mirror of
https://github.com/postgres/postgres.git
synced 2025-07-28 23:42:10 +03:00
Support explicit placement of the temporary-table schema within search_path.
This is needed to allow a security-definer function to set a truly secure value of search_path. Without it, a malicious user can use temporary objects to execute code with the privileges of the security-definer function. Even pushing the temp schema to the back of the search path is not quite good enough, because a function or operator at the back of the path might still capture control from one nearer the front due to having a more exact datatype match. Hence, disable searching the temp schema altogether for functions and operators. Security: CVE-2007-2138
This commit is contained in:
Tom Lane
@ -1,5 +1,5 @@
|
||||
<!--
|
||||
$Header: /cvsroot/pgsql/doc/src/sgml/ref/create_function.sgml,v 1.53.2.1 2003/11/12 20:05:15 petere Exp $
|
||||
$Header: /cvsroot/pgsql/doc/src/sgml/ref/create_function.sgml,v 1.53.2.2 2007/04/20 02:38:44 tgl Exp $
|
||||
-->
|
||||
|
||||
<refentry id="SQL-CREATEFUNCTION">
|
||||
@ -382,6 +382,54 @@ CREATE FUNCTION add(integer, integer) RETURNS integer
|
||||
</para>
|
||||
</refsect1>
|
||||
|
||||
<refsect1 id="sql-createfunction-security">
|
||||
<title>Writing <literal>SECURITY DEFINER</literal> Functions Safely</title>
|
||||
|
||||
<para>
|
||||
Because a <literal>SECURITY DEFINER</literal> function is executed
|
||||
with the privileges of the user that created it, care is needed to
|
||||
ensure that the function cannot be misused. For security,
|
||||
<xref linkend="guc-search-path"> should be set to exclude any schemas
|
||||
writable by untrusted users. This prevents
|
||||
malicious users from creating objects that mask objects used by the
|
||||
function. Particularly important is in this regard is the
|
||||
temporary-table schema, which is searched first by default, and
|
||||
is normally writable by anyone. A secure arrangement can be had
|
||||
by forcing the temporary schema to be searched last. To do this,
|
||||
write <literal>pg_temp</> as the last entry in <varname>search_path</>.
|
||||
This function illustrates safe usage:
|
||||
</para>
|
||||
|
||||
<programlisting>
|
||||
CREATE FUNCTION check_password(TEXT, TEXT)
|
||||
RETURNS BOOLEAN AS '
|
||||
DECLARE passed BOOLEAN;
|
||||
old_path TEXT;
|
||||
BEGIN
|
||||
-- Save old search_path; notice we must qualify current_setting
|
||||
-- to ensure we invoke the right function
|
||||
old_path := pg_catalog.current_setting(''search_path'');
|
||||
|
||||
-- Set a secure search_path: trusted schemas, then ''pg_temp''.
|
||||
-- We set is_local = true so that the old value will be restored
|
||||
-- in event of an error before we reach the function end.
|
||||
PERFORM pg_catalog.set_config(''search_path'', ''admin, pg_temp'', true);
|
||||
|
||||
-- Do whatever secure work we came for.
|
||||
SELECT (pwd = $2) INTO passed
|
||||
FROM pwds
|
||||
WHERE username = $1;
|
||||
|
||||
-- Restore caller''s search_path
|
||||
PERFORM pg_catalog.set_config(''search_path'', old_path, true);
|
||||
|
||||
RETURN passed;
|
||||
END;
|
||||
' LANGUAGE plpgsql SECURITY DEFINER;
|
||||
</programlisting>
|
||||
|
||||
</refsect1>
|
||||
|
||||
|
||||
<refsect1 id="sql-createfunction-compat">
|
||||
<title>Compatibility</title>
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
<!--
|
||||
$Header: /cvsroot/pgsql/doc/src/sgml/release.sgml,v 1.235.2.52 2007/04/19 13:01:59 momjian Exp $
|
||||
$Header: /cvsroot/pgsql/doc/src/sgml/release.sgml,v 1.235.2.53 2007/04/20 02:38:44 tgl Exp $
|
||||
-->
|
||||
|
||||
<appendix id="release">
|
||||
@ -14,7 +14,8 @@ $Header: /cvsroot/pgsql/doc/src/sgml/release.sgml,v 1.235.2.52 2007/04/19 13:01:
|
||||
</note>
|
||||
|
||||
<para>
|
||||
This release contains a variety of fixes from 7.4.16.
|
||||
This release contains fixes from 7.4.16,
|
||||
including a security fix.
|
||||
</para>
|
||||
|
||||
<sect2>
|
||||
@ -35,13 +36,37 @@ $Header: /cvsroot/pgsql/doc/src/sgml/release.sgml,v 1.235.2.52 2007/04/19 13:01:
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
<filename>/contrib/tsearch2</> fixes (Teodor)
|
||||
Support explicit placement of the temporary-table schema within
|
||||
<varname>search_path</>, and disable searching it for functions
|
||||
and operators (Tom)
|
||||
</para>
|
||||
<para>
|
||||
This is needed to allow a security-definer function to set a
|
||||
truly secure value of <varname>search_path</>. Without it,
|
||||
an unprivileged SQL user can use temporary objects to execute code
|
||||
with the privileges of the security-definer function (CVE-2007-2138).
|
||||
See <xref linkend="sql-createfunction"
|
||||
endterm="sql-createfunction-title"> for more information.
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
|
||||
<filename>/contrib/tsearch2</> crash fixes (Teodor)
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
|
||||
<command>UPDATE</> chains (Tom, Pavan Deolasee)
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
Fix PANIC during enlargement of a hash index (bug introduced in 7.4.15)
|
||||
(Tom)
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
@ -3174,7 +3199,8 @@ DROP SCHEMA information_schema CASCADE;
|
||||
</note>
|
||||
|
||||
<para>
|
||||
This release contains a variety of fixes from 7.3.18.
|
||||
This release contains fixes from 7.3.18,
|
||||
including a security fix.
|
||||
</para>
|
||||
|
||||
<sect2>
|
||||
@ -3195,7 +3221,24 @@ DROP SCHEMA information_schema CASCADE;
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
|
||||
Support explicit placement of the temporary-table schema within
|
||||
<varname>search_path</>, and disable searching it for functions
|
||||
and operators (Tom)
|
||||
</para>
|
||||
<para>
|
||||
This is needed to allow a security-definer function to set a
|
||||
truly secure value of <varname>search_path</>. Without it,
|
||||
an unprivileged SQL user can use temporary objects to execute code
|
||||
with the privileges of the security-definer function (CVE-2007-2138).
|
||||
See <xref linkend="sql-createfunction"
|
||||
endterm="sql-createfunction-title"> for more information.
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
<listitem>
|
||||
<para>
|
||||
Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
|
||||
<command>UPDATE</> chains (Tom, Pavan Deolasee)
|
||||
</para>
|
||||
</listitem>
|
||||
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
<!--
|
||||
$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.215.2.9 2006/05/21 20:11:58 tgl Exp $
|
||||
$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.215.2.10 2007/04/20 02:38:46 tgl Exp $
|
||||
-->
|
||||
|
||||
<Chapter Id="runtime">
|
||||
@ -1980,9 +1980,17 @@ SET ENABLE_SEQSCAN TO OFF;
|
||||
mentioned in the path then it will be searched in the specified
|
||||
order. If <literal>pg_catalog</> is not in the path then it will
|
||||
be searched <emphasis>before</> searching any of the path items.
|
||||
It should also be noted that the temporary-table schema,
|
||||
<literal>pg_temp_<replaceable>nnn</></>, is implicitly searched before any of
|
||||
these.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
Likewise, the current session's temporary-table schema,
|
||||
<literal>pg_temp_<replaceable>nnn</></>, is always searched if it
|
||||
exists. It can be explicitly listed in the path by using the
|
||||
alias <literal>pg_temp</>. If it is not listed in the path then
|
||||
it is searched first (before even <literal>pg_catalog</>). However,
|
||||
the temporary schema is only searched for relation (table, view,
|
||||
sequence, etc) and data type names. It will never be searched for
|
||||
function or operator names.
|
||||
</para>
|
||||
|
||||
<para>
|
||||
|
||||
Reference in New Issue
Block a user