mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-09-30 22:41:15 +02:00
Again match pg_user_mappings to information_schema.user_mapping_options.
Commit 3eefc51053
claimed to make
pg_user_mappings enforce the qualifications user_mapping_options had
been enforcing, but its removal of a longstanding restriction left them
distinct when the current user is the subject of a mapping yet has no
server privileges. user_mapping_options emits no rows for such a
mapping, but pg_user_mappings includes full umoptions. Change
pg_user_mappings to show null for umoptions. Back-patch to 9.2, like
the above commit.
Reviewed by Tom Lane. Reported by Jeff Janes.
Security: CVE-2017-7547
This commit is contained in:
parent
bf6b9e9444
commit
e568e1eee4
@ -11099,17 +11099,37 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
|
|||||||
<entry><type>text[]</type></entry>
|
<entry><type>text[]</type></entry>
|
||||||
<entry></entry>
|
<entry></entry>
|
||||||
<entry>
|
<entry>
|
||||||
User mapping specific options, as <quote>keyword=value</>
|
User mapping specific options, as <quote>keyword=value</> strings
|
||||||
strings. This column will show as null unless the current user
|
|
||||||
is the user being mapped, or the mapping is for
|
|
||||||
<literal>PUBLIC</literal> and the current user is the server
|
|
||||||
owner, or the current user is a superuser. The intent is
|
|
||||||
to protect password information stored as user mapping option.
|
|
||||||
</entry>
|
</entry>
|
||||||
</row>
|
</row>
|
||||||
</tbody>
|
</tbody>
|
||||||
</tgroup>
|
</tgroup>
|
||||||
</table>
|
</table>
|
||||||
|
|
||||||
|
<para>
|
||||||
|
To protect password information stored as a user mapping option,
|
||||||
|
the <structfield>umoptions</structfield> column will read as null
|
||||||
|
unless one of the following applies:
|
||||||
|
<itemizedlist>
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
current user is the user being mapped, and owns the server or
|
||||||
|
holds <literal>USAGE</> privilege on it
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
current user is the server owner and mapping is for <literal>PUBLIC</>
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
<listitem>
|
||||||
|
<para>
|
||||||
|
current user is a superuser
|
||||||
|
</para>
|
||||||
|
</listitem>
|
||||||
|
</itemizedlist>
|
||||||
|
</para>
|
||||||
|
|
||||||
</sect1>
|
</sect1>
|
||||||
|
|
||||||
|
|
||||||
|
@ -910,7 +910,9 @@ CREATE VIEW pg_user_mappings AS
|
|||||||
ELSE
|
ELSE
|
||||||
A.rolname
|
A.rolname
|
||||||
END AS usename,
|
END AS usename,
|
||||||
CASE WHEN (U.umuser <> 0 AND A.rolname = current_user)
|
CASE WHEN (U.umuser <> 0 AND A.rolname = current_user
|
||||||
|
AND (pg_has_role(S.srvowner, 'USAGE')
|
||||||
|
OR has_server_privilege(S.oid, 'USAGE')))
|
||||||
OR (U.umuser = 0 AND pg_has_role(S.srvowner, 'USAGE'))
|
OR (U.umuser = 0 AND pg_has_role(S.srvowner, 'USAGE'))
|
||||||
OR (SELECT rolsuper FROM pg_authid WHERE rolname = current_user)
|
OR (SELECT rolsuper FROM pg_authid WHERE rolname = current_user)
|
||||||
THEN U.umoptions
|
THEN U.umoptions
|
||||||
|
@ -1185,10 +1185,11 @@ ERROR: permission denied for foreign-data wrapper foo
|
|||||||
ALTER SERVER s9 VERSION '1.1';
|
ALTER SERVER s9 VERSION '1.1';
|
||||||
GRANT USAGE ON FOREIGN SERVER s9 TO regress_test_role;
|
GRANT USAGE ON FOREIGN SERVER s9 TO regress_test_role;
|
||||||
CREATE USER MAPPING FOR current_user SERVER s9;
|
CREATE USER MAPPING FOR current_user SERVER s9;
|
||||||
|
-- We use terse mode to avoid ordering issues in cascade detail output.
