aboutsummaryrefslogtreecommitdiff
path: root/src/backend/commands
diff options
context:
space:
mode:
Diffstat (limited to 'src/backend/commands')
-rw-r--r--src/backend/commands/analyze.c24
-rw-r--r--src/backend/commands/schemacmds.c13
-rw-r--r--src/backend/commands/tablecmds.c12
-rw-r--r--src/backend/commands/vacuum.c26
4 files changed, 51 insertions, 24 deletions
diff --git a/src/backend/commands/analyze.c b/src/backend/commands/analyze.c
index 91a0cc05b35..5eaf7a2ecf9 100644
--- a/src/backend/commands/analyze.c
+++ b/src/backend/commands/analyze.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/commands/analyze.c,v 1.80.4.1 2008/01/03 21:25:00 tgl Exp $
+ * $PostgreSQL: pgsql/src/backend/commands/analyze.c,v 1.80.4.2 2009/12/09 21:58:54 tgl Exp $
*
*-------------------------------------------------------------------------
*/
@@ -34,6 +34,7 @@
#include "utils/builtins.h"
#include "utils/datum.h"
#include "utils/fmgroids.h"
+#include "utils/guc.h"
#include "utils/lsyscache.h"
#include "utils/syscache.h"
#include "utils/tuplesort.h"
@@ -111,7 +112,8 @@ analyze_rel(Oid relid, VacuumStmt *vacstmt)
double totalrows;
HeapTuple *rows;
AclId save_userid;
- bool save_secdefcxt;
+ int save_sec_context;
+ int save_nestlevel;
if (vacstmt->verbose)
elevel = INFO;
@@ -202,11 +204,14 @@ analyze_rel(Oid relid, VacuumStmt *vacstmt)
RelationGetRelationName(onerel))));
/*
- * Switch to the table owner's userid, so that any index functions are
- * run as that user.
+ * Switch to the table owner's userid, so that any index functions are run
+ * as that user. Also lock down security-restricted operations and
+ * arrange to make GUC variable changes local to this command.
*/
- GetUserIdAndContext(&save_userid, &save_secdefcxt);
- SetUserIdAndContext(onerel->rd_rel->relowner, true);
+ GetUserIdAndSecContext(&save_userid, &save_sec_context);
+ SetUserIdAndSecContext(onerel->rd_rel->relowner,
+ save_sec_context | SECURITY_RESTRICTED_OPERATION);
+ save_nestlevel = NewGUCNestLevel();
/*
* Determine which columns to analyze
@@ -444,8 +449,11 @@ cleanup:
*/
relation_close(onerel, NoLock);
- /* Restore userid */
- SetUserIdAndContext(save_userid, save_secdefcxt);
+ /* Roll back any GUC changes executed by index functions */
+ AtEOXact_GUC(false, save_nestlevel);
+
+ /* Restore userid and security context */
+ SetUserIdAndSecContext(save_userid, save_sec_context);
}
/*
diff --git a/src/backend/commands/schemacmds.c b/src/backend/commands/schemacmds.c
index 49e931013a5..d255e3a5cb2 100644
--- a/src/backend/commands/schemacmds.c
+++ b/src/backend/commands/schemacmds.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/commands/schemacmds.c,v 1.27.4.1 2008/01/03 21:25:00 tgl Exp $
+ * $PostgreSQL: pgsql/src/backend/commands/schemacmds.c,v 1.27.4.2 2009/12/09 21:58:54 tgl Exp $
*
*-------------------------------------------------------------------------
*/
@@ -46,10 +46,10 @@ CreateSchemaCommand(CreateSchemaStmt *stmt)
const char *owner_name;
AclId owner_userid;
AclId saved_userid;
- bool saved_secdefcxt;
+ int save_sec_context;
AclResult aclresult;
- GetUserIdAndContext(&saved_userid, &saved_secdefcxt);
+ GetUserIdAndSecContext(&saved_userid, &save_sec_context);
/*
* Figure out user identities.
@@ -72,7 +72,8 @@ CreateSchemaCommand(CreateSchemaStmt *stmt)
* (This will revert to session user on error or at the end of
* this routine.)
