Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-27 Thread Tom Lane
I wrote: > =?utf-8?Q?Dagfinn_Ilmari_Manns=C3=A5ker?= writes: >> Thanks! Just one minor nitpick: setting an %ENV entry to `undef` >> doesn't unset the environment variable, it sets it to the empty string. >> To unset a variable it needs to be deleted from %ENV, i.e. `delete >> $ENV{PGUSER};`. > A

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-26 Thread Tom Lane
=?utf-8?Q?Dagfinn_Ilmari_Manns=C3=A5ker?= writes: > Thanks! Just one minor nitpick: setting an %ENV entry to `undef` > doesn't unset the environment variable, it sets it to the empty string. > To unset a variable it needs to be deleted from %ENV, i.e. `delete > $ENV{PGUSER};`. Ah. Still, libpq

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-26 Thread Dagfinn Ilmari Mannsåker
Tom Lane writes: > =?utf-8?Q?Dagfinn_Ilmari_Manns=C3=A5ker?= writes: >> Tom Lane writes: >>> I wonder if it'd be a good idea to convert >>> auto_explain's TAP test to load auto_explain via session_preload_libraries >>> instead of shared_preload_libraries, and then pass in the settings for >>> e

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-25 Thread Tom Lane
=?utf-8?Q?Dagfinn_Ilmari_Manns=C3=A5ker?= writes: > Tom Lane writes: >> I wonder if it'd be a good idea to convert >> auto_explain's TAP test to load auto_explain via session_preload_libraries >> instead of shared_preload_libraries, and then pass in the settings for >> each test via PGOPTIONS ins

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-25 Thread Dagfinn Ilmari Mannsåker
Tom Lane writes: > I wonder if it'd be a good idea to convert > auto_explain's TAP test to load auto_explain via session_preload_libraries > instead of shared_preload_libraries, and then pass in the settings for > each test via PGOPTIONS instead of constantly rewriting postgresql.conf. That whol

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-25 Thread Tom Lane
Nathan Bossart writes: > Given all this, I think I'm inclined for the new argument. Pushed like that then (after a bit more fooling with the comments). I haven't done anything about a test case. We can't rely on plperl getting built, and even if we could, it doesn't have any TAP-style tests so

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-24 Thread Nathan Bossart
On Sun, Jul 24, 2022 at 11:49:23PM -0400, Tom Lane wrote: > Nathan Bossart writes: >> I noticed that a couple of places check whether whereToSendOutput is set to >> DestRemote to determine if this is an interactive session. > > IIRC, that would end in not loading the preload libraries in a standa

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-24 Thread Tom Lane
Nathan Bossart writes: > I noticed that a couple of places check whether whereToSendOutput is set to > DestRemote to determine if this is an interactive session. IIRC, that would end in not loading the preload libraries in a standalone backend. Perhaps that's what we want, but I'd supposed not.

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-24 Thread Nathan Bossart
On Sat, Jul 23, 2022 at 01:23:24PM -0400, Tom Lane wrote: > - /* > - * process any libraries that should be preloaded at backend start (this > - * likewise can't be done until GUC settings are complete) > - */ > - process_session_preload_libraries(); This patch essentially m

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-23 Thread Tom Lane
Nathan Bossart writes: > On Fri, Jul 22, 2022 at 06:44:04PM -0400, Tom Lane wrote: >> Another idea is to add a "bool interactive" parameter to InitPostgres, >> thereby shoving the issue out to the call sites. Still wouldn't >> expose the am_walsender angle, but conceivably it'd be more >> future-

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-22 Thread Nathan Bossart
On Fri, Jul 22, 2022 at 06:44:04PM -0400, Tom Lane wrote: > Another idea is to add a "bool interactive" parameter to InitPostgres, > thereby shoving the issue out to the call sites. Still wouldn't > expose the am_walsender angle, but conceivably it'd be more > future-proof anyway? I hesitated to

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-22 Thread Tom Lane
Nathan Bossart writes: > On Fri, Jul 22, 2022 at 02:56:22PM -0400, Tom Lane wrote: >> +if (!bootstrap && >> +!IsAutoVacuumWorkerProcess() && >> +!IsBackgroundWorker && >> +!am_walsender) >> +process_session_preload_libraries(); > I worry that th

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-22 Thread Nathan Bossart
On Fri, Jul 22, 2022 at 02:56:22PM -0400, Tom Lane wrote: > + /* > + * If this is an interactive session, load any libraries that should be > + * preloaded at backend start. Since those are determined by GUCs, this > + * can't happen until GUC settings are complete, but we want

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-22 Thread Tom Lane
Kyotaro Horiguchi writes: > At Fri, 22 Jul 2022 10:00:34 +0900, Michael Paquier > wrote in >> On Thu, Jul 21, 2022 at 05:39:35PM -0700, Gurjeet Singh wrote: >>> The patch also adds an assertion in pg_parameter_aclcheck() to ensure >>> that there's a transaction is in progress before it's called

Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

2022-07-21 Thread Kyotaro Horiguchi
At Fri, 22 Jul 2022 10:00:34 +0900, Michael Paquier wrote in > On Thu, Jul 21, 2022 at 05:39:35PM -0700, Gurjeet Singh wrote: > > One notable side effect of this change is that > > process_session_preload_libraries() is now called _before_ we > > SetProcessingMode(NormalProcessing). Which means