Skip to content

Commit 50595b5

Browse files
committed
Use a separate interpreter for each calling SQL userid in plperl and pltcl.
There are numerous methods by which a Perl or Tcl function can subvert the behavior of another such function executed later; for example, by redefining standard functions or operators called by the target function. If the target function is SECURITY DEFINER, or is called by such a function, this means that any ordinary SQL user with Perl or Tcl language usage rights can do essentially anything with the privileges of the target function's owner. To close this security hole, create a separate Perl or Tcl interpreter for each SQL userid under which plperl or pltcl functions are executed within a session. However, all plperlu or pltclu functions run within a session still share a single interpreter, since they all execute at the trust level of a database superuser anyway. Note: this change results in a functionality loss when libperl has been built without the "multiplicity" option: it's no longer possible to call plperl functions under different userids in one session, since such a libperl can't support multiple interpreters in one process. However, such a libperl already failed to support concurrent use of plperl and plperlu, so it's likely that few people use such versions with Postgres. Security: CVE-2010-3433
1 parent 1f0eb5d commit 50595b5

12 files changed

+920
-396
lines changed

doc/src/sgml/installation.sgml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,11 @@ su - postgres
167167
recent <productname>Perl</productname> versions, but it was not
168168
in earlier versions, and in any case it is the choice of whomever
169169
installed Perl at your site.
170+
If you intend to make more than incidental use of
171+
<application>PL/Perl</application>, you should ensure that the
172+
<productname>Perl</productname> installation was built with the
173+
<literal>usemultiplicity</> option enabled (<literal>perl -V</>
174+
will show whether this is the case).
170175
</para>
171176

172177
<para>

doc/src/sgml/plperl.sgml

Lines changed: 86 additions & 64 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@
4141
<para>
4242
Users of source packages must specially enable the build of
4343
PL/Perl during the installation process. (Refer to <xref
44-
linkend="install-short"> for more information.) Users of
44+
linkend="installation"> for more information.) Users of
4545
binary packages might find PL/Perl in a separate subpackage.
4646
</para>
4747
</note>
@@ -101,7 +101,7 @@ $$ LANGUAGE plperl;
101101
most convenient to use dollar quoting (see <xref
102102
linkend="sql-syntax-dollar-quoting">) for the string constant.
103103
If you choose to use escape string syntax <literal>E''</>,
104-
you must double the single quote marks (<literal>'</>) and backslashes
104+
you must double any single quote marks (<literal>'</>) and backslashes
105105
(<literal>\</>) used in the body of the function
106106
(see <xref linkend="sql-syntax-strings">).
107107
</para>
@@ -829,10 +829,20 @@ $$ LANGUAGE plperl;
829829
</para>
830830

831831
<para>
832-
The <varname>%_SHARED</varname> variable and other global state within
833-
the language are public data, available to all PL/Perl functions within a
834-
session. Use with care, especially in situations that involve use of
835-
multiple roles or <literal>SECURITY DEFINER</> functions.
832+
For security reasons, PL/Perl executes functions called by any one SQL role
833+
in a separate Perl interpreter for that role. This prevents accidental or
834+
malicious interference by one user with the behavior of another user's
835+
PL/Perl functions. Each such interpreter has its own value of the
836+
<varname>%_SHARED</varname> variable and other global state. Thus, two
837+
PL/Perl functions will share the same value of <varname>%_SHARED</varname>
838+
if and only if they are executed by the same SQL role. In an application
839+
wherein a single session executes code under multiple SQL roles (via
840+
<literal>SECURITY DEFINER</> functions, use of <command>SET ROLE</>, etc)
841+
you may need to take explicit steps to ensure that PL/Perl functions can
842+
share data via <varname>%_SHARED</varname>. To do that, make sure that
843+
functions that should communicate are owned by the same user, and mark
844+
them <literal>SECURITY DEFINER</>. You must of course take care that
845+
such functions can't be used to do anything unintended.
836846
</para>
837847
</sect1>
838848

