capability might unintentionally open up new hazards.To forestall future problems, cause these support functions to be owned bythe bootstrap superuser, not the user creating the parent object.
1 parent33c6eaf commitad0009e

File tree

6 files changed

+10
-1
lines changed

6 files changed

+10
-1
lines changed

‎src/backend/catalog/pg_aggregate.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,7 @@ AggregateCreate(const char *aggName,
233233
false,/* no replacement */
234234
false,/* doesn't return a set */
235235
finaltype,/* returnType */
236+
GetUserId(),/* proowner */
236237
INTERNALlanguageId,/* languageObjectId */
237238
InvalidOid,/* no validator */
238239
"aggregate_dummy",/* placeholder proc */

‎src/backend/catalog/pg_proc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ ProcedureCreate(const char *procedureName,
6969
boolreplace,
7070
boolreturnsSet,
7171
OidreturnType,
72+
Oidproowner,
7273
OidlanguageObjectId,
7374
OidlanguageValidator,
7475
constchar*prosrc,
@@ -100,7 +101,6 @@ ProcedureCreate(const char *procedureName,
100101
boolinternalInParam= false;
101102
boolinternalOutParam= false;
102103
OidvariadicType=InvalidOid;
103-
Oidproowner=GetUserId();
104104
Acl*proacl=NULL;
105105
Relationrel;
106106
HeapTupletup;

‎src/backend/commands/functioncmds.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -978,6 +978,7 @@ CreateFunction(CreateFunctionStmt *stmt, const char *queryString)
978978
stmt->replace,
979979
returnsSet,
980980
prorettype,
981+
GetUserId(),
981982
languageOid,
982983
languageValidator,
983984
prosrc_str,/* converted to text later */

‎src/backend/commands/proclang.c

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
#include"catalog/dependency.h"
1919
#include"catalog/indexing.h"
2020
#include"catalog/objectaccess.h"
21+
#include"catalog/pg_authid.h"
2122
#include"catalog/pg_language.h"
2223
#include"catalog/pg_namespace.h"
2324
#include"catalog/pg_pltemplate.h"
@@ -124,6 +125,7 @@ CreateProceduralLanguage(CreatePLangStmt *stmt)
124125
false,/* replace */
125126
false,/* returnsSet */
126127
LANGUAGE_HANDLEROID,
128+
BOOTSTRAP_SUPERUSERID,
127129
ClanguageId,
128130
F_FMGR_C_VALIDATOR,
129131
pltemplate->tmplhandler,
@@ -160,6 +162,7 @@ CreateProceduralLanguage(CreatePLangStmt *stmt)
160162
false,/* replace */
161163
false,/* returnsSet */
162164
VOIDOID,
165+
BOOTSTRAP_SUPERUSERID,
163166
ClanguageId,
164167
F_FMGR_C_VALIDATOR,
165168
pltemplate->tmplinline,
@@ -199,6 +202,7 @@ CreateProceduralLanguage(CreatePLangStmt *stmt)
199202
false,/* replace */
200203
false,/* returnsSet */
201204
VOIDOID,
205+
BOOTSTRAP_SUPERUSERID,
202206
ClanguageId,
203207
F_FMGR_C_VALIDATOR,
204208
pltemplate->tmplvalidator,

‎src/backend/commands/typecmds.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@
3838
#include"catalog/dependency.h"
3939
#include"catalog/heap.h"
4040
#include"catalog/indexing.h"
41+
#include"catalog/pg_authid.h"
4142
#include"catalog/pg_collation.h"
4243
#include"catalog/pg_constraint.h"
4344
#include"catalog/pg_depend.h"
@@ -1513,6 +1514,7 @@ makeRangeConstructors(const char *name, Oid namespace,
15131514
false,/* replace */
15141515
false,/* returns set */
15151516
rangeOid,/* return type */
1517+
BOOTSTRAP_SUPERUSERID,/* proowner */
15161518
INTERNALlanguageId,/* language */
15171519
F_FMGR_INTERNAL_VALIDATOR,/* language validator */
15181520
prosrc[i],/* prosrc */

‎src/include/catalog/pg_proc_fn.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ extern Oid ProcedureCreate(const char *procedureName,
2121
boolreplace,
2222
boolreturnsSet,
2323
OidreturnType,
24+
Oidproowner,
2425
OidlanguageObjectId,
2526
OidlanguageValidator,
2627
constchar*prosrc,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp