pgsql: Make standard maintenance operations (including VACUUM, ANALYZE,

Log Message:
-----------
Make standard maintenance operations (including VACUUM, ANALYZE, REINDEX,
and CLUSTER) execute as the table owner rather than the calling user, using
the same privilege-switching mechanism already used for SECURITY DEFINER
functions. The purpose of this change is to ensure that user-defined
functions used in index definitions cannot acquire the privileges of a
superuser account that is performing routine maintenance. While a function
used in an index is supposed to be IMMUTABLE and thus not able to do anything
very interesting, there are several easy ways around that restriction; and
even if we could plug them all, there would remain a risk of reading sensitive
information and broadcasting it through a covert channel such as CPU usage.

To prevent bypassing this security measure, execution of SET SESSION
AUTHORIZATION and SET ROLE is now forbidden within a SECURITY DEFINER context.

Thanks to Itagaki Takahiro for reporting this vulnerability.

Security: CVE-2007-6600

Modified Files:
--------------
pgsql/doc/src/sgml/ref:
set_role.sgml (r1.4 -> r1.5)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/set_role.sgml?r1=1.4&r2=1.5)
set_session_auth.sgml (r1.16 -> r1.17)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/set_session_auth.sgml?r1=1.16&r2=1.17)
show.sgml (r1.44 -> r1.45)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/ref/show.sgml?r1=1.44&r2=1.45)
pgsql/src/backend/access/transam:
xact.c (r1.255 -> r1.256)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/access/transam/xact.c?r1=1.255&r2=1.256)
pgsql/src/backend/catalog:
index.c (r1.289 -> r1.290)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/catalog/index.c?r1=1.289&r2=1.290)
pgsql/src/backend/commands:
analyze.c (r1.113 -> r1.114)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/analyze.c?r1=1.113&r2=1.114)
schemacmds.c (r1.48 -> r1.49)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/schemacmds.c?r1=1.48&r2=1.49)
vacuum.c (r1.362 -> r1.363)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/vacuum.c?r1=1.362&r2=1.363)
variable.c (r1.124 -> r1.125)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/commands/variable.c?r1=1.124&r2=1.125)
pgsql/src/backend/utils/adt:
ri_triggers.c (r1.100 -> r1.101)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/adt/ri_triggers.c?r1=1.100&r2=1.101)
pgsql/src/backend/utils/fmgr:
fmgr.c (r1.112 -> r1.113)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/fmgr/fmgr.c?r1=1.112&r2=1.113)
pgsql/src/backend/utils/init:
miscinit.c (r1.165 -> r1.166)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/backend/utils/init/miscinit.c?r1=1.165&r2=1.166)
pgsql/src/include:
miscadmin.h (r1.198 -> r1.199)
(http://developer.postgresql.org/cvsweb.cgi/pgsql/src/include/miscadmin.h?r1=1.198&r2=1.199)