Re: CVE-2017-7484-induced bugs, or, btree cmp functions are not leakproof?

On 12.07.18 00:52, Tom Lane wrote:
>> Another question that could be raised is why we are refusing to use
>> stats for a child table when the caller has select on the parent.
>> It's completely trivial to extract data from a child table if you
>> have select on the parent, so it seems like we are checking the
>> wrong table's privileges.

That seems like an oversight.

The underlying principle is that we want to allow access to statistics
if the user could read the table, or more accurately the column, anyway.
This could also happen through inheritance, so we should check that as
well, but we need to make sure that the particular column is inherited
and not added locally. Also, for the expression index case, we don't
track the individual columns, so we don't have that information. For
partitioning, we can rely on all the columns being inherited, but not
for plain inheritance. So there are some details to work through, it seems.

--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services