database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

Plug RLS related information leak in pg_stats view.

Browse Source 
The pg_stats view is supposed to be restricted to only show rows
about tables the user can read. However, it sometimes can leak
information which could not otherwise be seen when row level security
is enabled. Fix that by not showing pg_stats rows to users that would
be subject to RLS on the table the row is related to. This is done
by creating/using the newly introduced SQL visible function,
row_security_active().

Along the way, clean up three call sites of check_enable_rls(). The second
argument of that function should only be specified as other than
InvalidOid when we are checking as a different user than the current one,
as in when querying through a view. These sites were passing GetUserId()
instead of InvalidOid, which can cause the function to return incorrect
results if the current user has the BYPASSRLS privilege and row_security
has been set to OFF.

Additionally fix a bug causing RI Trigger error messages to unintentionally
leak information when RLS is enabled, and other minor cleanup and
improvements. Also add WITH (security_barrier) to the definition of pg_stats.

Bumped CATVERSION due to new SQL functions and pg_stats view definition.

Back-patch to 9.5 where RLS was introduced. Reported by Yaroslav.
Patch by Joe Conway and Dean Rasheed with review and input by
Michael Paquier and Stephen Frost.
This commit is contained in:
Joe Conway
2015-07-28 13:21:37 -07:00
parent 6087d952b3
commit cfa928ff6f
16 changed files with 159 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
doc/src/sgml/func.sgml
View File

@ -15244,6 +15244,12 @@ SET search_path TO <replaceable>schema</> <optional>, <replaceable>schema</>, ..
<entry><type>boolean</type></entry>
<entry>does current user have privilege for role</entry>
</row>
<row>
<entry><literal><function>row_security_active</function>(<parameter>table</parameter>)</literal>
</entry>
<entry><type>boolean</type></entry>
<entry>does current user have row level security active for table</entry>
</row>
</tbody>
</tgroup>
</table>
@ -15284,6 +15290,9 @@ SET search_path TO <replaceable>schema</> <optional>, <replaceable>schema</>, ..
<indexterm>
<primary>pg_has_role</primary>
</indexterm>
<indexterm>
<primary>row_security_active</primary>
</indexterm>
<para>
<function>has_table_privilege</function> checks whether a user
@ -15447,6 +15456,13 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute');
are immediately available without doing <command>SET ROLE</>.
</para>
<para>
<function>row_security_active</function> checks whether row level
security is active for the specified table in the context of the
<function>current_user</function> and environment. The table can
be specified by name or by OID.
</para>
<para>
<xref linkend="functions-info-schema-table"> shows functions that
determine whether a certain object is <firstterm>visible</> in the