|
||||||
|
\set VERBOSITY terse
|
||||||
DROP SERVER s9 CASCADE;
|
DROP SERVER s9 CASCADE;
|
||||||
NOTICE: drop cascades to 2 other objects
|
NOTICE: drop cascades to 2 other objects
|
||||||
DETAIL: drop cascades to user mapping for public on server s9
|
\set VERBOSITY default
|
||||||
drop cascades to user mapping for regress_unprivileged_role on server s9
|
|
||||||
RESET ROLE;
|
RESET ROLE;
|
||||||
CREATE SERVER s9 FOREIGN DATA WRAPPER foo;
|
CREATE SERVER s9 FOREIGN DATA WRAPPER foo;
|
||||||
GRANT USAGE ON FOREIGN SERVER s9 TO regress_unprivileged_role;
|
GRANT USAGE ON FOREIGN SERVER s9 TO regress_unprivileged_role;
|
||||||
@ -1204,13 +1205,14 @@ ERROR: must be owner of foreign server s9
|
|||||||
SET ROLE regress_test_role;
|
SET ROLE regress_test_role;
|
||||||
CREATE SERVER s10 FOREIGN DATA WRAPPER foo;
|
CREATE SERVER s10 FOREIGN DATA WRAPPER foo;
|
||||||
CREATE USER MAPPING FOR public SERVER s10 OPTIONS (user 'secret');
|
CREATE USER MAPPING FOR public SERVER s10 OPTIONS (user 'secret');
|
||||||
GRANT USAGE ON FOREIGN SERVER s10 TO regress_unprivileged_role;
|
CREATE USER MAPPING FOR regress_unprivileged_role SERVER s10 OPTIONS (user 'secret');
|
||||||
-- owner of server can see option fields
|
-- owner of server can see some option fields
|
||||||
\deu+
|
\deu+
|
||||||
List of user mappings
|
List of user mappings
|
||||||
Server | User name | FDW options
|
Server | User name | FDW options
|
||||||
--------+---------------------------+-------------------
|
--------+---------------------------+-------------------
|
||||||
s10 | public | ("user" 'secret')
|
s10 | public | ("user" 'secret')
|
||||||
|
s10 | regress_unprivileged_role |
|
||||||
s4 | regress_foreign_data_user |
|
s4 | regress_foreign_data_user |
|
||||||
s5 | regress_test_role | (modified '1')
|
s5 | regress_test_role | (modified '1')
|
||||||
s6 | regress_test_role |
|
s6 | regress_test_role |
|
||||||
@ -1218,15 +1220,16 @@ GRANT USAGE ON FOREIGN SERVER s10 TO regress_unprivileged_role;
|
|||||||
s8 | regress_foreign_data_user |
|
s8 | regress_foreign_data_user |
|
||||||
s9 | regress_unprivileged_role |
|
s9 | regress_unprivileged_role |
|
||||||
t1 | public | (modified '1')
|
t1 | public | (modified '1')
|
||||||
(8 rows)
|
(9 rows)
|
||||||
|
|
||||||
RESET ROLE;
|
RESET ROLE;
|
||||||
-- superuser can see option fields
|
-- superuser can see all option fields
|
||||||
\deu+
|
\deu+
|
||||||
List of user mappings
|
List of user mappings
|
||||||
Server | User name | FDW options
|
Server | User name | FDW options
|
||||||
--------+---------------------------+---------------------
|
--------+---------------------------+---------------------
|
||||||
s10 | public | ("user" 'secret')
|
s10 | public | ("user" 'secret')
|
||||||
|
s10 | regress_unprivileged_role | ("user" 'secret')
|
||||||
s4 | regress_foreign_data_user |
|
s4 | regress_foreign_data_user |
|
||||||
s5 | regress_test_role | (modified '1')
|
s5 | regress_test_role | (modified '1')
|
||||||
s6 | regress_test_role |
|
s6 | regress_test_role |
|
||||||
@ -1234,15 +1237,16 @@ RESET ROLE;
|
|||||||
s8 | regress_foreign_data_user | (password 'public')
|
s8 | regress_foreign_data_user | (password 'public')
|
