Commitcebf9d6

committed

Only superuser can set sslcert/sslkey in postgres_fdw user mappings

1 parent4e514c6 commitcebf9d6Copy full SHA for cebf9d6

File tree

+31

-1

lines changed

+31

-1

lines changed

Lines changed: 9 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -8898,6 +8898,15 @@ SELECT * FROM ft1_nopw LIMIT 1;`
`8898`	`8898`	`1111 \| 2 \| \| \| \| \| ft1 \|`
`8899`	`8899`	`(1 row)`
`8900`	`8900`
	`8901`	`+-- unpriv user also cannot set sslcert / sslkey on the user mapping`
	`8902`	`+-- first set password_required so we see the right error messages`
	`8903`	`+ALTER USER MAPPING FOR CURRENT_USER SERVER loopback_nopw OPTIONS (SET password_required 'true');`
	`8904`	`+ALTER USER MAPPING FOR CURRENT_USER SERVER loopback_nopw OPTIONS (ADD sslcert 'foo.crt');`
	`8905`	`+ERROR: sslcert and sslkey are superuser-only`
	`8906`	`+HINT: User mappings with the sslcert or sslkey options set may only be created or modified by the superuser`
	`8907`	`+ALTER USER MAPPING FOR CURRENT_USER SERVER loopback_nopw OPTIONS (ADD sslkey 'foo.key');`
	`8908`	`+ERROR: sslcert and sslkey are superuser-only`
	`8909`	`+HINT: User mappings with the sslcert or sslkey options set may only be created or modified by the superuser`
`8901`	`8910`	`-- We're done with the role named after a specific user and need to check the`
`8902`	`8911`	`-- changes to the public mapping.`
`8903`	`8912`	`DROP USER MAPPING FOR CURRENT_USER SERVER loopback_nopw;`

Lines changed: 10 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -159,6 +159,16 @@ postgres_fdw_validator(PG_FUNCTION_ARGS)`
`159`	`159`	`errmsg("password_required=false is superuser-only"),`
`160`	`160`	`errhint("User mappings with the password_required option set to false may only be created or modified by the superuser")));`
`161`	`161`	`}`
	`162`	`+elseif (strcmp(def->defname,"sslcert")==0\|\|`
	`163`	`+strcmp(def->defname,"sslkey")==0)`
	`164`	`+{`
	`165`	`+/* similarly for sslcert / sslkey on user mapping */`
	`166`	`+if (catalog==UserMappingRelationId&& !superuser())`
	`167`	`+ereport(ERROR,`
	`168`	`+(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),`
	`169`	`+errmsg("sslcert and sslkey are superuser-only"),`
	`170`	`+errhint("User mappings with the sslcert or sslkey options set may only be created or modified by the superuser")));`
	`171`	`+}`
`162`	`172`	`}`
`163`	`173`
`164`	`174`	`PG_RETURN_VOID();`

Lines changed: 7 additions & 0 deletions

Original file line number	Diff line number	Diff line change
`@@ -2567,6 +2567,7 @@ SELECT * FROM ft1_nopw LIMIT 1;`
`2567`	`2567`	`-- Unpriv user cannot make the mapping passwordless`
`2568`	`2568`	`ALTERUSER MAPPING FORCURRENT_USER SERVER loopback_nopw OPTIONS (ADD password_required'false');`
`2569`	`2569`
	`2570`	`+`
`2570`	`2571`	`SELECT*FROM ft1_nopwLIMIT1;`
`2571`	`2572`
`2572`	`2573`	`RESET ROLE;`
`@@ -2579,6 +2580,12 @@ SET ROLE regress_nosuper;`
`2579`	`2580`	`-- Should finally work now`
`2580`	`2581`	`SELECT*FROM ft1_nopwLIMIT1;`
`2581`	`2582`
	`2583`	`+-- unpriv user also cannot set sslcert / sslkey on the user mapping`
	`2584`	`+-- first set password_required so we see the right error messages`
	`2585`	`+ALTERUSER MAPPING FORCURRENT_USER SERVER loopback_nopw OPTIONS (SET password_required'true');`
	`2586`	`+ALTERUSER MAPPING FORCURRENT_USER SERVER loopback_nopw OPTIONS (ADD sslcert'foo.crt');`
	`2587`	`+ALTERUSER MAPPING FORCURRENT_USER SERVER loopback_nopw OPTIONS (ADD sslkey'foo.key');`
	`2588`	`+`
`2582`	`2589`	`-- We're done with the role named after a specific user and need to check the`
`2583`	`2590`	`-- changes to the public mapping.`
`2584`	`2591`	`DROPUSER MAPPING FORCURRENT_USER SERVER loopback_nopw;`

Lines changed: 5 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -130,7 +130,7 @@`
`130`	`130`	`</listitem>`
`131`	`131`	`<listitem>`
`132`	`132`	`<para>`
`133`		`- <literal>sslkey</literal> and <literal>sslpassword</literal> - these may`
	`133`	`+ <literal>sslkey</literal> and <literal>sslcert</literal> - these may`
`134`	`134`	`appear in <emphasis>either or both</emphasis> a connection and a user`
`135`	`135`	`mapping. If both are present, the user mapping setting overrides the`
`136`	`136`	`connection setting.`
`@@ -139,6 +139,10 @@`
`139`	`139`	`</itemizedlist>`
`140`	`140`	`</para>`
`141`	`141`
	`142`	`+ <para>`
	`143`	`+ Only superusers may create or modify user mappings with the`
	`144`	`+ <literal>sslcert</literal> or <literal>sslkey</literal> settings.`
	`145`	`+ </para>`
`142`	`146`	`<para>`
`143`	`147`	`Only superusers may connect to foreign servers without password`
`144`	`148`	`authentication, so always specify the <literal>password</literal> option`

Comments

(0)