Re: MAINTAIN privilege -- what do we need to un-revert it? - Mailing list pgsql-hackers

From Noah Misch
Subject Re: MAINTAIN privilege -- what do we need to un-revert it?
Date
Msg-id 20240630222344.db.nmisch@google.com
Whole thread Raw
In response to Re: MAINTAIN privilege -- what do we need to un-revert it?  (Jeff Davis <pgsql@j-davis.com>)
Responses Re: MAINTAIN privilege -- what do we need to un-revert it?
List pgsql-hackers
On Mon, Mar 04, 2024 at 07:52:05PM -0800, Jeff Davis wrote:
> Committed.

Commit 2af07e2 wrote:
> --- a/src/backend/access/brin/brin.c
> +++ b/src/backend/access/brin/brin.c
> @@ -1412,6 +1412,8 @@ brin_summarize_range(PG_FUNCTION_ARGS)
>          SetUserIdAndSecContext(heapRel->rd_rel->relowner,
>                                 save_sec_context | SECURITY_RESTRICTED_OPERATION);
>          save_nestlevel = NewGUCNestLevel();
> +        SetConfigOption("search_path", GUC_SAFE_SEARCH_PATH, PGC_USERSET,
> +                        PGC_S_SESSION);

I've audited NewGUCNestLevel() calls that didn't get this addition.  Among
those, these need the addition:

- Each in ComputeIndexAttrs() -- they arise when the caller is DefineIndex()
- In DefineIndex(), after comment "changed a behavior-affecting GUC"

While "not necessary for security", ExecCreateTableAs() should do it for the
same reason it calls NewGUCNestLevel().



pgsql-hackers by date:

Previous
From: "Fujii.Yuki@df.MitsubishiElectric.co.jp"
Date:
Subject: RE: Partial aggregates pushdown
Next
From: Noah Misch
Date:
Subject: Re: Faster "SET search_path"