@@ -908,22 +918,31 @@ $$ LANGUAGE plperl;
908918
</para>
909919

910920
<note>
911-
<para>
912-
For security reasons, to stop a leak of privileged operations from
913-
<application>PL/PerlU</> to <application>PL/Perl</>, these two languages
914-
have to run in separate instances of the Perl interpreter. If your
915-
Perl installation has been appropriately compiled, this is not a problem.
916-
However, not all installations are compiled with the requisite flags.
917-
If <productname>PostgreSQL</> detects that this is the case then it will
918-
not start a second interpreter, but instead create an error. In
919-
consequence, in such an installation, you cannot use both
920-
<application>PL/PerlU</> and <application>PL/Perl</> in the same backend
921-
process. The remedy for this is to obtain a Perl installation configured
922-
with the appropriate flags, namely either <literal>usemultiplicity</>
923-
or <literal>useithreads</>. <literal>usemultiplicity</> is preferred
924-
unless you actually need to use threads. For more details, see the
925-
<citerefentry><refentrytitle>perlembed</></citerefentry> man page.
926-
</para>
921+
<para>
922+
While <application>PL/Perl</> functions run in a separate Perl
923+
interpreter for each SQL role, all <application>PL/PerlU</> functions
924+
executed in a given session run in a single Perl interpreter (which is
925+
not any of the ones used for <application>PL/Perl</> functions).
926+
This allows <application>PL/PerlU</> functions to share data freely,
927+
but no communication can occur between <application>PL/Perl</> and
928+
<application>PL/PerlU</> functions.
929+
</para>
930+
</note>
931+
932+
<note>
933+
<para>
934+
Perl cannot support multiple interpreters within one process unless
935+
it was built with the appropriate flags, namely either
936+
<literal>usemultiplicity</> or <literal>useithreads</>.
937+
(<literal>usemultiplicity</> is preferred unless you actually need
938+
to use threads. For more details, see the
939+
<citerefentry><refentrytitle>perlembed</></citerefentry> man page.)
940+
If <application>PL/Perl</> is used with a copy of Perl that was not built
941+
this way, then it is only possible to have one Perl interpreter per
942+
session, and so any one session can only execute either
943+
<application>PL/PerlU</> functions, or <application>PL/Perl</> functions
944+
that are all called by the same SQL role.
945+
</para>
927946
</note>
928947

