Re: CREATEROLE and role ownership hierarchies

From: Mark Dilger <mark(dot)dilger(at)enterprisedb(dot)com>
To: Shinya Kato <Shinya11(dot)Kato(at)oss(dot)nttdata(dot)com>, "Bossart, Nathan" <bossartn(at)amazon(dot)com>
Cc: PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>, Andrew Dunstan <andrew(at)dunslane(dot)net>, Jeff Davis <pgsql(at)j-davis(dot)com>
Subject: Re: CREATEROLE and role ownership hierarchies
Date: 2021-10-27 22:21:43
Message-ID: 388E59DA-303D-4808-945D-43E9338912DD@enterprisedb.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers


>> On Oct 25, 2021, at 10:09 PM, Shinya Kato <Shinya11(dot)Kato(at)oss(dot)nttdata(dot)com> wrote:

>> Hi! Thank you for the patch.
>> I too think that CREATEROLE escalation attack is problem.
>>
>> I have three comments.
>> 1. Is there a function to check the owner of a role, it would be nice to be able to check with \du or pg_roles view.
>
> No, but that is a good idea.

These two ideas are implemented in v2. Both \du and pg_roles show the owner information.

> The current solution is to run REASSIGN OWNED in each database where the role owns objects before running DROP ROLE. At that point, the CASCADE option (not implemented) won't be needed. Of course, I need to post the next revision of this patch set addressing the deficiencies that Nathan pointed out upthread to make that work.

REASSIGN OWNED and ALTER ROLE..OWNER TO now work in v2.

Attachment Content-Type Size
v2-0001-Add-tests-of-the-CREATEROLE-attribute.patch application/octet-stream 13.4 KB
v2-0002-Add-owners-to-roles.patch application/octet-stream 38.1 KB
v2-0003-Give-role-owners-control-over-owned-roles.patch application/octet-stream 24.5 KB
v2-0004-Restrict-power-granted-via-CREATEROLE.patch application/octet-stream 41.2 KB

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Chapman Flack 2021-10-27 23:50:45 Re: [PATCH v2] src/port/snprintf.c: Optimize the common base=10 case in fmtint
Previous Message Arjan van de Ven 2021-10-27 22:18:13 Re: [PATCH v2] src/port/snprintf.c: Optimize the common base=10 case in fmtint