||||||
s9 | regress_unprivileged_role |
|
s9 | regress_unprivileged_role |
|
||||||
t1 | public | (modified '1')
|
t1 | public | (modified '1')
|
||||||
(8 rows)
|
(9 rows)
|
||||||
|
|
||||||
-- unprivileged user cannot see option fields
|
-- unprivileged user cannot see any option field
|
||||||
SET ROLE regress_unprivileged_role;
|
SET ROLE regress_unprivileged_role;
|
||||||
\deu+
|
\deu+
|
||||||
List of user mappings
|
List of user mappings
|
||||||
Server | User name | FDW options
|
Server | User name | FDW options
|
||||||
--------+---------------------------+-------------
|
--------+---------------------------+-------------
|
||||||
s10 | public |
|
s10 | public |
|
||||||
|
s10 | regress_unprivileged_role |
|
||||||
s4 | regress_foreign_data_user |
|
s4 | regress_foreign_data_user |
|
||||||
s5 | regress_test_role |
|
s5 | regress_test_role |
|
||||||
s6 | regress_test_role |
|
s6 | regress_test_role |
|
||||||
@ -1250,11 +1254,13 @@ SET ROLE regress_unprivileged_role;
|
|||||||
s8 | regress_foreign_data_user |
|
s8 | regress_foreign_data_user |
|
||||||
s9 | regress_unprivileged_role |
|
s9 | regress_unprivileged_role |
|
||||||
t1 | public |
|
t1 | public |
|
||||||
(8 rows)
|
(9 rows)
|
||||||
|
|
||||||
RESET ROLE;
|
RESET ROLE;
|
||||||
|
\set VERBOSITY terse
|
||||||
DROP SERVER s10 CASCADE;
|
DROP SERVER s10 CASCADE;
|
||||||
NOTICE: drop cascades to user mapping for public on server s10
|
NOTICE: drop cascades to 2 other objects
|
||||||
|
\set VERBOSITY default
|
||||||
-- Triggers
|
-- Triggers
|
||||||
CREATE FUNCTION dummy_trigger() RETURNS TRIGGER AS $$
|
CREATE FUNCTION dummy_trigger() RETURNS TRIGGER AS $$
|
||||||
BEGIN
|
BEGIN
|
||||||
@ -1596,15 +1602,12 @@ Inherits: pt1
|
|||||||
Child tables: ct3,
|
Child tables: ct3,
|
||||||
ft3
|
ft3
|
||||||
|
|
||||||
|
\set VERBOSITY terse
|
||||||
DROP FOREIGN TABLE ft2; -- ERROR
|
DROP FOREIGN TABLE ft2; -- ERROR
|
||||||
ERROR: cannot drop foreign table ft2 because other objects depend on it
|
ERROR: cannot drop foreign table ft2 because other objects depend on it
|
||||||
DETAIL: table ct3 depends on foreign table ft2
|
|
||||||
foreign table ft3 depends on foreign table ft2
|
|
||||||
HINT: Use DROP ... CASCADE to drop the dependent objects too.
|
|
||||||
DROP FOREIGN TABLE ft2 CASCADE;
|
DROP FOREIGN TABLE ft2 CASCADE;
|
||||||
NOTICE: drop cascades to 2 other objects
|
NOTICE: drop cascades to 2 other objects
|
||||||
DETAIL: drop cascades to table ct3
|
\set VERBOSITY default
|
||||||
drop cascades to foreign table ft3
|
|
||||||
CREATE FOREIGN TABLE ft2 (
|
CREATE FOREIGN TABLE ft2 (
|
||||||
c1 integer NOT NULL,
|
c1 integer NOT NULL,
|
||||||
c2 text,
|
c2 text,
|
||||||
@ -2026,16 +2029,12 @@ owner of user mapping for regress_test_role on server s6
|
|||||||
DROP SERVER t1 CASCADE;
|
DROP SERVER t1 CASCADE;
|
||||||
NOTICE: drop cascades to user mapping for public on server t1
|
NOTICE: drop cascades to user mapping for public on server t1
|
||||||
DROP USER MAPPING FOR regress_test_role SERVER s6;
|
DROP USER MAPPING FOR regress_test_role SERVER s6;
|
||||||
-- This test causes some order dependent cascade detail output,
|
|
||||||
-- so switch to terse mode for it.
