yjhjstz opened a new pull request, #2049:
URL: https://github.com/apache/cloudberry/pull/2049
pg_file_write(text,text,bool), pg_file_rename(text,text,text),
pg_file_unlink(text) and pg_logdir_ls() had proacl = NULL (PUBLIC EXECUTE): any
role could create, overwrite, rename or delete files under the data/log
directory, including postgresql.auto.conf, and list the log directory, without
any GRANT.
Their catalog entries point at the _v1_1 C symbols, which intentionally have
no superuser check because they were designed to be paired with
contrib/adminpack's REVOKE (see adminpack--1.1--2.0.sql). The merge that
brought the _v1_1 function bodies into core (genfile.c) never carried over the
matching REVOKE, and the catalog bootstrap SQL was never updated either.
convert_and_check_filename()'s path confinement is a read-side check only and
was never a substitute for this.
Add superuser-or-pg_write_server_files checks in genfile.c (effective
immediately, no initdb needed) for the three write-side functions, and a
superuser-or-pg_read_server_files check for pg_logdir_ls(), which is a
read-side listing. Add the matching REVOKE/GRANT in system_functions.sql as
defense in depth for new initdbs. gp_toolkit's gp_move_orphaned_files, the one
in-tree caller, is run by administrators and is unaffected; contrib/adminpack
has its own copies of these C functions and is likewise unaffected.
New regression test bfv_genfile_privileges covers both layers: a plain role
is denied, pg_write_server_files/pg_read_server_files members and the superuser
are allowed, and — with EXECUTE explicitly granted, to simulate an upgraded
cluster where proacl stays NULL — genfile.c's own checks still deny the plain
role.
Ported from warehouse-pg/warehouse-pg#305. Adapted for the PG16-based
kernel: the REVOKEs live in system_functions.sql rather than system_views.sql,
the role OID symbols are ROLE_PG_{READ,WRITE}_SERVER_FILES, and the membership
tests use has_privs_of_role() to match the existing pg_read_server_files check
in convert_and_check_filename().
<!-- Thank you for your contribution to Apache Cloudberry (Incubating)! -->
Fixes #ISSUE_Number
### What does this PR do?
<!-- Brief overview of the changes, including any major features or fixes -->
### Type of Change
- [ ] Bug fix (non-breaking change)
- [ ] New feature (non-breaking change)
- [ ] Breaking change (fix or feature with breaking changes)
- [ ] Documentation update
### Breaking Changes
<!-- Remove if not applicable. If yes, explain impact and migration path -->
### Test Plan
<!-- How did you test these changes? -->
- [ ] Unit tests added/updated
- [ ] Integration tests added/updated
- [ ] Passed `make installcheck`
- [ ] Passed `make -C src/test installcheck-cbdb-parallel`
### Impact
<!-- Remove sections that don't apply -->
**Performance:**
<!-- Any performance implications? -->
**User-facing changes:**
<!-- Any changes visible to users? -->
**Dependencies:**
<!-- New dependencies or version changes? -->
### Checklist
- [ ] Followed [contribution
guide](https://cloudberry.apache.org/contribute/code)
- [ ] Added/updated documentation
- [ ] Reviewed code for security implications
- [ ] This PR contains AI-assisted code generation
- [ ] Requested review from [cloudberry
committers](https://github.com/orgs/apache/teams/cloudberry-committers)
### Additional Context
<!-- Any other information that would help reviewers? Remove if none -->
### CI Skip Instructions
<!--
To skip CI builds, add the appropriate CI skip identifier to your PR title.
The identifier must:
- Be in square brackets []
- Include the word "ci" and either "skip" or "no"
- Only use for documentation-only changes or when absolutely necessary
-->
---
<!-- Join our community:
- Mailing list:
[[email protected]](https://lists.apache.org/[email protected])
(subscribe: [email protected])
- Discussions: https://github.com/apache/cloudberry/discussions -->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
