| From: | Mark Volpe <volpe(dot)mark(at)epa(dot)gov> |
|---|---|
| To: | |
| Cc: | PostgreSQL-patches <pgsql-patches(at)postgresql(dot)org> |
| Subject: | Re: [HACKERS] [PATCH] Re: Setuid functions |
| Date: | 2001-07-13 13:23:57 |
| Message-ID: | 3B4EF66D.476A256D@epa.gov |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-patches |
Might as well just get rid of that one; Peter's right about the security hole.
The simplest fix I see is to allow SET AUTHORIZATION only in superuser-owned
functions. It would still be potentially useful that way. Doing this the
"right" way (with users needing regrantable privileges, etc.) would involve
too much effort for too little reward, IMHO.
(Repost - I don't think this made it to the list)
Mark
Bruce Momjian wrote:
>
> I am backing out this SET AUTHORIZATION patch until we can resolve the
> security issues. It will remain in the patch queue at:
>
> http://candle.pha.pa.us/cgi-bin/pgpatches
>
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Anders Bengtsson | 2001-07-13 13:59:13 | Re: [PATCH] Cleanup of JDBC character encoding |
| Previous Message | Bruce Momjian | 2001-07-13 02:22:53 | Re: Patch for handling long null terminated strings in JDBC driver |