On 03/02/2014 12:17 PM, Stephen Frost wrote: > The issue here is about how much effort to go to in order to secure the > PostgreSQL system that is started up to do the regression tests. It's > already set up to only listen on localhost and will run with only the > privileges of the user running the tests. The concern is that another > user on the same system could gain access to the account which is > running the 'make check' by connecting over localhost to the PostgreSQL > instance and being superuser there, which would allow executing > commands, etc, as that other user (eg: with COPY PIPE).
My $0.02: Not a lot of effort. A) Few users run the regression tests at all, because they use packages. B) Of the users who do self-builds, most do so on secure systems deep inside the corporate firewall. C) A related attack requires not only access to the host but good timing as well, or the ability to leave a booby-trap program on the system. D) If the host is compromised, the user gains access to the build user ... which should be a regular, unprivilged, shell user. The only way I can see this being of real use to an attacker is if they could use this exploit to create a wormed version of PostgresQL on the target build system. Is that possible? -- Josh Berkus PostgreSQL Experts Inc. http://pgexperts.com -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers
