database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-29 10:41:53 +03:00
Code Activity

Support explicit placement of the temporary-table schema within search_path.

Browse Source 
This is needed to allow a security-definer function to set a truly secure
value of search_path.  Without it, a malicious user can use temporary objects
to execute code with the privileges of the security-definer function.  Even
pushing the temp schema to the back of the search path is not quite good
enough, because a function or operator at the back of the path might still
capture control from one nearer the front due to having a more exact datatype
match.  Hence, disable searching the temp schema altogether for functions and
operators.

Security: CVE-2007-2138
This commit is contained in:
Tom Lane
2007-04-20 02:38:05 +00:00
parent 2a1b76f046
commit fc52d13ca6
7 changed files with 414 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
doc/src/sgml/config.sgml
View File

@ -1,5 +1,5 @@
<!--
$PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.36.2.7 2006/11/04 18:20:40 tgl Exp $
$PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.36.2.8 2007/04/20 02:38:04 tgl Exp $
-->
<chapter Id="runtime-config">
<title>Server Configuration</title>
@ -3103,9 +3103,17 @@ SELECT * FROM parent WHERE key = 2400;
mentioned in the path then it will be searched in the specified
order. If <literal>pg_catalog</> is not in the path then it will
be searched <emphasis>before</> searching any of the path items.
It should also be noted that the temporary-table schema,
<literal>pg_temp_<replaceable>nnn</></>, is implicitly searched before any of
these.
</para>
<para>
Likewise, the current session's temporary-table schema,
<literal>pg_temp_<replaceable>nnn</></>, is always searched if it
exists. It can be explicitly listed in the path by using the
alias <literal>pg_temp</>. If it is not listed in the path then
it is searched first (before even <literal>pg_catalog</>). However,
the temporary schema is only searched for relation (table, view,
sequence, etc) and data type names. It will never be searched for
function or operator names.
</para>
<para>

50
doc/src/sgml/ref/create_function.sgml
View File

@ -1,5 +1,5 @@
<!--
$PostgreSQL: pgsql/doc/src/sgml/ref/create_function.sgml,v 1.67 2005/11/01 21:09:50 tgl Exp $
$PostgreSQL: pgsql/doc/src/sgml/ref/create_function.sgml,v 1.67.2.1 2007/04/20 02:38:04 tgl Exp $
-->
<refentry id="SQL-CREATEFUNCTION">
@ -473,6 +473,54 @@ SELECT * FROM dup(42);
</para>
</refsect1>
<refsect1 id="sql-createfunction-security">
<title>Writing <literal>SECURITY DEFINER</literal> Functions Safely</title>
<para>
Because a <literal>SECURITY DEFINER</literal> function is executed
with the privileges of the user that created it, care is needed to
ensure that the function cannot be misused. For security,
<xref linkend="guc-search-path"> should be set to exclude any schemas
writable by untrusted users. This prevents
malicious users from creating objects that mask objects used by the
function. Particularly important is in this regard is the
temporary-table schema, which is searched first by default, and
is normally writable by anyone. A secure arrangement can be had
by forcing the temporary schema to be searched last. To do this,
write <literal>pg_temp</> as the last entry in <varname>search_path</>.
This function illustrates safe usage:
</para>
<programlisting>
CREATE FUNCTION check_password(uname TEXT, pass TEXT)
RETURNS BOOLEAN AS $$
DECLARE passed BOOLEAN;
old_path TEXT;
BEGIN
-- Save old search_path; notice we must qualify current_setting
-- to ensure we invoke the right function
old_path := pg_catalog.current_setting('search_path');
-- Set a secure search_path: trusted schemas, then 'pg_temp'.
-- We set is_local = true so that the old value will be restored
-- in event of an error before we reach the function end.
PERFORM pg_catalog.set_config('search_path', 'admin, pg_temp', true);
-- Do whatever secure work we came for.
SELECT (pwd = $2) INTO passed
FROM pwds
WHERE username = $1;
-- Restore caller's search_path
PERFORM pg_catalog.set_config('search_path', old_path, true);
RETURN passed;
END;
$$ LANGUAGE plpgsql SECURITY DEFINER;
</programlisting>
</refsect1>
<refsect1 id="sql-createfunction-compat">
<title>Compatibility</title>

