From decfd72535ec245366d33465b0be627299423be7 Mon Sep 17 00:00:00 2001 From: Michael Paquier Date: Mon, 14 Aug 2017 11:15:31 +0900 Subject: [PATCH 2/3] Replace superuser checks of large object import/export by ACL checks The large object functions lo_import and lo_export are restricted to superusers since their creation, and since Postgres 10 it is possible to dump permission checks related to system functions. Let's remove those hardcoded checks and replace them wiht proper GRANT permissions at initialization. This also gives more flexibility to administrators. --- src/backend/catalog/system_views.sql | 4 ++++ src/backend/libpq/be-fsstubs.c | 12 ------------ src/test/regress/expected/privileges.out | 10 ++++++---- src/test/regress/sql/privileges.sql | 2 ++ 4 files changed, 12 insertions(+), 16 deletions(-) diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql index dc40cde424..cd7d0b208d 100644 --- a/src/backend/catalog/system_views.sql +++ b/src/backend/catalog/system_views.sql @@ -1121,6 +1121,10 @@ AS 'jsonb_insert'; -- system to REVOKE access to those functions at initdb time. Administrators -- can later change who can access these functions, or leave them as only -- available to superuser / cluster owner, if they choose. +REVOKE EXECUTE ON FUNCTION lo_import(text) FROM public; +REVOKE EXECUTE ON FUNCTION lo_import(text, oid) FROM public; +REVOKE EXECUTE ON FUNCTION lo_export(oid, text) FROM public; + REVOKE EXECUTE ON FUNCTION pg_start_backup(text, boolean, boolean) FROM public; REVOKE EXECUTE ON FUNCTION pg_stop_backup() FROM public; REVOKE EXECUTE ON FUNCTION pg_stop_backup(boolean, boolean) FROM public; diff --git a/src/backend/libpq/be-fsstubs.c b/src/backend/libpq/be-fsstubs.c index 9266d68569..50c70dd66d 100644 --- a/src/backend/libpq/be-fsstubs.c +++ b/src/backend/libpq/be-fsstubs.c @@ -448,12 +448,6 @@ lo_import_internal(text *filename, Oid lobjOid) LargeObjectDesc *lobj; Oid oid; - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("must be superuser to use server-side lo_import()"), - errhint("Anyone can use the client-side lo_import() provided by libpq."))); - CreateFSContext(); /* @@ -512,12 +506,6 @@ be_lo_export(PG_FUNCTION_ARGS) LargeObjectDesc *lobj; mode_t oumask; - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("must be superuser to use server-side lo_export()"), - errhint("Anyone can use the client-side lo_export() provided by libpq."))); - CreateFSContext(); /* diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index f37df6c709..7f3b7ac25d 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -1346,8 +1346,11 @@ ERROR: permission denied for large object 1002 SELECT lo_unlink(1002); -- to be denied ERROR: must be owner of large object 1002 SELECT lo_export(1001, '/dev/null'); -- to be denied -ERROR: must be superuser to use server-side lo_export() -HINT: Anyone can use the client-side lo_export() provided by libpq. +ERROR: permission denied for function lo_export +SELECT lo_import('/dev/null'); -- to be denied +ERROR: permission denied for function lo_import +SELECT lo_import('/dev/null', 2003); -- to be denied +ERROR: permission denied for function lo_import \c - SET lo_compat_privileges = true; -- compatibility mode SET SESSION AUTHORIZATION regress_user4; @@ -1376,8 +1379,7 @@ SELECT lo_unlink(1002); (1 row) SELECT lo_export(1001, '/dev/null'); -- to be denied -ERROR: must be superuser to use server-side lo_export() -HINT: Anyone can use the client-side lo_export() provided by libpq. +ERROR: permission denied for function lo_export -- don't allow unpriv users to access pg_largeobject contents \c - SELECT * FROM pg_largeobject LIMIT 0; diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql index e2c13e08a4..d22d08ca62 100644 --- a/src/test/regress/sql/privileges.sql +++ b/src/test/regress/sql/privileges.sql @@ -824,6 +824,8 @@ SELECT lo_truncate(lo_open(1002, x'20000'::int), 10); -- to be denied SELECT lo_put(1002, 1, 'abcd'); -- to be denied SELECT lo_unlink(1002); -- to be denied SELECT lo_export(1001, '/dev/null'); -- to be denied +SELECT lo_import('/dev/null'); -- to be denied +SELECT lo_import('/dev/null', 2003); -- to be denied \c - SET lo_compat_privileges = true; -- compatibility mode -- 2.14.1