pgsql: Make standard maintenance operations (including VACUUM, ANALYZE, - Mailing list pgsql-committers

Log Message:
-----------
Make standard maintenance operations (including VACUUM, ANALYZE, REINDEX,
and CLUSTER) execute as the table owner rather than the calling user, using
the same privilege-switching mechanism already used for SECURITY DEFINER
functions.  The purpose of this change is to ensure that user-defined
functions used in index definitions cannot acquire the privileges of a
superuser account that is performing routine maintenance.  While a function
used in an index is supposed to be IMMUTABLE and thus not able to do anything
very interesting, there are several easy ways around that restriction; and
even if we could plug them all, there would remain a risk of reading sensitive
information and broadcasting it through a covert channel such as CPU usage.

To prevent bypassing this security measure, execution of SET SESSION
AUTHORIZATION and SET ROLE is now forbidden within a SECURITY DEFINER context.

Thanks to Itagaki Takahiro for reporting this vulnerability.

Security: CVE-2007-6600

Tags:
----
REL8_2_STABLE

Modified Files:
--------------
    pgsql/doc/src/sgml/ref:
        set_role.sgml (r1.3 -> r1.3.2.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/set_role.sgml?r1=1.3&r2=1.3.2.1)
        set_session_auth.sgml (r1.15 -> r1.15.2.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/set_session_auth.sgml?r1=1.15&r2=1.15.2.1)
        show.sgml (r1.42 -> r1.42.2.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/show.sgml?r1=1.42&r2=1.42.2.1)
    pgsql/src/backend/access/transam:
        xact.c (r1.229.2.2 -> r1.229.2.3)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/access/transam/xact.c?r1=1.229.2.2&r2=1.229.2.3)
    pgsql/src/backend/catalog:
        index.c (r1.274.2.1 -> r1.274.2.2)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/catalog/index.c?r1=1.274.2.1&r2=1.274.2.2)
    pgsql/src/backend/commands:
        analyze.c (r1.101 -> r1.101.2.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/analyze.c?r1=1.101&r2=1.101.2.1)
        schemacmds.c (r1.41 -> r1.41.2.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/schemacmds.c?r1=1.41&r2=1.41.2.1)
        vacuum.c (r1.342.2.3 -> r1.342.2.4)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/vacuum.c?r1=1.342.2.3&r2=1.342.2.4)
        variable.c (r1.119 -> r1.119.2.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/variable.c?r1=1.119&r2=1.119.2.1)
    pgsql/src/backend/utils/adt:
        ri_triggers.c (r1.89.2.1 -> r1.89.2.2)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/ri_triggers.c?r1=1.89.2.1&r2=1.89.2.2)
    pgsql/src/backend/utils/fmgr:
        fmgr.c (r1.102.2.1 -> r1.102.2.2)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/fmgr/fmgr.c?r1=1.102.2.1&r2=1.102.2.2)
    pgsql/src/backend/utils/init:
        miscinit.c (r1.159 -> r1.159.2.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/init/miscinit.c?r1=1.159&r2=1.159.2.1)
    pgsql/src/include:
        miscadmin.h (r1.190 -> r1.190.2.1)
        (http://developer.postgresql.org/cvsweb.cgi/pgsql/src/include/miscadmin.h?r1=1.190&r2=1.190.2.1)