Re: How to stop script executions - Mailing list pgsql-general

From David G. Johnston
Subject Re: How to stop script executions
Date
Msg-id CAKFQuwaz9+QR+tLc59RWG7a5Y8HVfwQjQaDkKq+n1WfU5n1iSA@mail.gmail.com
Whole thread Raw
In response to Re: How to stop script executions  (Sameer Kumar <sameer.kumar@ashnik.com>)
Responses Re: How to stop script executions  (Dev Kumkar <devdas.kumkar@gmail.com>)
List pgsql-general
On Tue, Jul 26, 2016 at 9:21 AM, Sameer Kumar <sameer.kumar@ashnik.com> wrote:

Yeah these extensions are not present, are their any chances of running OS commands from database?

What do you mean by "from database"? I think you need to lay down your requirement and goal more clearly.

 
​Typically this means that given user only having psql, or some other backend protocol only, connect to the database are they able to execute arbitrary commands as the user running the PostgreSQL process on the host system.​

Untrusted langauges are untrusted for specifically this reason.  Without untrusted languages it requires privilege escalation to interact dynamically with the host operating system.

Assuming raised privileges it is presently impossible to prevent such dynamic interaction.

David J.

pgsql-general by date:

Previous
From: "David G. Johnston"
Date:
Subject: Re: How to stop script executions
Next
From: Dev Kumkar
Date:
Subject: Re: How to stop script executions