929948
</sect1>
@@ -1137,12 +1156,13 @@ CREATE TRIGGER test_valid_id_trig
11371156
</indexterm>
11381157
<listitem>
11391158
<para>
1140-
Specifies Perl code to be executed when a Perl interpreter is first initialized
1141-
and before it is specialized for use by <literal>plperl</> or <literal>plperlu</>.
1142-
The SPI functions are not available when this code is executed.
1143-
If the code fails with an error it will abort the initialization of the interpreter
1144-
and propagate out to the calling query, causing the current transaction
1145-
or subtransaction to be aborted.
1159+
Specifies Perl code to be executed when a Perl interpreter is first
1160+
initialized, before it is specialized for use by <literal>plperl</> or
1161+
<literal>plperlu</>.
1162+
The SPI functions are not available when this code is executed.
1163+
If the code fails with an error it will abort the initialization of
1164+
the interpreter and propagate out to the calling query, causing the
1165+
current transaction or subtransaction to be aborted.
11461166
</para>
11471167
<para>
11481168
The Perl code is limited to a single string. Longer code can be placed
@@ -1162,9 +1182,21 @@ DO 'elog(WARNING, join ", ", sort keys %INC)' language plperl;
11621182
</programlisting>
11631183
</para>
11641184
<para>
1165-
Initialization will happen in the postmaster if the plperl library is included
1166-
in <literal>shared_preload_libraries</> (see <xref linkend="guc-shared-preload-libraries">),
1167-
in which case extra consideration should be given to the risk of destabilizing the postmaster.
1185+
Initialization will happen in the postmaster if the plperl library is
1186+
included in <xref linkend="guc-shared-preload-libraries">, in which
1187+
case extra consideration should be given to the risk of destabilizing
1188+
the postmaster. The principal reason for making use of this feature
1189+
is that Perl modules loaded by <literal>plperl.on_init</> need be
1190+
loaded only at postmaster start, and will be instantly available
1191+
without loading overhead in individual database sessions. However,
1192+
keep in mind that the overhead is avoided only for the first Perl
1193+
interpreter used by a database session &mdash; either PL/PerlU, or
1194+
PL/Perl for the first SQL role that calls a PL/Perl function. Any
1195+
additional Perl interpreters created in a database session will have
1196+
to execute <literal>plperl.on_init</> afresh. Also, on Windows there
1197+
will be no savings whatsoever from preloading, since the Perl
1198+
interpreter created in the postmaster process does not propagate to
1199+
child processes.
11681200
</para>
11691201
<para>
11701202
This parameter can only be set in the postgresql.conf file or on the server command line.
@@ -1183,41 +1215,30 @@ DO 'elog(WARNING, join ", ", sort keys %INC)' language plperl;
11831215
</indexterm>
11841216
<listitem>
11851217
<para>
1186-
These parameters specify Perl code to be executed when the
1187-
<literal>plperl</>, or <literal>plperlu</> language is first used in a
1188-
session. Changes to these parameters after the corresponding language
1189-
has been used will have no effect.
1190-
The SPI functions are not available when this code is executed.
1191-
Only superusers can change these settings.
1192-
The Perl code in <literal>plperl.on_plperl_init</> can only perform trusted operations.
1193-
</para>
1194-
<para>
1195-
The effect of setting these parameters is very similar to executing a
1196-
<literal>DO</> command with the Perl code before any other use of the
1197-
language. The parameters are useful when you want to execute the Perl
1198-
code automatically on every connection, or when a connection is not
1199-
interactive. The parameters can be used by non-superusers by having a
1200-
superuser execute an <literal>ALTER USER ... SET ...</> command.
1201-
For example:
1202-
<programlisting>
1203-
ALTER USER joe SET plperl.on_plperl_init = '$_SHARED{debug} = 1';
1204-
</programlisting>
1218+
These parameters specify Perl code to be executed when a Perl
1219+
interpreter is specialized for <literal>plperl</> or
1220+
<literal>plperlu</> respectively. This will happen when a PL/Perl or
1221+
PL/PerlU function is first executed in a database session, or when
1222+
an additional interpreter has to be created because the other language
1223+
is called or a PL/Perl function is called by a new SQL role. This
1224+
follows any initialization done by <literal>plperl.on_init</>.
1225+
The SPI functions are not available when this code is executed.
1226+
The Perl code in <literal>plperl.on_plperl_init</> is executed after
1227+
<quote>locking down</> the interpreter, and thus it can only perform
1228+
trusted operations.
12051229
</para>
12061230
<para>
1207-
If the code fails with an error it will abort the initialization and
1208-
propagate out to the calling query, causing the current transaction or
1209-
subtransaction to be aborted. Any changes within Perl won't be undone.
1210-
If the language is used again the initialization will be repeated.
1231+
If the code fails with an error it will abort the initialization and
1232+
propagate out to the calling query, causing the current transaction or
1233+
subtransaction to be aborted. Any actions already done within Perl
1234+
won't be undone; however, that interpreter won't be used again.
1235+
If the language is used again the initialization will be attempted
1236+
again within a fresh Perl interpreter.
12111237
</para>
12121238
<para>
1213-
The difference between these two settings and the
1214-
<literal>plperl.on_init</> setting is that these can be used for
1215-
settings specific to the trusted or untrusted language variant, such
1216-
as setting values in the <varname>%_SHARED</> variable. By contrast,
1217-
<literal>plperl.on_init</> is more useful for doing things like
1218-
setting the library search path for <productname>Perl</> or
1219-
loading Perl modules that don't interact directly with
1220-
<productname>PostgreSQL</>.
1239+
Only superusers can change these settings. Although these settings
1240+
can be changed within a session, such changes will not affect Perl
1241+
interpreters that have already been used to execute functions.
12211242
</para>
12221243
</listitem>
12231244
</varlistentry>
@@ -1229,8 +1250,9 @@ ALTER USER joe SET plperl.on_plperl_init = '$_SHARED{debug} = 1';
12291250
</indexterm>
12301251
<listitem>
12311252
<para>
1232-
When set true subsequent compilations of PL/Perl functions have the <literal>strict</> pragma enabled.
1233-
This parameter does not affect functions already compiled in the current session.
1253+
When set true subsequent compilations of PL/Perl functions will have
1254+
the <literal>strict</> pragma enabled. This parameter does not affect
1255+
functions already compiled in the current session.
12341256
</para>
12351257
</listitem>
12361258
</varlistentry>