*/
- SetUserIdAndContext(owner_userid, true);
+ SetUserIdAndSecContext(owner_userid,
+ save_sec_context | SECURITY_LOCAL_USERID_CHANGE);
}
else
{
@@ -151,8 +152,8 @@ CreateSchemaCommand(CreateSchemaStmt *stmt)
/* Reset search path to normal state */
PopSpecialNamespace(namespaceId);
- /* Reset current user */
- SetUserIdAndContext(saved_userid, saved_secdefcxt);
+ /* Reset current user and security context */
+ SetUserIdAndSecContext(saved_userid, save_sec_context);
}
diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c
index 8001b0798c4..3c1cbae6955 100644
--- a/src/backend/commands/tablecmds.c
+++ b/src/backend/commands/tablecmds.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/commands/tablecmds.c,v 1.142.4.10 2008/05/27 21:13:50 tgl Exp $
+ * $PostgreSQL: pgsql/src/backend/commands/tablecmds.c,v 1.142.4.11 2009/12/09 21:58:54 tgl Exp $
*
*-------------------------------------------------------------------------
*/
@@ -296,6 +296,16 @@ DefineRelation(CreateStmt *stmt, char relkind)
errmsg("ON COMMIT can only be used on temporary tables")));
/*
+ * Security check: disallow creating temp tables from security-restricted
+ * code. This is needed because calling code might not expect untrusted
+ * tables to appear in pg_temp at the front of its search path.
+ */
+ if (stmt->relation->istemp && InSecurityRestrictedOperation())
+ ereport(ERROR,
+ (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
+ errmsg("cannot create temporary table within security-restricted operation")));
+
+ /*
* Look up the namespace in which we are supposed to create the
* relation. Check we have permission to create there. Skip check if
* bootstrapping, since permissions machinery may not be working yet.
diff --git a/src/backend/commands/vacuum.c b/src/backend/commands/vacuum.c
index dc481f30f5f..ccef7141092 100644
--- a/src/backend/commands/vacuum.c
+++ b/src/backend/commands/vacuum.c
@@ -13,7 +13,7 @@
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/commands/vacuum.c,v 1.299.4.5 2009/11/10 18:01:26 alvherre Exp $
+ * $PostgreSQL: pgsql/src/backend/commands/vacuum.c,v 1.299.4.6 2009/12/09 21:58:55 tgl Exp $
*
*-------------------------------------------------------------------------
*/
@@ -43,6 +43,7 @@
#include "utils/acl.h"
#include "utils/builtins.h"
#include "utils/fmgroids.h"
+#include "utils/guc.h"
#include "utils/inval.h"
#include "utils/lsyscache.h"
#include "utils/relcache.h"
@@ -884,7 +885,8 @@ vacuum_rel(Oid relid, VacuumStmt *vacstmt, char expected_relkind)
Oid toast_relid;
bool result;
AclId save_userid;
- bool save_secdefcxt;
+ int save_sec_context;
+ int save_nestlevel;
bool heldoff;
/* Begin a transaction for vacuuming this relation */
@@ -1001,12 +1003,15 @@ vacuum_rel(Oid relid, VacuumStmt *vacstmt, char expected_relkind)
toast_relid = onerel->rd_rel->reltoastrelid;
/*
- * Switch to the table owner's userid, so that any index functions are
- * run as that user. (This is unnecessary, but harmless, for lazy
- * VACUUM.)
+ * Switch to the table owner's userid, so that any index functions are run
+ * as that user. Also lock down security-restricted operations and
+ * arrange to make GUC variable changes local to this command.
+ * (This is unnecessary, but harmless, for lazy VACUUM.)
*/
- GetUserIdAndContext(&save_userid, &save_secdefcxt);
- SetUserIdAndContext(onerel->rd_rel->relowner, true);
+ GetUserIdAndSecContext(&save_userid, &save_sec_context);
+ SetUserIdAndSecContext(onerel->rd_rel->relowner,
+ save_sec_context | SECURITY_RESTRICTED_OPERATION);
+ save_nestlevel = NewGUCNestLevel();
/*
* Do the actual work --- either FULL or "lazy" vacuum
@@ -1018,8 +1023,11 @@ vacuum_rel(Oid relid, VacuumStmt *vacstmt, char expected_relkind)
result = true; /* did the vacuum */
- /* Restore userid */
- SetUserIdAndContext(save_userid, save_secdefcxt);
+ /* Roll back any GUC changes executed by index functions */
+ AtEOXact_GUC(false, save_nestlevel);
+
+ /* Restore userid and security context */
+ SetUserIdAndSecContext(save_userid, save_sec_context);
/* all done with this class, but hold lock until commit */
relation_close(onerel, NoLock);
generated by cgit v1.2.3 (git 2.25.1) at 2025-08-01 23:32:33 +0000