121
doc/src/sgml/release.sgml
View File

@ -1,4 +1,4 @@
<!-- $PostgreSQL: pgsql/doc/src/sgml/release.sgml,v 1.400.2.41 2007/04/19 13:02:30 momjian Exp $ -->
<!-- $PostgreSQL: pgsql/doc/src/sgml/release.sgml,v 1.400.2.42 2007/04/20 02:38:04 tgl Exp $ -->
<!--
Typical markup:
@ -28,7 +28,8 @@ For new features, add links to the documentation sections.
</note>
<para>
This release contains fixes from 8.1.8.
This release contains a variety of fixes from 8.1.8,
including a security fix.
</para>
<sect2>
@ -49,39 +50,57 @@ For new features, add links to the documentation sections.
<listitem>
<para>
Fix <function>to_char()</> so it properly upper/lower cases localized day or month
names (Pavel Stehule)
Support explicit placement of the temporary-table schema within
<varname>search_path</>, and disable searching it for functions
and operators (Tom)
</para>
<para>
This is needed to allow a security-definer function to set a
truly secure value of <varname>search_path</>. Without it,
an unprivileged SQL user can use temporary objects to execute code
with the privileges of the security-definer function (CVE-2007-2138).
See <xref linkend="sql-createfunction"
endterm="sql-createfunction-title"> for more information.
</para>
</listitem>
<listitem>
<para>
<filename>/contrib/tsearch2</> fixes (Teodor)
<filename>/contrib/tsearch2</> crash fixes (Teodor)
</para>
</listitem>
<listitem>
<para>
Require <command>COMMIT TRANSACTION</> to be executed in the same database as
it was prepared (Heikki)
Require <command>COMMIT PREPARED</> to be executed in the same
database as the transaction was prepared in (Heikki)
</para>
</listitem>
<listitem>
<para>
Improve detection of <acronym>POSIX</>-style time zone names (Tom)
Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
<command>UPDATE</> chains (Tom, Pavan Deolasee)
</para>
</listitem>
<listitem>
<para>
Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
Planner fixes, including improving outer join and bitmap scan
selection logic (Tom)
</para>
</listitem>
<listitem>
<para>
Improve outer join and bitmap join selection logic (Tom)
Fix PANIC during enlargement of a hash index (bug introduced in 8.1.6)
(Tom)
</para>
</listitem>
<listitem>
<para>
Fix POSIX-style timezone specs to follow new USA DST rules (Tom)
</para>
</listitem>
@ -3047,7 +3066,8 @@ psql -t -f fixseq.sql db1 | psql -e db1
</note>
<para>
This release contains fixes from 8.0.12.
This release contains a variety of fixes from 8.0.12,
including a security fix.
</para>
<sect2>
@ -3068,25 +3088,43 @@ psql -t -f fixseq.sql db1 | psql -e db1
<listitem>
<para>
<filename>/contrib/tsearch2</> fixes (Teodor)
Support explicit placement of the temporary-table schema within
<varname>search_path</>, and disable searching it for functions
and operators (Tom)
</para>
<para>
This is needed to allow a security-definer function to set a
truly secure value of <varname>search_path</>. Without it,
an unprivileged SQL user can use temporary objects to execute code
with the privileges of the security-definer function (CVE-2007-2138).
See <xref linkend="sql-createfunction"
endterm="sql-createfunction-title"> for more information.
</para>
</listitem>
<listitem>
<para>
Improve detection of <acronym>POSIX</>-style time zone names (Tom)
<filename>/contrib/tsearch2</> crash fixes (Teodor)
</para>
</listitem>
<listitem>
<para>
Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
<command>UPDATE</> chains (Tom, Pavan Deolasee)
</para>
</listitem>
<listitem>
<para>
<filename>/contrib/tsearch2</> fixes (Teodor)
Fix PANIC during enlargement of a hash index (bug introduced in 8.0.10)
(Tom)
</para>
</listitem>
<listitem>
<para>
Fix POSIX-style timezone specs to follow new USA DST rules (Tom)
</para>
</listitem>
@ -6537,7 +6575,8 @@ typedefs (Michael)</para></listitem>
</note>
<para>
This release contains a variety of fixes from 7.4.16.
This release contains fixes from 7.4.16,
including a security fix.
</para>
<sect2>
@ -6558,13 +6597,37 @@ typedefs (Michael)</para></listitem>
<listitem>
<para>
<filename>/contrib/tsearch2</> fixes (Teodor)
Support explicit placement of the temporary-table schema within
<varname>search_path</>, and disable searching it for functions
and operators (Tom)
</para>
<para>
This is needed to allow a security-definer function to set a
truly secure value of <varname>search_path</>. Without it,
an unprivileged SQL user can use temporary objects to execute code
with the privileges of the security-definer function (CVE-2007-2138).
See <xref linkend="sql-createfunction"
endterm="sql-createfunction-title"> for more information.
</para>
</listitem>
<listitem>
<para>
Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
<filename>/contrib/tsearch2</> crash fixes (Teodor)
</para>
</listitem>
<listitem>
<para>
Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
<command>UPDATE</> chains (Tom, Pavan Deolasee)
</para>
</listitem>
<listitem>
<para>
Fix PANIC during enlargement of a hash index (bug introduced in 7.4.15)
(Tom)
</para>
</listitem>
@ -9697,7 +9760,8 @@ DROP SCHEMA information_schema CASCADE;
</note>
<para>
This release contains a variety of fixes from 7.3.18.
This release contains fixes from 7.3.18,
including a security fix.
</para>
<sect2>
@ -9718,7 +9782,24 @@ DROP SCHEMA information_schema CASCADE;
<listitem>
<para>
Fix bug in how <command>VACUUM FULL</> handles <command>UPDATE</> chains (Tom, Pavan Deolasee)
Support explicit placement of the temporary-table schema within
<varname>search_path</>, and disable searching it for functions
and operators (Tom)
</para>
<para>
This is needed to allow a security-definer function to set a
truly secure value of <varname>search_path</>. Without it,
an unprivileged SQL user can use temporary objects to execute code
with the privileges of the security-definer function (CVE-2007-2138).
See <xref linkend="sql-createfunction"
endterm="sql-createfunction-title"> for more information.
</para>
</listitem>
<listitem>
<para>
Fix potential-data-corruption bug in how <command>VACUUM FULL</> handles
<command>UPDATE</> chains (Tom, Pavan Deolasee)
</para>
</listitem>