doc/src/sgml/pltcl.sgml

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -214,14 +214,36 @@ $$ LANGUAGE pltcl;
214214
Sometimes it
215215
is useful to have some global data that is held between two
216216
calls to a function or is shared between different functions.
217-
This is easily done since
218-
all PL/Tcl functions executed in one session share the same
219-
safe Tcl interpreter. So, any global Tcl variable is accessible to
220-
all PL/Tcl function calls and will persist for the duration of the
221-
SQL session. (Note that <application>PL/TclU</> functions likewise share
222-
global data, but they are in a different Tcl interpreter and cannot
223-
communicate with PL/Tcl functions.)
217+
This is easily done in PL/Tcl, but there are some restrictions that
218+
must be understood.
224219
</para>
220+
221+
<para>
222+
For security reasons, PL/Tcl executes functions called by any one SQL
223+
role in a separate Tcl interpreter for that role. This prevents
224+
accidental or malicious interference by one user with the behavior of
225+
another user's PL/Tcl functions. Each such interpreter will have its own
226+
values for any <quote>global</> Tcl variables. Thus, two PL/Tcl
227+
functions will share the same global variables if and only if they are
228+
executed by the same SQL role. In an application wherein a single
229+
session executes code under multiple SQL roles (via <literal>SECURITY
230+
DEFINER</> functions, use of <command>SET ROLE</>, etc) you may need to
231+
take explicit steps to ensure that PL/Tcl functions can share data. To
232+
do that, make sure that functions that should communicate are owned by
233+
the same user, and mark them <literal>SECURITY DEFINER</>. You must of
234+
course take care that such functions can't be used to do anything
235+
unintended.
236+
</para>
237+
238+
<para>
239+
All PL/TclU functions used in a session execute in the same Tcl
240+
interpreter, which of course is distinct from the interpreter(s)
241+
used for PL/Tcl functions. So global data is automatically shared
242+
between PL/TclU functions. This is not considered a security risk
243+
because all PL/TclU functions execute at the same trust level,
244+
namely that of a database superuser.
245+
</para>
246+
225247
<para>
226248
To help protect PL/Tcl functions from unintentionally interfering
227249
with each other, a global
@@ -231,7 +253,9 @@ $$ LANGUAGE pltcl;
231253
<literal>GD</> be used
232254
for persistent private data of a function. Use regular Tcl global
233255
variables only for values that you specifically intend to be shared among
234-
multiple functions.
256+
multiple functions. (Note that the <literal>GD</> arrays are only
257+
global within a particular interpreter, so they do not bypass the
258+
security restrictions mentioned above.)
235259
</para>
236260

