8000 Abandon the use of Perl's Safe.pm to enforce restrictions in plperl, … · danielcode/postgres@e089e04 · GitHub
[go: up one dir, main page]
Skip to content

Commit e089e04

Browse files
adunstanadunstan
committed
Abandon the use of Perl's Safe.pm to enforce restrictions in plperl, as it is
fundamentally insecure. Instead apply an opmask to the whole interpreter that imposes restrictions on unsafe operations. These restrictions are much harder to subvert than is Safe.pm, since there is no container to be broken out of. Backported to release 7.4. In releases 7.4, 8.0 and 8.1 this also includes the necessary backporting of the two interpreters model for plperl and plperlu adopted in release 8.2. In versions 8.0 and up, the use of Perl's POSIX module to undo its locale mangling on Windows has become insecure with these changes, so it is replaced by our own routine, which is also faster. Nice side effects of the changes include that it is now possible to use perl's "strict" pragma in a natural way in plperl, and that perl's $a and $b variables now work as expected in sort routines, and that function compilation is significantly faster. Tim Bunce and Andrew Dunstan, with reviews from Alex Hunsaker and Alexey Klyukin. Security: CVE-2010-1169
1 parent 2824dd4 commit e089e04

File tree

10 files changed

+791
-193
lines changed

10 files changed

+791
-193
lines changed

‎doc/src/sgml/plperl.sgml

Lines changed: 21 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
< 8000 /code>
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/plperl.sgml,v 2.37 2005/01/17 17:29:49 momjian Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/plperl.sgml,v 2.37.4.1 2010/05/13 16:44:03 adunstan Exp $
33
-->
44

55
<chapter id="plperl">
@@ -458,7 +458,26 @@ $$ LANGUAGE plperl;
458458
If the above function was created by a superuser using the language
459459
<literal>plperlu</>, execution would succeed.
460460
</para>
461-
</sect1>
461+
462+
<note>
463+
<para>
464+
For security reasons, to stop a leak of privileged operations from
465+
<application>PL/PerlU</> to <application>PL/Perl</>, these two languages
466+
have to run in separate instances of the Perl interpreter. If your
467+
Perl installation has been appropriately compiled, this is not a problem.
468+
However, not all installations are compiled with the requisite flags.
469+
If <productname>PostgreSQL</> detects that this is the case then it will
470+
not start a second interpreter, but instead create an error. In
471+
consequence, in such an installation, you cannot use both
472+
<application>PL/PerlU</> and <application>PL/Perl</> in the same backend
473+
process. The remedy for this is to obtain a Perl installation created
474+
with the appropriate flags, namely either <literal>usemultiplicity</> or
475+
both <literal>usethreads</> and <literal>useithreads</>.
476+
For more details,see the <literal>perlembed</> manual page.
477+
</para>
478+
</note>
479+
480+
</sect1>
462481

463482
<sect1 id="plperl-triggers">
464483
<title>PL/Perl Triggers</title>

‎src/pl/plperl/GNUmakefile

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Makefile for PL/Perl
2-
# $PostgreSQL: pgsql/src/pl/plperl/GNUmakefile,v 1.18.4.1 2005/07/17 04:05:49 tgl Exp $
2+
# $PostgreSQL: pgsql/src/pl/plperl/GNUmakefile,v 1.18.4.2 2010/05/13 16:44:03 adunstan Exp $
33

44
subdir = src/pl/plperl
55
top_builddir = ../../..
< 8000 div class="d-flex flex-row">
@@ -23,7 +23,7 @@ perl_embed_ldflags := -L$(perl_archlibexp)/CORE -lperl58
2323
override CPPFLAGS += -DPLPERL_HAVE_UID_GID
2424
endif
2525

26-
override CPPFLAGS := -I$(srcdir) $(CPPFLAGS) -I$(perl_archlibexp)/CORE
26+
override CPPFLAGS := -I. -I$(srcdir) $(CPPFLAGS) -I$(perl_archlibexp)/CORE
2727

2828
rpathdir = $(perl_archlibexp)/CORE
2929

@@ -41,6 +41,13 @@ include $(top_srcdir)/src/Makefile.shlib
4141

4242
all: all-lib
4343

44+
plperl.o: plperl_opmask.h
45+
46+
plperl_opmask.h: plperl_opmask.pl
47+
$(PERL) $< $@
48+
49+
50+
4451
SPI.c: SPI.xs
4552
$(PERL) $(perl_privlibexp)/ExtUtils/xsubpp -typemap $(perl_privlibexp)/ExtUtils/typemap $< >$@
4653

@@ -60,7 +67,7 @@ uninstall:
6067
rm -f $(DESTDIR)$(pkglibdir)/plperl$(DLSUFFIX)
6168

6269
clean distclean maintainer-clean: clean-lib
63-
rm -f SPI.c $(OBJS)
70+
rm -f SPI.c $(OBJS) plperl_opmask.h
6471

6572
else # can't build
6673

0 commit comments

Comments
 (0)
0