8000 Again match pg_user_mappings to information_schema.user_mapping_options. · shurik236/postgres@e255e97 · GitHub
[go: up one dir, main page]
Skip to content

Commit e255e97

Browse files
nmischnmisch
committed
Again match pg_user_mappings to information_schema.user_mapping_options.
Commit 3eefc51 claimed to make pg_user_mappings enforce the qualifications user_mapping_options had been enforcing, but its removal of a longstanding restriction left them distinct when the current user is the subject of a mapping yet has no server privileges. user_mapping_options emits no rows for such a mapping, but pg_user_mappings includes full umoptions. Change pg_user_mappings to show null for umoptions. Back-patch to 9.2, like the above commit. Reviewed by Tom Lane. Reported by Jeff Janes. Security: CVE-2017-7547
1 parent 0665164 commit e255e97

File tree

5 files changed

+57
-30
lines changed

5 files changed

+57
-30
lines changed

‎doc/src/sgml/catalogs.sgml

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8768,17 +8768,37 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
87688768
<entry><type>text[]</type></entry>
87698769
<entry></entry>
87708770
<entry>
8771-
User mapping specific options, as <quote>keyword=value</>
8772-
strings. This column will show as null unless the current user
8773-
is the user being mapped, or the mapping is for
8774-
<literal>PUBLIC</literal> and the current user is the server
8775-
owner, or the current user is a superuser. The intent is
8776-
to protect password information stored as user mapping option.
8771+
User mapping specific options, as <quote>keyword=value</> strings
87778772
</entry>
87788773
</row>
87798774
</tbody>
87808775
</tgroup>
87818776
</table>
8777+
8778+
<para>
8779+
To protect password information stored as a user mapping option,
8780+
the <structfield>umoptions</structfield> column will read as null
8781+
unless one of the following applies:
8782+
<itemizedlist>
8783+
<listitem>
8784+
<para>
8785+
current user is the user being mapped, and owns the server or
8786+
holds <literal>USAGE</> privilege on it
8787+
</para>
8788+
</listitem>
8789+
<listitem>
8790+
<para>
8791+
current user is the server owner and mapping is for <literal>PUBLIC</>
8792+
</para>
8793+
</listitem>
8794+
<listitem>
8795+
<para>
8796+
current user is a superuser
8797+
</para>
8798+
</listitem>
8799+
</itemizedlist>
8800+
</para>
8801+
87828802
</sect1>
87838803

87848804

‎src/backend/catalog/system_views.sql

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -669,7 +669,9 @@ CREATE VIEW pg_user_mappings AS
669669
ELSE
670670
A.rolname
671671
END AS usename,
672-
CASE WHEN (U.umuser <> 0 AND A.rolname = current_user)
672+
CASE WHEN (U.umuser <> 0 AND A.rolname = current_user
673+
AND (pg_has_role(S.srvowner, 'USAGE')
674+
OR has_server_privilege(S.oid, 'USAGE')))
673675
OR (U.umuser = 0 AND pg_has_role(S.srvowner, 'USAGE'))
674676
OR (SELECT rolsuper FROM pg_authid WHERE rolname = current_user)
675677
THEN U.umoptions

‎src/test/regress/expected/foreign_data.out

-15Lines changed: 17 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1144,10 +1144,11 @@ ERROR: permission denied for foreign-data wrapper foo
11441144
ALTER SERVER s9 VERSION '1.1';
11451145
GRANT USAGE ON FOREIGN SERVER s9 TO regress_test_role;
11461146
CREATE USER MAPPING FOR current_user SERVER s9;
1147+
-- We use terse mode to avoid ordering issues in cascade detail output.
1148+
\set VERBOSITY terse
11471149
DROP SERVER s9 CASCADE;
11481150
NOTICE: drop cascades to 2 other objects
1149-
DETAIL: drop cascades to user mapping for public on server s9
1150-
drop cascades to user mapping for unprivileged_role on server s9
1151+
\set VERBOSITY default
11511152
RESET ROLE;
11521153
CREATE SERVER s9 FOREIGN DATA WRAPPER foo;
11531154
GRANT USAGE ON FOREIGN SERVER s9 TO unprivileged_role;
@@ -1163,57 +1164,62 @@ ERROR: must be owner of foreign server s9
11631164
SET ROLE regress_test_role;
11641165
CREATE SERVER s10 FOREIGN DATA WRAPPER foo;
11651166
CREATE USER MAPPING FOR public SERVER s10 OPTIONS (user 'secret');
1166-
GRANT USAGE ON FOREIGN SERVER s10 TO unprivileged_role;
1167-
-- owner of server can see option fields
1167+
CREATE USER MAPPING FOR unprivileged_role SERVER s10 OPTIONS (user 'secret');
1168+
-- owner of server can see some option fields
11681169
\deu+
11691170
List of user mappings
11701171
Server | User name | FDW Options
11711172
--------+-------------------+-------------------
11721173
s10 | public | ("user" 'secret')
1174+
s10 | unprivileged_role |
11731175
s4 | foreign_data_user |
11741176
s5 | regress_test_role | (modified '1')
11751177
s6 | regress_test_role |
11761178
s8 | foreign_data_user |
11771179
s8 | public |
11781180
s9 | unprivileged_role |
11791181
t1 | public | (modified '1')
1180-
(8 rows)
1182+
(9 rows)
11811183

11821184
RESET ROLE;
1183-
-- superuser can see option fields
1185+
-- superuser can see all option fields
11841186
\deu+
11851187
List of user mappings
11861188
Server | User name | FDW Options
11871189
--------+-------------------+---------------------
11881190
s10 | public | ("user" 'secret')
1191+
s10 | unprivileged_role | ("user" 'secret')
11891192
s4 | foreign_data_user |
11901193
s5 | regress_test_role | (modified '1')
11911194
s6 | regress_test_role |
11921195
s8 | foreign_data_user | (password 'public')
11931196
s8 | public |
11941197
s9 | unprivileged_role |
11951198
t1 | public | (modified '1')
1196-
(8 rows)
1199+
(9 rows)
11971200

1198-
-- unprivileged user cannot see option fields
1201+
-- unprivileged user cannot see any option field
11991202
SET ROLE unprivileged_role;
12001203
\deu+
12011204
List of user mappings
12021205
Server | User name | FDW Options
12031206
--------+-------------------+-------------
12041207
s10 | public |
1208+
s10 | unprivileged_role |
12051209
s4 | foreign_data_user |
12061210
s5 | regress_test_role |
12071211
s6 | regress_test_role |
12081212
s8 | foreign_data_user |
12091213
s8 | public |
12101214
s9 | unprivileged_role |
12111215
t1 | public |
1212-
(8 rows)
1216+
(9 rows)
12131217

12141218
RESET ROLE;
1219+
\set VERBOSITY terse
12151220
DROP SERVER s10 CASCADE;
1216-
NOTICE: drop cascades to user mapping for public on server s10
1221+
NOTICE: drop cascades to 2 other objects
1222+
\set VERBOSITY default
12171223
-- DROP FOREIGN TABLE
12181224
DROP FOREIGN TABLE no_table; -- ERROR
12191225
ERROR: foreign table "no_table" does not exist
@@ -1238,16 +1244,12 @@ owner of user mapping for regress_test_role on server s6
12381244
DROP SERVER t1 CASCADE;
12391245
NOTICE: drop cascades to user mapping for public on server t1
12401246
DROP USER MAPPING FOR regress_test_role SERVER s6;
1241-
-- This test causes some order dependent cascade detail output,
1242-
-- so switch to terse mode for it.
12431247
\set VERBOSITY terse
12441248
DROP FOREIGN DATA WRAPPER foo CASCADE;
12451249
NOTICE: drop cascades to 5 other objects
1246-
\set VERBOSITY default
12471250
DROP SERVER s8 CASCADE;
12481251
NOTICE: drop cascades to 2 other objects
1249-
DETAIL: drop cascades to user mapping for foreign_data_user on server s8
1250-
drop cascades to user mapping for public on server s8
1252+
\set VERBOSITY default
12511253
DROP ROLE regress_test_indirect;
12521254
DROP ROLE regress_test_role;
12531255
DROP ROLE unprivileged_role; -- ERROR

