From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
---|---|
To: | Nathan Bossart <nathandbossart(at)gmail(dot)com> |
Cc: | Kyotaro Horiguchi <horikyota(dot)ntt(at)gmail(dot)com>, michael(at)paquier(dot)xyz, gurjeet(at)singh(dot)im, pgsql-hackers(at)postgresql(dot)org |
Subject: | Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS |
Date: | 2022-07-22 22:44:04 |
Message-ID: | 763512.1658529844@sss.pgh.pa.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Nathan Bossart <nathandbossart(at)gmail(dot)com> writes:
> On Fri, Jul 22, 2022 at 02:56:22PM -0400, Tom Lane wrote:
>> + if (!bootstrap &&
>> + !IsAutoVacuumWorkerProcess() &&
>> + !IsBackgroundWorker &&
>> + !am_walsender)
>> + process_session_preload_libraries();
> I worry that this will be easily missed when adding new types of
> non-interactive sessions, but I can't claim to have a better idea.
Yeah, that bothered me too. A variant that I'd considered is to
create a local variable "bool interactive" and set it properly
in each of the arms of the if-chain dealing with authentication
(starting about postinit.c:800). While that approach would cover
most of the tests shown above, it would not have exposed the issue
of needing to check am_walsender, so I'm not very convinced that
it'd be any better.
Another idea is to add a "bool interactive" parameter to InitPostgres,
thereby shoving the issue out to the call sites. Still wouldn't
expose the am_walsender angle, but conceivably it'd be more
future-proof anyway?
regards, tom lane
From | Date | Subject | |
---|---|---|---|
Next Message | Nathan Bossart | 2022-07-22 22:56:15 | Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS |
Previous Message | Nathan Bossart | 2022-07-22 22:33:59 | Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS |