postgresql/src/backend/catalog
Tom Lane 613981be04 Prevent indirect security attacks via changing session-local state within
an allegedly immutable index function.  It was previously recognized that
we had to prevent such a function from executing SET/RESET ROLE/SESSION
AUTHORIZATION, or it could trivially obtain the privileges of the session
user.  However, since there is in general no privilege checking for changes
of session-local state, it is also possible for such a function to change
settings in a way that might subvert later operations in the same session.
Examples include changing search_path to cause an unexpected function to
be called, or replacing an existing prepared statement with another one
that will execute a function of the attacker's choosing.

The present patch secures VACUUM, ANALYZE, and CREATE INDEX/REINDEX against
these threats, which are the same places previously deemed to need protection
against the SET ROLE issue.  GUC changes are still allowed, since there are
many useful cases for that, but we prevent security problems by forcing a
rollback of any GUC change after completing the operation.  Other cases are
handled by throwing an error if any change is attempted; these include temp
table creation, closing a cursor, and creating or deleting a prepared
statement.  (In 7.4, the infrastructure to roll back GUC changes doesn't
exist, so we settle for rejecting changes of "search_path" in these contexts.)

Original report and patch by Gurjeet Singh, additional analysis by
Tom Lane.

Security: CVE-2009-4136
2009-12-09 21:58:44 +00:00
..
aclchk.c Support explicit placement of the temporary-table schema within search_path. 2007-04-20 02:38:05 +00:00
catalog.c Put a CHECK_FOR_INTERRUPTS call into the loops that try to find a unique new 2008-02-20 17:44:26 +00:00
dependency.c Re-run pgindent, fixing a problem where comment lines after a blank 2005-11-22 18:23:31 +00:00
genbki.sh Replace pg_shadow and pg_group by new role-capable catalogs pg_authid 2005-06-28 05:09:14 +00:00
heap.c Repair a longstanding bug in CLUSTER and the rewriting variants of ALTER 2009-02-24 01:39:10 +00:00
index.c Prevent indirect security attacks via changing session-local state within 2009-12-09 21:58:44 +00:00
indexing.c Standard pgindent run for 8.1. 2005-10-15 02:49:52 +00:00
information_schema.sql Change nextval and other sequence functions to specify their sequence 2005-10-02 23:50:16 +00:00
Makefile Create the pg_pltemplate system catalog to hold template information 2005-09-08 20:07:42 +00:00
namespace.c Support explicit placement of the temporary-table schema within search_path. 2007-04-20 02:38:05 +00:00
pg_aggregate.c Re-run pgindent, fixing a problem where comment lines after a blank 2005-11-22 18:23:31 +00:00
pg_constraint.c Re-run pgindent, fixing a problem where comment lines after a blank 2005-11-22 18:23:31 +00:00
pg_conversion.c Clean up rather sloppy fix in HEAD for the ancient bug that CREATE CONVERSION 2006-08-31 17:31:40 +00:00
pg_depend.c Standard pgindent run for 8.1. 2005-10-15 02:49:52 +00:00
pg_largeobject.c Completion of project to use fixed OIDs for all system catalogs and 2005-04-14 20:03:27 +00:00
pg_namespace.c Track dependencies on shared objects (which is to say, roles; we already 2005-07-07 20:40:02 +00:00
pg_operator.c Standard pgindent run for 8.1. 2005-10-15 02:49:52 +00:00
pg_proc.c Fix erroneous handling of shared dependencies (ie dependencies on roles) 2009-10-02 18:13:32 +00:00
pg_shdepend.c Re-run pgindent, fixing a problem where comment lines after a blank 2005-11-22 18:23:31 +00:00
pg_type.c Repair a longstanding bug in CLUSTER and the rewriting variants of ALTER 2009-02-24 01:39:10 +00:00
README First phase of project to use fixed OIDs for all system catalogs and 2005-04-14 01:38:22 +00:00
sql_feature_packages.txt > I have installed your patch and adjusted the names of the standards 2004-12-02 22:51:28 +00:00
sql_features.txt Mention we now support BETWEEN SYMMETRIC. 2005-06-15 01:28:43 +00:00
system_views.sql Revise pgstats stuff to fix the problems with not counting accesses 2005-10-06 02:29:23 +00:00

$PostgreSQL: pgsql/src/backend/catalog/README,v 1.9 2005/04/14 01:38:15 tgl Exp $

This directory contains .c files that manipulate the system catalogs;
src/include/catalog contains the .h files that define the structure
of the system catalogs.

When the compile-time scripts (such as Gen_fmgrtab.sh and genbki.sh)
execute, they grep the DATA statements out of the .h files and munge
these in order to generate the postgres.bki file.  The .bki file is then
used as input to initdb (which is just a wrapper around postgres
running single-user in bootstrapping mode) in order to generate the
initial (template) system catalog relation files.