‎src/test/regress/expected/rules.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1322,7 +1322,7 @@ SELECT viewname, definition FROM pg_views WHERE schemaname <> 'information_schem
13221322
pg_timezone_abbrevs | SELECT pg_timezone_abbrevs.abbrev, pg_timezone_abbrevs.utc_offset, pg_timezone_abbrevs.is_dst FROM pg_timezone_abbrevs() pg_timezone_abbrevs(abbrev, utc_offset, is_dst);
13231323
pg_timezone_names | SELECT pg_timezone_names.name, pg_timezone_names.abbrev, pg_timezone_names.utc_offset, pg_timezone_names.is_dst FROM pg_timezone_names() pg_timezone_names(name, abbrev, utc_offset, is_dst);
13241324
pg_user | SELECT pg_shadow.usename, pg_shadow.usesysid, pg_shadow.usecreatedb, pg_shadow.usesuper, pg_shadow.usecatupd, pg_shadow.userepl, '********'::text AS passwd, pg_shadow.valuntil, pg_shadow.useconfig FROM pg_shadow;
1325-
pg_user_mappings | SELECT u.oid AS umid, s.oid AS srvid, s.srvname, u.umuser, CASE WHEN (u.umuser = (0)::oid) THEN 'public'::name ELSE a.rolname END AS usename, CASE WHEN ((((u.umuser <> (0)::oid) AND (a.rolname = "current_user"())) OR ((u.umuser = (0)::oid) AND pg_has_role(s.srvowner, 'USAGE'::text))) OR (SELECT pg_authid.rolsuper FROM pg_authid WHERE (pg_authid.rolname = "current_user"()))) THEN u.umoptions ELSE NULL::text[] END AS umoptions FROM ((pg_user_mapping u LEFT JOIN pg_authid a ON ((a.oid = u.umuser))) JOIN pg_foreign_server s ON ((u.umserver = s.oid)));
1325+
pg_user_mappings | SELECT u.oid AS umid, s.oid AS srvid, s.srvname, u.umuser, CASE WHEN (u.umuser = (0)::oid) THEN 'public'::name ELSE a.rolname END AS usename, CASE WHEN (((((u.umuser <> (0)::oid) AND (a.rolname = "current_user"())) AND (pg_has_role(s.srvowner, 'USAGE'::text) OR has_server_privilege(s.oid, 'USAGE'::text))) OR ((u.umuser = (0)::oid) AND pg_has_role(s.srvowner, 'USAGE'::text))) OR (SELECT pg_authid.rolsuper FROM pg_authid WHERE (pg_authid.rolname = "current_user"()))) THEN u.umoptions ELSE NULL::text[] END AS umoptions FROM ((pg_user_mapping u LEFT JOIN pg_authid a ON ((a.oid = u.umuser))) JOIN pg_foreign_server s ON ((u.umserver = s.oid)));
13261326
pg_views | SELECT n.nspname AS schemaname, c.relname AS viewname, pg_get_userbyid(c.relowner) AS viewowner, pg_get_viewdef(c.oid) AS definition FROM (pg_class c LEFT JOIN pg_namespace n ON ((n.oid = c.relnamespace))) WHERE (c.relkind = 'v'::"char");
13271327
rtest_v1 | SELECT rtest_t1.a, rtest_t1.b FROM rtest_t1;
13281328
rtest_vcomp | SELECT x.part, (x.size * y.factor) AS size_in_cm FROM rtest_comp x, rtest_unitfact y WHERE (x.unit = y.unit);

‎src/test/regress/sql/foreign_data.sql

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -460,7 +460,10 @@ CREATE SERVER s10 FOREIGN DATA WRAPPER foo; -- ERROR
460460
ALTER SERVER s9 VERSION '1.1';
461461
GRANT USAGE ON FOREIGN SERVER s9 TO regress_test_role;
462462
CREATE USER MAPPING FOR current_user SERVER s9;
463+
-- We use terse mode to avoid ordering issues in cascade detail output.
464+
\set VERBOSITY terse
463465
DROP SERVER s9 CASCADE;
466+
\set VERBOSITY default
464467
RESET ROLE;
465468
CREATE SERVER s9 FOREIGN DATA WRAPPER foo;
466469
GRANT USAGE ON FOREIGN SERVER s9 TO unprivileged_role;
@@ -474,17 +477,19 @@ DROP SERVER s9 CASCADE; -- ERROR
474477
SET ROLE regress_test_role;
475478
CREATE SERVER s10 FOREIGN DATA WRAPPER foo;
476479
CREATE USER MAPPING FOR public SERVER s10 OPTIONS (user 'secret');
477-
GRANT USAGE ON FOREIGN SERVER s10 TO unprivileged_role;
478-
-- owner of server can see option fields
480+
CREATE USER MAPPING FOR unprivileged_role SERVER s10 OPTIONS (user 'secret');
481+
-- owner of server can see some option fields
479482
\deu+
480483
RESET ROLE;
481-
-- superuser can see option fields
484+
-- superuser can see all option fields
482485
\deu+
483-
-- unprivileged user cannot see option fields
486+
-- unprivileged user cannot see any option field
484487
SET ROLE unprivileged_role;
485488
\deu+
486489
RESET ROLE;
490+
\set VERBOSITY terse
487491
DROP SERVER s10 CASCADE;
492+
\set VERBOSITY default
488493

489494
-- DROP FOREIGN TABLE
490495
DROP FOREIGN TABLE no_table; -- ERROR
@@ -501,12 +506,10 @@ DROP SCHEMA foreign_schema CASCADE;
501506
DROP ROLE regress_test_role; -- ERROR
502507
DROP SERVER t1 CASCADE;
503508
DROP USER MAPPING FOR regress_test_role SERVER s6;
504-
-- This test causes some order dependent cascade detail output,
505-
-- so switch to terse mode for it.
506509
\set VERBOSITY terse
507510
DROP FOREIGN DATA WRAPPER foo CASCADE;
508-
\set VERBOSITY default
509511
DROP SERVER s8 CASCADE;
512+
\set VERBOSITY default
510513
DROP ROLE regress_test_indirect;
511514
DROP ROLE regress_test_role;
512515
DROP ROLE unprivileged_role; -- ERROR

0 commit comments

Comments
 (0)
0