diff options
| author | Robert Haas <rhaas@postgresql.org> | 2022-07-26 14:10:38 -0400 |
|---|---|---|
| committer | Robert Haas <rhaas@postgresql.org> | 2022-07-26 14:10:38 -0400 |
| commit | e530be2c5ce77475d56ccf8f4e0c4872b666ad5f (patch) | |
| tree | fdefef95474e0530a4c8a9cced5c59f77dbc5fbe /src/backend/commands/user.c | |
| parent | f92944137cdec3e80e826879d817a2d3dff68b5f (diff) | |
| download | postgresql-e530be2c5ce77475d56ccf8f4e0c4872b666ad5f.tar.gz postgresql-e530be2c5ce77475d56ccf8f4e0c4872b666ad5f.zip | |
Do not allow removal of superuser privileges from bootstrap user.
A bootstrap user who is not a superuser will still own many
important system objects, such as the pg_catalog schema, that
will likely allow that user to regain superuser status. Therefore,
allowing the superuser property to be removed from the superuser
creates a false perception of security where none exists.
Although removing superuser from the bootstrap user is also a bad idea
and should be considered unsupported in all released versions, no
back-patch, as this is a behavior change.
Discussion: http://postgr.es/m/CA+TgmoZirCwArJms_fgvLBFrC6b=HdxmG7iAhv+kt_=NBA7tEw@mail.gmail.com
Diffstat (limited to 'src/backend/commands/user.c')
| -rw-r--r-- | src/backend/commands/user.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c index 5b24b6dcad8..37260edbe48 100644 --- a/src/backend/commands/user.c +++ b/src/backend/commands/user.c @@ -693,7 +693,14 @@ AlterRole(ParseState *pstate, AlterRoleStmt *stmt) */ if (dissuper) { - new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(boolVal(dissuper->arg)); + bool should_be_super = BoolGetDatum(boolVal(dissuper->arg)); + + if (!should_be_super && roleid == BOOTSTRAP_SUPERUSERID) + ereport(ERROR, + (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("permission denied: bootstrap user must be superuser"))); + + new_record[Anum_pg_authid_rolsuper - 1] = should_be_super; new_record_repl[Anum_pg_authid_rolsuper - 1] = true; } |