mirror of
https://github.com/postgres/postgres.git
synced 2025-07-23 03:21:12 +03:00
ef792f7856
When a feature enumerates relations and runs functions associated with all found relations, the feature's user shall not need to trust every user having permission to create objects. BRIN-specific functionality in autovacuum neglected to account for this, as did pg_amcheck and CLUSTER. An attacker having permission to create non-temp objects in at least one schema could execute arbitrary SQL functions under the identity of the bootstrap superuser. CREATE INDEX (not a relation-enumerating operation) and REINDEX protected themselves too late. This change extends to the non-enumerating amcheck interface. Back-patch to v10 (all supported versions). Sergey Shinderuk, reviewed (in earlier versions) by Alexander Lakhin. Reported by Alexander Lakhin. Security: CVE-2022-1552
83 lines
2.7 KiB
PL/PgSQL
83 lines
2.7 KiB
PL/PgSQL
-- minimal test, basically just verifying that amcheck
|
|
CREATE TABLE bttest_a(id int8);
|
|
CREATE TABLE bttest_b(id int8);
|
|
|
|
INSERT INTO bttest_a SELECT * FROM generate_series(1, 100000);
|
|
INSERT INTO bttest_b SELECT * FROM generate_series(100000, 1, -1);
|
|
|
|
CREATE INDEX bttest_a_idx ON bttest_a USING btree (id);
|
|
CREATE INDEX bttest_b_idx ON bttest_b USING btree (id);
|
|
|
|
CREATE ROLE regress_bttest_role;
|
|
|
|
-- verify permissions are checked (error due to function not callable)
|
|
SET ROLE regress_bttest_role;
|
|
SELECT bt_index_check('bttest_a_idx'::regclass);
|
|
SELECT bt_index_parent_check('bttest_a_idx'::regclass);
|
|
RESET ROLE;
|
|
|
|
-- we, intentionally, don't check relation permissions - it's useful
|
|
-- to run this cluster-wide with a restricted account, and as tested
|
|
-- above explicit permission has to be granted for that.
|
|
GRANT EXECUTE ON FUNCTION bt_index_check(regclass) TO regress_bttest_role;
|
|
GRANT EXECUTE ON FUNCTION bt_index_parent_check(regclass) TO regress_bttest_role;
|
|
SET ROLE regress_bttest_role;
|
|
SELECT bt_index_check('bttest_a_idx');
|
|
SELECT bt_index_parent_check('bttest_a_idx');
|
|
RESET ROLE;
|
|
|
|
-- verify plain tables are rejected (error)
|
|
SELECT bt_index_check('bttest_a');
|
|
SELECT bt_index_parent_check('bttest_a');
|
|
|
|
-- verify non-existing indexes are rejected (error)
|
|
SELECT bt_index_check(17);
|
|
SELECT bt_index_parent_check(17);
|
|
|
|
-- verify wrong index types are rejected (error)
|
|
BEGIN;
|
|
CREATE INDEX bttest_a_brin_idx ON bttest_a USING brin(id);
|
|
SELECT bt_index_parent_check('bttest_a_brin_idx');
|
|
ROLLBACK;
|
|
|
|
-- normal check outside of xact
|
|
SELECT bt_index_check('bttest_a_idx');
|
|
-- more expansive test
|
|
SELECT bt_index_parent_check('bttest_b_idx');
|
|
|
|
BEGIN;
|
|
SELECT bt_index_check('bttest_a_idx');
|
|
SELECT bt_index_parent_check('bttest_b_idx');
|
|
-- make sure we don't have any leftover locks
|
|
SELECT * FROM pg_locks
|
|
WHERE relation = ANY(ARRAY['bttest_a', 'bttest_a_idx', 'bttest_b', 'bttest_b_idx']::regclass[])
|
|
AND pid = pg_backend_pid();
|
|
COMMIT;
|
|
|
|
--
|
|
-- Check that index expressions and predicates are run as the table's owner
|
|
--
|
|
TRUNCATE bttest_a;
|
|
INSERT INTO bttest_a SELECT * FROM generate_series(1, 1000);
|
|
ALTER TABLE bttest_a OWNER TO regress_bttest_role;
|
|
-- A dummy index function checking current_user
|
|
CREATE FUNCTION ifun(int8) RETURNS int8 AS $$
|
|
BEGIN
|
|
ASSERT current_user = 'regress_bttest_role',
|
|
format('ifun(%s) called by %s', $1, current_user);
|
|
RETURN $1;
|
|
END;
|
|
$$ LANGUAGE plpgsql IMMUTABLE;
|
|
|
|
CREATE INDEX bttest_a_expr_idx ON bttest_a ((ifun(id) + ifun(0)))
|
|
WHERE ifun(id + 10) > ifun(10);
|
|
|
|
SELECT bt_index_check('bttest_a_expr_idx');
|
|
|
|
-- cleanup
|
|
DROP TABLE bttest_a;
|
|
DROP TABLE bttest_b;
|
|
DROP FUNCTION ifun(int8);
|
|
DROP OWNED BY regress_bttest_role; -- permissions
|
|
DROP ROLE regress_bttest_role;
|