From 5f03ab8801e1bd326146a29a4aea4241ed5c8f0d Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Thu, 3 Sep 2009 22:08:34 +0000 Subject: Disallow RESET ROLE and RESET SESSION AUTHORIZATION inside security-definer functions. This extends the previous patch that forbade SETting these variables inside security-definer functions. RESET is equally a security hole, since it would allow regaining privileges of the caller; furthermore it can trigger Assert failures and perhaps other internal errors, since the code is not expecting these variables to change in such contexts. The previous patch did not cover this case because assign hooks don't really have enough information, so move the responsibility for preventing this into guc.c. Problem discovered by Heikki Linnakangas. Security: no CVE assigned yet, extends CVE-2007-6600 --- src/backend/commands/variable.c | 37 +------------------------------------ 1 file changed, 1 insertion(+), 36 deletions(-) (limited to 'src/backend/commands/variable.c') diff --git a/src/backend/commands/variable.c b/src/backend/commands/variable.c index 730a3ac4289..7803a91525e 100644 --- a/src/backend/commands/variable.c +++ b/src/backend/commands/variable.c @@ -9,7 +9,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.119.2.1 2008/01/03 21:23:45 tgl Exp $ + * $PostgreSQL: pgsql/src/backend/commands/variable.c,v 1.119.2.2 2009/09/03 22:08:29 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -620,22 +620,6 @@ assign_session_authorization(const char *value, bool doit, GucSource source) /* not a saved ID, so look it up */ HeapTuple roleTup; - if (InSecurityDefinerContext()) - { - /* - * Disallow SET SESSION AUTHORIZATION inside a security definer - * context. We need to do this because when we exit the context, - * GUC won't be notified, leaving things out of sync. Note that - * this test is positioned so that restoring a previously saved - * setting isn't prevented. - */ - if (source >= PGC_S_INTERACTIVE) - ereport(ERROR, - (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), - errmsg("cannot set session authorization within security-definer function"))); - return NULL; - } - if (!IsTransactionState()) { /* @@ -743,25 +727,6 @@ assign_role(const char *value, bool doit, GucSource source) } } - if (roleid == InvalidOid && InSecurityDefinerContext()) - { - /* - * Disallow SET ROLE inside a security definer context. We need to do - * this because when we exit the context, GUC won't be notified, - * leaving things out of sync. Note that this test is arranged so - * that restoring a previously saved setting isn't prevented. - * - * XXX it would be nice to allow this case in future, with the - * behavior being that the SET ROLE's effects end when the security - * definer context is exited. - */ - if (source >= PGC_S_INTERACTIVE) - ereport(ERROR, - (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), - errmsg("cannot set role within security-definer function"))); - return NULL; - } - if (roleid == InvalidOid && strcmp(actual_rolename, "none") != 0) { -- cgit v1.2.3