|
|
||||||
\set VERBOSITY terse
|
\set VERBOSITY terse
|
||||||
DROP FOREIGN DATA WRAPPER foo CASCADE;
|
DROP FOREIGN DATA WRAPPER foo CASCADE;
|
||||||
NOTICE: drop cascades to 5 other objects
|
NOTICE: drop cascades to 5 other objects
|
||||||
\set VERBOSITY default
|
|
||||||
DROP SERVER s8 CASCADE;
|
DROP SERVER s8 CASCADE;
|
||||||
NOTICE: drop cascades to 2 other objects
|
NOTICE: drop cascades to 2 other objects
|
||||||
DETAIL: drop cascades to user mapping for regress_foreign_data_user on server s8
|
\set VERBOSITY default
|
||||||
drop cascades to user mapping for public on server s8
|
|
||||||
DROP ROLE regress_test_indirect;
|
DROP ROLE regress_test_indirect;
|
||||||
DROP ROLE regress_test_role;
|
DROP ROLE regress_test_role;
|
||||||
DROP ROLE regress_unprivileged_role; -- ERROR
|
DROP ROLE regress_unprivileged_role; -- ERROR
|
||||||
|
@ -2228,7 +2228,7 @@ pg_user_mappings| SELECT u.oid AS umid,
|
|||||||
ELSE a.rolname
|
ELSE a.rolname
|
||||||
END AS usename,
|
END AS usename,
|
||||||
CASE
|
CASE
|
||||||
WHEN (((u.umuser <> (0)::oid) AND (a.rolname = CURRENT_USER)) OR ((u.umuser = (0)::oid) AND pg_has_role(s.srvowner, 'USAGE'::text)) OR ( SELECT pg_authid.rolsuper
|
WHEN (((u.umuser <> (0)::oid) AND (a.rolname = CURRENT_USER) AND (pg_has_role(s.srvowner, 'USAGE'::text) OR has_server_privilege(s.oid, 'USAGE'::text))) OR ((u.umuser = (0)::oid) AND pg_has_role(s.srvowner, 'USAGE'::text)) OR ( SELECT pg_authid.rolsuper
|
||||||
FROM pg_authid
|
FROM pg_authid
|
||||||
WHERE (pg_authid.rolname = CURRENT_USER))) THEN u.umoptions
|
WHERE (pg_authid.rolname = CURRENT_USER))) THEN u.umoptions
|
||||||
ELSE NULL::text[]
|
ELSE NULL::text[]
|
||||||
|
@ -484,7 +484,10 @@ CREATE SERVER s10 FOREIGN DATA WRAPPER foo; -- ERROR
|
|||||||
ALTER SERVER s9 VERSION '1.1';
|
ALTER SERVER s9 VERSION '1.1';
|
||||||
GRANT USAGE ON FOREIGN SERVER s9 TO regress_test_role;
|
GRANT USAGE ON FOREIGN SERVER s9 TO regress_test_role;
|
||||||
CREATE USER MAPPING FOR current_user SERVER s9;
|
CREATE USER MAPPING FOR current_user SERVER s9;
|
||||||
|
-- We use terse mode to avoid ordering issues in cascade detail output.
