database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-17 17:02:08 +03:00
Code Activity

Restrict accesses to non-system views and foreign tables during pg_dump.

Browse Source 
When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.

This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.

To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.

Back-patch to all supported branches.

Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12
This commit is contained in:
Masahiko Sawada
2024-08-05 06:05:33 -07:00
parent ca6fde9225
commit 66e94448ab
15 changed files with 255 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
src/backend/tcop/postgres.c
View File

@ -79,6 +79,7 @@
#include "utils/snapmgr.h"
#include "utils/timeout.h"
#include "utils/timestamp.h"
#include "utils/varlena.h"
/* ----------------
* global variables
@ -103,6 +104,9 @@ int PostAuthDelay = 0;
/* Time between checks that the client is still connected. */
int client_connection_check_interval = 0;
/* flags for non-system relation kinds to restrict use */
int restrict_nonsystem_relation_kind;
/* ----------------
* private typedefs etc
* ----------------
@ -3673,6 +3677,66 @@ assign_transaction_timeout(int newval, void *extra)
}
}
/*
* GUC check_hook for restrict_nonsystem_relation_kind
*/
bool
check_restrict_nonsystem_relation_kind(char **newval, void **extra, GucSource source)
{
char *rawstring;
List *elemlist;
ListCell *l;
int flags = 0;
/* Need a modifiable copy of string */
rawstring = pstrdup(*newval);
if (!SplitIdentifierString(rawstring, ',', &elemlist))
{
/* syntax error in list */
GUC_check_errdetail("List syntax is invalid.");
pfree(rawstring);
list_free(elemlist);
return false;
}
foreach(l, elemlist)
{
char *tok = (char *) lfirst(l);
if (pg_strcasecmp(tok, "view") == 0)
flags |= RESTRICT_RELKIND_VIEW;
else if (pg_strcasecmp(tok, "foreign-table") == 0)
flags |= RESTRICT_RELKIND_FOREIGN_TABLE;
else
{
GUC_check_errdetail("Unrecognized key word: \"%s\".", tok);
pfree(rawstring);
list_free(elemlist);
return false;
}
}
pfree(rawstring);
list_free(elemlist);
/* Save the flags in *extra, for use by the assign function */
*extra = guc_malloc(ERROR, sizeof(int));
*((int *) *extra) = flags;
return true;
}
/*
* GUC assign_hook for restrict_nonsystem_relation_kind
*/
void
assign_restrict_nonsystem_relation_kind(const char *newval, void *extra)
{
int *flags = (int *) extra;
restrict_nonsystem_relation_kind = *flags;
}
/*
* set_debug_options --- apply "-d N" command line option