Skip to content

Commit 13d8388

Browse files
tglsfdctglsfdc
committed
Fix missed corner cases for grantable permissions on GUCs.
We allow users to set the values of not-yet-loaded extension GUCs, remembering those values in "placeholder" GUC entries. When/if the extension is loaded later in the session, we need to verify that the user had permissions to set the GUC. That was done correctly before commit a0ffa88, but as of that commit, we'd check the permissions of the active role when the LOAD happens, not the role that had set the value. (This'd be a security bug if it had made it into a released version.) In principle this is simple enough to fix: we just need to remember the exact role OID that set each GUC value, and use that not GetUserID() when verifying permissions. Maintaining that data in the guc.c data structures is slightly tedious, but fortunately it's all basically just copy-n-paste of the logic for tracking the GucSource of each setting, as we were already doing. Another oversight is that validate_option_array_item() hadn't been taught to check for granted GUC privileges. This appears to manifest only in that ALTER ROLE/DATABASE RESET ALL will fail to reset settings that the user should be allowed to reset. Patch by myself and Nathan Bossart, per report from Nathan Bossart. Back-patch to v15 where the faulty code came in. Discussion: https://postgr.es/m/20220706224727.GA2158260@nathanxps13
1 parent d6a3aeb commit 13d8388

File tree

8 files changed

+280
-59
lines changed

8 files changed

+280
-59
lines changed

‎src/backend/commands/extension.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -912,6 +912,9 @@ execute_extension_script(Oid extensionOid, ExtensionControlFile *control,
912912
* We use the equivalent of a function SET option to allow the setting to
913913
* persist for exactly the duration of the script execution. guc.c also
914914
* takes care of undoing the setting on error.
915+
*
916+
* log_min_messages can't be set by ordinary users, so for that one we
917+
* pretend to be superuser.
915918
*/
916919
save_nestlevel = NewGUCNestLevel();
917920

@@ -920,9 +923,10 @@ execute_extension_script(Oid extensionOid, ExtensionControlFile *control,
920923
PGC_USERSET, PGC_S_SESSION,
921924
GUC_ACTION_SAVE, true, 0, false);
922925
if (log_min_messages < WARNING)
923-
(void) set_config_option("log_min_messages", "warning",
924-
PGC_SUSET, PGC_S_SESSION,
925-
GUC_ACTION_SAVE, true, 0, false);
926+
(void) set_config_option_ext("log_min_messages", "warning",
927+
PGC_SUSET, PGC_S_SESSION,
928+
BOOTSTRAP_SUPERUSERID,
929+
GUC_ACTION_SAVE, true, 0, false);
926930

927931
/*
928932
* Similarly disable check_function_bodies, to ensure that SQL functions

0 commit comments

Comments
 (0)