Re: in-catalog Extension Scripts and Control parameters (templates?) - Mailing list pgsql-hackers

From Robert Haas
Subject Re: in-catalog Extension Scripts and Control parameters (templates?)
Date
Msg-id CA+TgmoaECR8QuUZ7uGJ_cWTfSmxhMuVT3Qzx20V=x7WxnKY57Q@mail.gmail.com
Whole thread Raw
In response to Re: in-catalog Extension Scripts and Control parameters (templates?)  (Heikki Linnakangas <hlinnakangas@vmware.com>)
Responses Re: in-catalog Extension Scripts and Control parameters (templates?)
List pgsql-hackers
On Wed, Mar 27, 2013 at 10:16 AM, Heikki Linnakangas
<hlinnakangas@vmware.com> wrote:
> I'm quite worried about the security ramifications of this patch. Today, if
> you're not sure if a system has e.g sslinfo installed, you can safely just
> run "CREATE EXTENSION sslinfo". With this patch, that's no longer true,
> because "foo" might not be the extension you're looking for. Mallory
> might've done this:
>
> create template for extension sslinfo version '1.0' with (schema public) as
> $$ DO EVIL STUFF $$;

Surely creating an extension template must be a superuser-only
operation, in which case this is an issue because Mallory could also
have just blown up the world directly if he's already a superuser
anyway.

If the current patch isn't enforcing that, it's 100% broken.

-- 
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company



pgsql-hackers by date:

Previous
From: Robert Haas
Date:
Subject: Re: [COMMITTERS] pgsql: Allow external recovery_config_directory
Next
From: Heikki Linnakangas
Date:
Subject: Re: in-catalog Extension Scripts and Control parameters (templates?)