Re: copy.c handling for RLS is insecure

On Mon, Oct 06, 2014 at 03:15:25PM -0400, Stephen Frost wrote:

> > As far as I can see, the previous code only looked up any given name
> > once. If you got a relation name, DoCopy() looked it up, and then
> > BeginCopy() references it only by the passed-down Relation descriptor;
> > if you got a query, DoCopy() ignores it, and then BeginCopy. All of
> > which is fine, at least AFAICS; if you think otherwise, that should be
> > reported to pgsql-security.
>
> Yeah, that's correct. I suppose there's some possible risk of things
> changing between when you parse the query and when it actually gets
> analyzed and rewritten, but that's not a security risk per-se..

I'm not sure I understand. If that change violates an access control,
it's a security risk /per se/, as you put it.

Are you saying that such changes, even though they might be bugs,
categorically couldn't violate an access control?

Cheers,
David.
--
David Fetter <david(at)fetter(dot)org> http://fetter.org/
Phone: +1 415 235 3778 AIM: dfetter666 Yahoo!: dfetter
Skype: davidfetter XMPP: david(dot)fetter(at)gmail(dot)com
iCal: webcal://www.tripit.com/feed/ical/people/david74/tripit.ics

Remember to vote!
Consider donating to Postgres: http://www.postgresql.org/about/donate