aboutsummaryrefslogtreecommitdiff
path: root/src/backend
diff options
context:
space:
mode:
authorNoah Misch <noah@leadboat.com>2024-11-15 20:39:56 -0800
committerNoah Misch <noah@leadboat.com>2024-11-15 20:39:56 -0800
commit7b88529f4363994450bd4cd3c172006a8a77e222 (patch)
treeb7270c5ca3ae6c343aa31bc4b8a3fd01ec87ea5b /src/backend
parente5ed873b1b4a395b06a5599100383a95c9846e5b (diff)
downloadpostgresql-7b88529f4363994450bd4cd3c172006a8a77e222.tar.gz
postgresql-7b88529f4363994450bd4cd3c172006a8a77e222.zip
Fix per-session activation of ALTER {ROLE|DATABASE} SET role.
After commit 5a2fed911a85ed6d8a015a6bafe3a0d9a69334ae, the catalog state resulting from these commands ceased to affect sessions. Restore the longstanding behavior, which is like beginning the session with a SET ROLE command. If cherry-picking the CVE-2024-10978 fixes, default to including this, too. (This fixes an unintended side effect of fixing CVE-2024-10978.) Back-patch to v12, like that commit. The release team decided to include v12, despite the original intent to halt v12 commits earlier this week. Tom Lane and Noah Misch. Reported by Etienne LAFARGE. Discussion: https://postgr.es/m/CADOZwSb0UsEr4_UTFXC5k7=fyyK8uKXekucd+-uuGjJsGBfxgw@mail.gmail.com
Diffstat (limited to 'src/backend')
-rw-r--r--src/backend/utils/init/miscinit.c20
-rw-r--r--src/backend/utils/misc/guc.c10
2 files changed, 28 insertions, 2 deletions
diff --git a/src/backend/utils/init/miscinit.c b/src/backend/utils/init/miscinit.c
index 9e3676f7b3f..3b7b2ebec08 100644
--- a/src/backend/utils/init/miscinit.c
+++ b/src/backend/utils/init/miscinit.c
@@ -824,7 +824,25 @@ InitializeSessionUserId(const char *rolename, Oid roleid, bool bypass_login_chec
{
SetAuthenticatedUserId(roleid);
- /* Set SessionUserId and related variables via the GUC mechanisms */
+ /*
+ * Set SessionUserId and related variables, including "role", via the
+ * GUC mechanisms.
+ *
+ * Note: ideally we would use PGC_S_DYNAMIC_DEFAULT here, so that
+ * session_authorization could subsequently be changed from
+ * pg_db_role_setting entries. Instead, session_authorization in
+ * pg_db_role_setting has no effect. Changing that would require
+ * solving two problems:
+ *
+ * 1. If pg_db_role_setting has values for both session_authorization
+ * and role, we could not be sure which order those would be applied
+ * in, and it would matter.
+ *
+ * 2. Sites may have years-old session_authorization entries. There's
+ * not been any particular reason to remove them. Ending the dormancy
+ * of those entries could seriously change application behavior, so
+ * only a major release should do that.
+ */
SetConfigOption("session_authorization", rname,
PGC_BACKEND, PGC_S_OVERRIDE);
}
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 40e3bf7e91e..c10c0844ab6 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -4099,6 +4099,12 @@ set_config_with_handle(const char *name, config_handle *handle,
* expect that if "role" isn't supposed to be default, it
* has been or will be set by a separate reload action.
*
+ * Also, for the call from InitializeSessionUserId with
+ * source == PGC_S_OVERRIDE, use PGC_S_DYNAMIC_DEFAULT for
+ * "role"'s source, so that it's still possible to set
+ * "role" from pg_db_role_setting entries. (See notes in
+ * InitializeSessionUserId before changing this.)
+ *
* A fine point: for RESET session_authorization, we do
* "RESET role" not "SET ROLE NONE" (by passing down NULL
* rather than "none" for the value). This would have the
@@ -4111,7 +4117,9 @@ set_config_with_handle(const char *name, config_handle *handle,
(void) set_config_with_handle("role", NULL,
value ? "none" : NULL,
orig_context,
- orig_source,
+ (orig_source == PGC_S_OVERRIDE)
+ ? PGC_S_DYNAMIC_DEFAULT
+ : orig_source,
orig_srole,
action,
true,