Tom Lane 230d5cfc47 Make standard maintenance operations (including VACUUM, ANALYZE, REINDEX, ...

and CLUSTER) execute as the table owner rather than the calling user, using
the same privilege-switching mechanism already used for SECURITY DEFINER
functions.  The purpose of this change is to ensure that user-defined
functions used in index definitions cannot acquire the privileges of a
superuser account that is performing routine maintenance.  While a function
used in an index is supposed to be IMMUTABLE and thus not able to do anything
very interesting, there are several easy ways around that restriction; and
even if we could plug them all, there would remain a risk of reading sensitive
information and broadcasting it through a covert channel such as CPU usage.

To prevent bypassing this security measure, execution of SET SESSION
AUTHORIZATION and SET ROLE is now forbidden within a SECURITY DEFINER context.

Thanks to Itagaki Takahiro for reporting this vulnerability.

Security: CVE-2007-6600

2008-01-03 21:25:34 +00:00

..

clog.c

Update copyrights to 2003.

2003-08-04 02:40:20 +00:00

Makefile

This patch extracts page buffer pooling and the simple

2003-06-11 22:37:46 +00:00

rmgr.c

pgindent run.

2003-08-04 00:43:34 +00:00

slru.c

Repair longstanding bug in slru/clog logic: it is possible for two backends

2006-01-21 04:38:46 +00:00

transam.c

Update copyrights to 2003.

2003-08-04 02:40:20 +00:00

varsup.c

Repair incorrect order of operations in GetNewTransactionId(). We must

2004-01-26 19:16:23 +00:00

xact.c

Make standard maintenance operations (including VACUUM, ANALYZE, REINDEX,

2008-01-03 21:25:34 +00:00

xlog.c

Arrange to set the LC_XXX environment variables to match our locale setup.

2006-01-05 00:55:24 +00:00

xlogutils.c

Update copyrights to 2003.

2003-08-04 02:40:20 +00:00