mirror of
https://github.com/postgres/postgres.git
synced 2026-10-23 13:29:09 +03:00
bf3842a64f
REPLICATION users were not previously subject to restrictions on output plugin paths, so they were able to bypass LOAD-time protections during logical decoding. Unfortunately, adding the standard LOAD restrictions now would retroactively require all third-party output plugins to be installed under the $libdir/plugins directory. This would prevent the use of dynamic_library_path, introduce a wire incompatibility for clients, and require all plugin authors to check that their libraries are safe for use by any unprivileged user; we want to avoid that. Instead, introduce an output_plugin_libraries GUC so that DBAs can specify the output plugins that are trusted for use in logical decoding. For simplicity, superusers are subject to the restriction as well (though they're free to modify the GUC at will during a session, so no power is actually lost). The default setting is 'pgoutput, test_decoding'. If other third-party plugins are in use, DBAs will need to modify this parameter after they update. Some pointers have been added to the documentation to assist with this. Author: Jacob Champion <jacob.champion@enterprisedb.com> Reported-by: Vladimir Tokarev <vladimirelitokarev@gmail.com> Reported-by: Yu Kunpeng <yu443940816@live.com> Reviewed-by: Álvaro Herrera <alvherre@kurilemu.de> Reviewed-by: Noah Misch <noah@leadboat.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us> Backpatch-through: 14 Security: CVE-2026-6471
78 lines
2.7 KiB
SQL
78 lines
2.7 KiB
SQL
-- predictability
|
|
SET synchronous_commit = on;
|
|
|
|
-- setup
|
|
CREATE ROLE regress_lr_normal;
|
|
CREATE ROLE regress_lr_superuser SUPERUSER;
|
|
CREATE ROLE regress_lr_replication REPLICATION;
|
|
CREATE TABLE lr_test(data text);
|
|
|
|
-- superuser can control replication
|
|
SET ROLE regress_lr_superuser;
|
|
SELECT 'init' FROM pg_create_logical_replication_slot('regression_slot', 'test_decoding');
|
|
INSERT INTO lr_test VALUES('lr_superuser_init');
|
|
SELECT data FROM pg_logical_slot_get_changes('regression_slot', NULL, NULL, 'include-xids', '0', 'skip-empty-xacts', '1');
|
|
SELECT pg_drop_replication_slot('regression_slot');
|
|
RESET ROLE;
|
|
|
|
-- no users can load an untrusted plugin
|
|
SET output_plugin_libraries = pgoutput;
|
|
SET ROLE regress_lr_replication;
|
|
SELECT 'init' FROM pg_create_logical_replication_slot('regression_slot', 'test_decoding');
|
|
RESET ROLE;
|
|
SELECT 'init' FROM pg_create_logical_replication_slot('regression_slot', 'test_decoding');
|
|
RESET output_plugin_libraries;
|
|
|
|
-- replication user can control replication
|
|
SET ROLE regress_lr_replication;
|
|
SELECT 'init' FROM pg_create_logical_replication_slot('regression_slot', 'test_decoding');
|
|
INSERT INTO lr_test VALUES('lr_superuser_init');
|
|
SELECT data FROM pg_logical_slot_get_changes('regression_slot', NULL, NULL, 'include-xids', '0', 'skip-empty-xacts', '1');
|
|
SELECT pg_drop_replication_slot('regression_slot');
|
|
RESET ROLE;
|
|
|
|
-- plain user *can't* can control replication
|
|
SET ROLE regress_lr_normal;
|
|
SELECT 'init' FROM pg_create_logical_replication_slot('regression_slot', 'test_decoding');
|
|
INSERT INTO lr_test VALUES('lr_superuser_init');
|
|
SELECT data FROM pg_logical_slot_get_changes('regression_slot', NULL, NULL, 'include-xids', '0', 'skip-empty-xacts', '1');
|
|
SELECT pg_drop_replication_slot('regression_slot');
|
|
RESET ROLE;
|
|
|
|
-- replication users can drop superuser created slots
|
|
SET ROLE regress_lr_superuser;
|
|
SELECT 'init' FROM pg_create_logical_replication_slot('regression_slot', 'test_decoding');
|
|
RESET ROLE;
|
|
SET ROLE regress_lr_replication;
|
|
SELECT pg_drop_replication_slot('regression_slot');
|
|
RESET ROLE;
|
|
|
|
-- normal users can't drop existing slots
|
|
SET ROLE regress_lr_superuser;
|
|
SELECT 'init' FROM pg_create_logical_replication_slot('regression_slot', 'test_decoding');
|
|
RESET ROLE;
|
|
SET ROLE regress_lr_normal;
|
|
SELECT pg_drop_replication_slot('regression_slot');
|
|
RESET ROLE;
|
|
|
|
-- all users can see existing slots
|
|
SET ROLE regress_lr_superuser;
|
|
SELECT slot_name, plugin FROM pg_replication_slots;
|
|
RESET ROLE;
|
|
|
|
SET ROLE regress_lr_replication;
|
|
SELECT slot_name, plugin FROM pg_replication_slots;
|
|
RESET ROLE;
|
|
|
|
SET ROLE regress_lr_normal;
|
|
SELECT slot_name, plugin FROM pg_replication_slots;
|
|
RESET ROLE;
|
|
|
|
-- cleanup
|
|
SELECT pg_drop_replication_slot('regression_slot');
|
|
|
|
DROP ROLE regress_lr_normal;
|
|
DROP ROLE regress_lr_superuser;
|
|
DROP ROLE regress_lr_replication;
|
|
DROP TABLE lr_test;
|