Re: [BUG] autovacuum may skip tables when session_authorization/role is set on database

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: "Imseih (AWS), Sami" <simseih(at)amazon(dot)com>
Cc: "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: [BUG] autovacuum may skip tables when session_authorization/role is set on database
Date: 2023-12-13 21:18:22
Message-ID: 2660032.1702502302@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

"Imseih (AWS), Sami" <simseih(at)amazon(dot)com> writes:
> A recent case in the field in which a database session_authorization is
> altered to a non-superuser, non-owner of tables via alter database .. set session_authorization ..
> caused autovacuum to skip tables.

That seems like an extremely not-bright idea. What is the actual
use case for such a setting? Doesn't it risk security problems?

> Attached is a repro and a patch which sets the session user to the BOOTSTRAP superuser
> at the start of the autovac worker.

I'm rather unimpressed by this proposal, first because there are
probably ten other ways to break autovac with ill-considered settings,
and second because if we do want to consider this a supported case,
what about other background processes? They'd likely have issues
as well.

regards, tom lane

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Andrew Dunstan 2023-12-13 21:27:12 Re: Remove MSVC scripts from the tree
Previous Message Tristan Partin 2023-12-13 20:59:11 Re: Clean up find_typedefs and add support for Mac