-----------------------------------------------------------------

People who are going to hose around with the .h files should be aware
of the following facts:

- It is very important that the DATA statements be properly formatted
(e.g., no broken lines, proper use of white-space and _null_).  The
scripts are line-oriented and break easily.  In addition, the only
documentation on the proper format for them is the code in the
bootstrap/ directory.  Just be careful when adding new DATA
statements.

- Some catalogs require that OIDs be preallocated to tuples because
of cross-references from other pre-loaded tuples.  For example, pg_type
contains pointers into pg_proc (e.g., pg_type.typinput), and pg_proc
contains back-pointers into pg_type (pg_proc.proargtypes).  For such
cases, the OID assigned to a tuple may be explicitly set by use of the
"OID = n" clause of the .bki insert statement.  If no such pointers are
required to a given tuple, then the OID = n clause may be omitted
(then the system generates an OID in the usual way, or leaves it 0 in a
catalog that has no OIDs).  In practice we usually preassign OIDs
for all or none of the pre-loaded tuples in a given catalog, even if only
some of them are actually cross-referenced.

- We also sometimes preallocate OIDs for catalog tuples whose OIDs must
be known directly in the C code.  In such cases, put a #define in the
catalog's .h file, and use the #define symbol in the C code.  Writing
the actual numeric value of any OID in C code is considered very bad form.
Direct references to pg_proc OIDs are common enough that there's a special
mechanism to create the necessary #define's automatically: see
backend/utils/Gen_fmgrtab.sh.  We also have standard conventions for setting
up #define's for the pg_class OIDs of system catalogs and indexes.  For all
the other system catalogs, you have to manually create any #define's you
need.

- If you need to find a valid OID for a new predefined tuple,
use the unused_oids script.  It generates inclusive ranges of
*unused* OIDs (e.g., the line "45-900" means OIDs 45 through 900 have
not been allocated yet).  Currently, OIDs 1-9999 are reserved for manual
assignment; the unused_oids script simply looks through the include/catalog
headers to see which ones do not appear in "OID =" clauses in DATA lines.
(As of Postgres 8.1, it also looks at CATALOG and DECLARE_INDEX lines.)
You can also use the duplicate_oids script to check for mistakes.

- The OID counter starts at 10000 at bootstrap.  If a catalog row is in a
table that requires OIDs, but no OID was preassigned by an "OID =" clause,
then it will receive an OID of 10000 or above.

- To create a "BOOTSTRAP" table you have to do a lot of extra work: these
tables are not created through a normal CREATE TABLE operation, but spring
into existence when first written to during initdb.  Therefore, you must
manually create appropriate entries for them in the pre-loaded contents of
pg_class, pg_attribute, and pg_type.  Avoid making new catalogs be bootstrap
catalogs if at all possible; generally, only tables that must be written to
in order to create a table should be bootstrapped.

- Certain BOOTSTRAP tables must be at the start of the Makefile
POSTGRES_BKI_SRCS variable, as these cannot be created through the standard
heap_create_with_catalog process, because it needs these tables to exist
already.  The list of files this currently includes is:
	pg_proc.h pg_type.h pg_attribute.h pg_class.h
Also, indexing.h must be last, since the indexes can't be created until all
the tables are in place.  There are reputedly some other order dependencies
in the .bki list, too.

-----------------------------------------------------------------

When munging the .c files, you should be aware of certain conventions:

- The system catalog cache code (and most catalog-munging code in
general) assumes that the fixed-length portions of all system catalog
tuples are in fact present, because it maps C struct declarations onto
them.  Thus, the variable-length fields must all be at the end, and
only the variable-length fields of a catalog tuple are permitted to be
NULL.  For example, if you set pg_type.typdelim to be NULL, a
piece of code will likely perform "typetup->typdelim" (or, worse,
"typetyp->typelem", which follows typdelim).  This will result in
random errors or even segmentation violations.  Hence, do NOT insert
catalog tuples that contain NULL attributes except in their
variable-length portions!  (The bootstrapping code is fairly good about
marking NOT NULL each of the columns that can legally be referenced via
C struct declarations ... but those markings won't be enforced against
DATA commands, so you must get it right in a DATA line.)

- Modification of the catalogs must be performed with the proper
updating of catalog indexes!  That is, most catalogs have indexes
on them; when you munge them using the executor, the executor will
take care of doing the index updates, but if you make direct access
method calls to insert new or modified tuples into a heap, you must
also make the calls to insert the tuple into ALL of its indexes!  If
not, the new tuple will generally be "invisible" to the system because
most of the accesses to the catalogs in question will be through the
associated indexes.