database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-13 07:41:39 +03:00
Code Activity

Add missing check on invocation of trusted procedures.

Browse Source 
KaiGai Kohei
This commit is contained in:
Robert Haas
2011-04-04 13:25:42 -04:00
parent a0e50e698b
commit 595a441ae9
4 changed files with 57 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
contrib/sepgsql/hooks.c
View File

@ -251,6 +251,7 @@ sepgsql_fmgr_hook(FmgrHookEventType event,
if (!stack)
{
MemoryContext oldcxt;
const char *cur_label = sepgsql_get_client_label();
oldcxt = MemoryContextSwitchTo(flinfo->fn_mcxt);
stack = palloc(sizeof(*stack));
@ -260,6 +261,19 @@ sepgsql_fmgr_hook(FmgrHookEventType event,
MemoryContextSwitchTo(oldcxt);
if (strcmp(cur_label, stack->new_label) != 0)
{
/*
* process:transition permission between old and new
* label, when user tries to switch security label of
* the client on execution of trusted procedure.
*/
sepgsql_check_perms(cur_label, stack->new_label,
SEPG_CLASS_PROCESS,
SEPG_PROCESS__TRANSITION,
NULL, true);
}
*private = PointerGetDatum(stack);
}
Assert(!stack->old_label);