237261
<para>
@@ -691,8 +715,8 @@ CREATE TRIGGER trig_mytab_modcount BEFORE INSERT OR UPDATE ON mytab
691715
exists, the module <literal>unknown</> is fetched from the table
692716
and loaded into the Tcl interpreter immediately before the first
693717
execution of a PL/Tcl function in a database session. (This
694-
happens separately for PL/Tcl and PL/TclU, if both are used,
695-
because separate interpreters are used for the two languages.)
718+
happens separately for each Tcl interpreter, if more than one is
719+
used in a session; see <xref linkend="pltcl-global">.)
696720
</para>
697721
<para>
698722
While the <literal>unknown</> module could actually contain any

doc/src/sgml/release-7.4.sgml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,43 @@
3737

3838
<itemizedlist>
3939

40+
<listitem>
41+
<para>
42+
Use a separate interpreter for each calling SQL userid in PL/Perl and
43+
PL/Tcl (Tom Lane)
44+
</para>
45+
46+
<para>
47+
This change prevents security problems that can be caused by subverting
48+
Perl or Tcl code that will be executed later in the same session under
49+
another SQL user identity (for example, within a <literal>SECURITY
50+
DEFINER</> function). Most scripting languages offer numerous ways that
51+
that might be done, such as redefining standard functions or operators
52+
called by the target function. Without this change, any SQL user with
53+
Perl or Tcl language usage rights can do essentially anything with the
54+
SQL privileges of the target function's owner.
55+
</para>
56+
57+
<para>
58+
The cost of this change is that intentional communication among Perl
59+
and Tcl functions becomes more difficult. To provide an escape hatch,
60+
PL/PerlU and PL/TclU functions continue to use only one interpreter
61+
per session. This is not considered a security issue since all such
62+
functions execute at the trust level of a database superuser already.
63+
</para>
64+
65+
<para>
66+
It is likely that third-party procedural languages that claim to offer
67+
trusted execution have similar security issues. We advise contacting
68+
the authors of any PL you are depending on for security-critical
69+
purposes.
70+
</para>
71+
72+
<para>
73+
Our thanks to Tim Bunce for pointing out this issue (CVE-2010-3433).
74+
</para>
75+
</listitem>
76+
4077
<listitem>
4178
<para>
4279
Prevent possible crashes in <function>pg_get_expr()</> by disallowing

doc/src/sgml/release-8.0.sgml

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,43 @@
3737

3838
<itemizedlist>
3939

40+
<listitem>
41+
<para>
42+
Use a separate interpreter for each calling SQL userid in PL/Perl and
43+
PL/Tcl (Tom Lane)
44+
</para>
45+
46+
<para>
47+
This change prevents security problems that can be caused by subverting
48+
Perl or Tcl code that will be executed later in the same session under
49+
another SQL user identity (for example, within a <literal>SECURITY
50+
DEFINER</> function). Most scripting languages offer numerous ways that
51+
that might be done, such as redefining standard functions or operators
52+
called by the target function. Without this change, any SQL user with
53+
Perl or Tcl language usage rights can do essentially anything with the
54+
SQL privileges of the target function's owner.
55+
</para>
56+
57+
<para>
58+
The cost of this change is that intentional communication among Perl
59+
and Tcl functions becomes more difficult. To provide an escape hatch,
60+
PL/PerlU and PL/TclU functions continue to use only one interpreter
61+
per session. This is not considered a security issue since all such
62+
functions execute at the trust level of a database superuser already.
63+
</para>
64+
65+
<para>
66+
It is likely that third-party procedural languages that claim to offer
67+
trusted execution have similar security issues. We advise contacting
68+
the authors of any PL you are depending on for security-critical
69+
purposes.
70+
</para>
71+
72+
<para>
73+
Our thanks to Tim Bunce for pointing out this issue (CVE-2010-3433).
74+
</para>
75+
</listitem>
76+
4077
<listitem>
4178
<para>
4279
Prevent possible crashes in <function>pg_get_expr()</> by disallowing

0 commit comments

Comments
 (0)