postgresql/doc
Michael Paquier 87330e21c3 Restrict access to reindex of shared catalogs for non-privileged users
A database owner running a database-level REINDEX has the possibility to
also do the operation on shared system catalogs without being an owner
of them, which allows him to block resources it should not have access
to.  The same goes for a schema owner.  For example, PostgreSQL would go
unresponsive and even block authentication if a lock is waited for
pg_authid.  This commit makes sure that a user running a REINDEX SYSTEM,
DATABASE or SCHEMA only works on the following relations:
- The user is a superuser
- The user is the table owner
- The user is the database/schema owner, only if the relation worked on
is not shared.

Robert has worded most the documentation changes, and I have coded the
core part.

Reported-by: Lloyd Albin, Jeremy Schneider
Author: Michael Paquier, Robert Haas
Reviewed by: Nathan Bossart, Kyotaro Horiguchi
Discussion: https://postgr.es/m/152512087100.19803.12733865831237526317@wrigleys.postgresql.org
Discussion: https://postgr.es/m/20180805211059.GA2185@paquier.xyz
Backpatch-through: 11- as the current behavior has been around for a
very long time and could be disruptive for already released branches.
2018-08-09 09:40:27 +02:00
..
src Restrict access to reindex of shared catalogs for non-privileged users 2018-08-09 09:40:27 +02:00
bug.template Stamp 11beta3. 2018-08-06 16:02:42 -04:00
KNOWN_BUGS Remove extra newlines at end and beginning of files, add missing newlines 2010-08-19 05:57:36 +00:00
Makefile Remove maintainer-check target, fold into normal build 2013-10-10 20:11:56 -04:00
MISSING_FEATURES Remove extra newlines at end and beginning of files, add missing newlines 2010-08-19 05:57:36 +00:00
TODO Change documentation references to PG website to use https: not http: 2017-05-20 21:50:47 -04:00