upstream/postgresql
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-03-01 04:40:42 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions
Base de données relationnelle
41618 commits 38 branches 679 tags 857 MiB
C 84.8%
PLpgSQL 6.1%
Perl 4.8%
Yacc 1.2%
Meson 0.7%
Other 2.3%
Find a file
Tom Lane 1341e017df Ensure that all temp files made during pg_upgrade are non-world-readable. 
pg_upgrade has always attempted to ensure that the transient dump files
it creates are inaccessible except to the owner.  However, refactoring
in commit 76a7650c4 broke that for the file containing "pg_dumpall -g"
output; since then, that file was protected according to the process's
default umask.  Since that file may contain role passwords (hopefully
encrypted, but passwords nonetheless), this is a particularly unfortunate
oversight.  Prudent users of pg_upgrade on multiuser systems would
probably run it under a umask tight enough that the issue is moot, but
perhaps some users are depending only on pg_upgrade's umask changes to
protect their data.

To fix this in a future-proof way, let's just tighten the umask at
process start.  There are no files pg_upgrade needs to write at a
weaker security level; and if there were, transiently relaxing the
umask around where they're created would be a safer approach.

Report and patch by Tom Lane; the idea for the fix is due to Noah Misch.
Back-patch to all supported branches.

Security: CVE-2018-1053
2018-02-05 10:58:27 -05:00
config Extend configure's __int128 test to check for a known gcc bug. 2018-01-18 11:09:44 -05:00
contrib pgcrypto's encrypt() supports AES-128, AES-192, and AES-256 2018-01-31 16:33:24 -05:00
doc Release notes for 10.2, 9.6.7, 9.5.11, 9.4.16, 9.3.21. 2018-02-04 15:13:44 -05:00
src Ensure that all temp files made during pg_upgrade are non-world-readable. 2018-02-05 10:58:27 -05:00
.dir-locals.el emacs: Set indent-tabs-mode in perl-mode 2015-04-12 23:53:23 -04:00
.gitattributes Fix whitespace and remove obsolete gitattributes entry 2016-03-13 16:03:13 -04:00
.gitignore Add .gitignore entries for AIX-specific intermediate build artifacts. 2015-07-08 20:44:22 -04:00
aclocal.m4 Replace our hacked version of ax_pthread.m4 with latest upstream version. 2015-07-08 20:36:06 +03:00
configure Extend configure's __int128 test to check for a known gcc bug. 2018-01-18 11:09:44 -05:00
configure.in Prevent int128 from requiring more than MAXALIGN alignment. 2017-11-14 17:49:49 -05:00
COPYRIGHT Update copyright for 2018 2018-01-02 23:30:12 -05:00
GNUmakefile.in Fix distclean/maintainer-clean targets to remove top-level tmp_install dir. 2015-05-13 18:48:05 -04:00
HISTORY Change documentation references to PG website to use https: not http: 2017-05-20 21:50:47 -04:00
Makefile Fix non-GNU makefiles for AIX make. 2017-11-30 00:57:31 -08:00
README Change documentation references to PG website to use https: not http: 2017-05-20 21:50:47 -04:00
README.git Change documentation references to PG website to use https: not http: 2017-05-20 21:50:47 -04:00

README 

PostgreSQL Database Management System
=====================================

This directory contains the source code distribution of the PostgreSQL
database management system.

PostgreSQL is an advanced object-relational database management system
that supports an extended subset of the SQL standard, including
transactions, foreign keys, subqueries, triggers, user-defined types
and functions.  This distribution also contains C language bindings.

PostgreSQL has many language interfaces, many of which are listed here:

	https://www.postgresql.org/download

See the file INSTALL for instructions on how to build and install
PostgreSQL.  That file also lists supported operating systems and
hardware platforms and contains information regarding any other
software packages that are required to build or run the PostgreSQL
system.  Copyright and license information can be found in the
file COPYRIGHT.  A comprehensive documentation set is included in this
distribution; it can be read as described in the installation
instructions.

The latest version of this software may be obtained at
https://www.postgresql.org/download/.  For more information look at our
web site located at https://www.postgresql.org/.