From e5fdb8feadd4385671bab0e2c4c57008f3ba8dda Mon Sep 17 00:00:00 2001
From: Tom Lane <tgl@sss.pgh.pa.us>
Date: Mon, 1 Apr 2013 13:09:29 -0400
Subject: [PATCH] Make REPLICATION privilege checks test current user not
authenticated user.
The pg_start_backup() and pg_stop_backup() functions checked the privileges
of the initially-authenticated user rather than the current user, which is
wrong. For example, a user-defined index function could successfully call
these functions when executed by ANALYZE within autovacuum. This could
allow an attacker with valid but low-privilege database access to interfere
with creation of routine backups. Reported and fixed by Noah Misch.
Security: CVE-2013-1901
---
src/backend/access/transam/xlog.c | 4 ++--
src/backend/utils/init/miscinit.c | 6 +++---
src/backend/utils/init/postinit.c | 2 +-
src/include/miscadmin.h | 2 +-
4 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index a4bc8c88eb6..690077ce821 100644
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -9413,7 +9413,7 @@ do_pg_start_backup(const char *backupidstr, bool fast, char **labelfile)
backup_started_in_recovery = RecoveryInProgress();
- if (!superuser() && !is_authenticated_user_replication_role())
+ if (!superuser() && !has_rolreplication(GetUserId()))
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
errmsg("must be superuser or replication role to run a backup")));
@@ -9743,7 +9743,7 @@ do_pg_stop_backup(char *labelfile, bool waitforarchive)
backup_started_in_recovery = RecoveryInProgress();
- if (!superuser() && !is_authenticated_user_replication_role())
+ if (!superuser() && !has_rolreplication(GetUserId()))
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
(errmsg("must be superuser or replication role to run a backup"))));
diff --git a/src/backend/utils/init/miscinit.c b/src/backend/utils/init/miscinit.c
index b28567e6521..0a40bcf5270 100644
--- a/src/backend/utils/init/miscinit.c
+++ b/src/backend/utils/init/miscinit.c
@@ -389,15 +389,15 @@ SetUserIdAndContext(Oid userid, bool sec_def_context)
/*
- * Check if the authenticated user is a replication role
+ * Check whether specified role has explicit REPLICATION privilege
*/
bool
-is_authenticated_user_replication_role(void)
+has_rolreplication(Oid roleid)
{
bool result = false;
HeapTuple utup;
- utup = SearchSysCache1(AUTHOID, ObjectIdGetDatum(AuthenticatedUserId));
+ utup = SearchSysCache1(AUTHOID, ObjectIdGetDatum(roleid));
if (HeapTupleIsValid(utup))
{
result = ((Form_pg_authid) GETSTRUCT(utup))->rolreplication;
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index ba0eba55689..3dc5331772e 100644
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -668,7 +668,7 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
{
Assert(!bootstrap);
- if (!superuser() && !is_authenticated_user_replication_role())
+ if (!superuser() && !has_rolreplication(GetUserId()))
ereport(FATAL,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
errmsg("must be superuser or replication role to start walsender")));
diff --git a/src/include/miscadmin.h b/src/include/miscadmin.h
index 8df2a28126a..5b92767682d 100644
--- a/src/include/miscadmin.h
+++ b/src/include/miscadmin.h
@@ -436,7 +436,7 @@ extern void ValidatePgVersion(const char *path);
extern void process_shared_preload_libraries(void);
extern void process_local_preload_libraries(void);
extern void pg_bindtextdomain(const char *domain);
-extern bool is_authenticated_user_replication_role(void);
+extern bool has_rolreplication(Oid roleid);
/* in access/transam/xlog.c */
extern bool BackupInProgress(void);
--
GitLab