|
||||||
|
\set VERBOSITY terse
|
||||||
DROP SERVER s9 CASCADE;
|
DROP SERVER s9 CASCADE;
|
||||||
|
\set VERBOSITY default
|
||||||
RESET ROLE;
|
RESET ROLE;
|
||||||
CREATE SERVER s9 FOREIGN DATA WRAPPER foo;
|
CREATE SERVER s9 FOREIGN DATA WRAPPER foo;
|
||||||
GRANT USAGE ON FOREIGN SERVER s9 TO regress_unprivileged_role;
|
GRANT USAGE ON FOREIGN SERVER s9 TO regress_unprivileged_role;
|
||||||
@ -498,17 +501,19 @@ DROP SERVER s9 CASCADE; -- ERROR
|
|||||||
SET ROLE regress_test_role;
|
SET ROLE regress_test_role;
|
||||||
CREATE SERVER s10 FOREIGN DATA WRAPPER foo;
|
CREATE SERVER s10 FOREIGN DATA WRAPPER foo;
|
||||||
CREATE USER MAPPING FOR public SERVER s10 OPTIONS (user 'secret');
|
CREATE USER MAPPING FOR public SERVER s10 OPTIONS (user 'secret');
|
||||||
GRANT USAGE ON FOREIGN SERVER s10 TO regress_unprivileged_role;
|
CREATE USER MAPPING FOR regress_unprivileged_role SERVER s10 OPTIONS (user 'secret');
|
||||||
-- owner of server can see option fields
|
-- owner of server can see some option fields
|
||||||
\deu+
|
\deu+
|
||||||
RESET ROLE;
|
RESET ROLE;
|
||||||
-- superuser can see option fields
|
-- superuser can see all option fields
|
||||||
\deu+
|
\deu+
|
||||||
-- unprivileged user cannot see option fields
|
-- unprivileged user cannot see any option field
|
||||||
SET ROLE regress_unprivileged_role;
|
SET ROLE regress_unprivileged_role;
|
||||||
\deu+
|
\deu+
|
||||||
RESET ROLE;
|
RESET ROLE;
|
||||||
|
\set VERBOSITY terse
|
||||||
DROP SERVER s10 CASCADE;
|
DROP SERVER s10 CASCADE;
|
||||||
|
\set VERBOSITY default
|
||||||
|
|
||||||
-- Triggers
|
-- Triggers
|
||||||
CREATE FUNCTION dummy_trigger() RETURNS TRIGGER AS $$
|
CREATE FUNCTION dummy_trigger() RETURNS TRIGGER AS $$
|
||||||
@ -638,8 +643,10 @@ SELECT relname, conname, contype, conislocal, coninhcount, connoinherit
|
|||||||
-- child does not inherit NO INHERIT constraints
|
-- child does not inherit NO INHERIT constraints
|
||||||
\d+ pt1
|
\d+ pt1
|
||||||
\d+ ft2
|
\d+ ft2
|
||||||
|
\set VERBOSITY terse
|
||||||
DROP FOREIGN TABLE ft2; -- ERROR
|
DROP FOREIGN TABLE ft2; -- ERROR
|
||||||
DROP FOREIGN TABLE ft2 CASCADE;
|
DROP FOREIGN TABLE ft2 CASCADE;
|
||||||
|
\set VERBOSITY default
|
||||||
CREATE FOREIGN TABLE ft2 (
|
CREATE FOREIGN TABLE ft2 (
|
||||||
c1 integer NOT NULL,
|
c1 integer NOT NULL,
|
||||||
c2 text,
|
c2 text,
|
||||||
@ -784,12 +791,10 @@ DROP SCHEMA foreign_schema CASCADE;
|
|||||||
DROP ROLE regress_test_role; -- ERROR
|
DROP ROLE regress_test_role; -- ERROR
|
||||||
DROP SERVER t1 CASCADE;
|
DROP SERVER t1 CASCADE;
|
||||||
DROP USER MAPPING FOR regress_test_role SERVER s6;
|
DROP USER MAPPING FOR regress_test_role SERVER s6;
|
||||||
-- This test causes some order dependent cascade detail output,
|
|
||||||
-- so switch to terse mode for it.
|
|
||||||
\set VERBOSITY terse
|
\set VERBOSITY terse
|
||||||
DROP FOREIGN DATA WRAPPER foo CASCADE;
|
DROP FOREIGN DATA WRAPPER foo CASCADE;
|
||||||
\set VERBOSITY default
|
|
||||||
DROP SERVER s8 CASCADE;
|
DROP SERVER s8 CASCADE;
|
||||||
|
\set VERBOSITY default
|
||||||
DROP ROLE regress_test_indirect;
|
DROP ROLE regress_test_indirect;
|
||||||
DROP ROLE regress_test_role;
|
DROP ROLE regress_test_role;
|
||||||
DROP ROLE regress_unprivileged_role; -- ERROR
|
DROP ROLE regress_unprivileged_role; -- ERROR
|
||||||
|
Loading…
Reference in New Issue
Block a user