Re: Non-superuser subscription owners - Mailing list pgsql-hackers

From Andres Freund
Subject Re: Non-superuser subscription owners
Date
Msg-id 20230121221057.cegjbybv4istuwme@awork3.anarazel.de
Whole thread Raw
In response to Re: Non-superuser subscription owners  (Robert Haas <robertmhaas@gmail.com>)
Responses Re: Non-superuser subscription owners
List pgsql-hackers
Hi,

On 2023-01-20 11:08:54 -0500, Robert Haas wrote:
>  /*
> - * Validate connection info string (just try to parse it)
> + * Validate connection info string, and determine whether it might cause
> + * local filesystem access to be attempted.
> + *
> + * If the connection string can't be parsed, this function will raise
> + * an error and will not return. If it can, it will return true if local
> + * filesystem access may be attempted and false otherwise.
>   */
> -static void
> +static bool
>  libpqrcv_check_conninfo(const char *conninfo)
>  {
>      PQconninfoOption *opts = NULL;
> +    PQconninfoOption *opt;
>      char       *err = NULL;
> +    bool        result = false;
>  
>      opts = PQconninfoParse(conninfo, &err);
>      if (opts == NULL)
> @@ -267,7 +274,40 @@ libpqrcv_check_conninfo(const char *conninfo)
>                   errmsg("invalid connection string syntax: %s", errcopy)));
>      }
>  
> +    for (opt = opts; opt->keyword != NULL; ++opt)
> +    {
> +        /* Ignore connection options that are not present. */
> +        if (opt->val == NULL)
> +            continue;
> +
> +        /* For all these parameters, the value is a local filename. */
> +        if (strcmp(opt->keyword, "passfile") == 0 ||
> +            strcmp(opt->keyword, "sslcert") == 0 ||
> +            strcmp(opt->keyword, "sslkey") == 0 ||
> +            strcmp(opt->keyword, "sslrootcert") == 0 ||
> +            strcmp(opt->keyword, "sslcrl") == 0 ||
> +            strcmp(opt->keyword, "sslcrldir") == 0 ||
> +            strcmp(opt->keyword, "service") == 0)
> +        {
> +            result = true;
> +            break;
> +        }

Do we need to think about 'options' allowing anything bad? I don't
immediately* see a problem, but ...


> +
> +        /*
> +         * For the host parameter, the value might be a local filename.
> +         * It might also be a reference to the local host's abstract UNIX
> +         * socket namespace, which we consider equivalent to a local pathname
> +         * for security purporses.
> +         */
> +        if (strcmp(opt->keyword, "host") == 0 && is_unixsock_path(opt->val))
> +        {
> +            result = true;
> +            break;
> +        }
> +    }

Hm, what about kerberos / gss / SSPI? Aren't those essentially also tied to
the local filesystem / user?

Greetings,

Andres Freund



pgsql-hackers by date:

Previous
From: Peter Geoghegan
Date:
Subject: Re: run pgindent on a regular basis / scripted manner
Next
From: Tom Lane
Date:
Subject: Re: run pgindent on a regular basis / scripted manner