Skip site navigation (1) Skip section navigation (2)

Re: [HACKERS] [PATCH] Re: Setuid functions

From: Mark Volpe <volpe(dot)mark(at)epa(dot)gov>
To: Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us>
Cc: PostgreSQL-patches <pgsql-patches(at)postgresql(dot)org>
Subject: Re: [HACKERS] [PATCH] Re: Setuid functions
Date: 2001-07-12 18:41:01
Message-ID: 3B4DEF3D.AF19D7D1@epa.gov (view raw or flat)
Thread:
Lists: pgsql-patches
Might as well just get rid of that one; Peter's right about the security hole.

The simplest fix I see is to allow SET AUTHORIZATION only in superuser-owned
functions. It would still be potentially useful that way. Doing this the
"right" way (with users needing regrantable privileges, etc.) would involve
too much effort for too little reward, IMHO. 

Mark

Bruce Momjian wrote:
> 
> I am backing out this SET AUTHORIZATION patch until we can resolve the
> security issues.  It will remain in the patch queue at:
> 
>         http://candle.pha.pa.us/cgi-bin/pgpatches
>

In response to

Responses

pgsql-patches by date

Next:From: Bruce MomjianDate: 2001-07-12 18:42:31
Subject: Re: [HACKERS] [PATCH] Re: Setuid functions
Previous:From: Bruce MomjianDate: 2001-07-12 18:26:53
Subject: Re: python installation patch.

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group