Re: Securing "make check" (CVE-2014-0067)

On Sun, Sep 21, 2014 at 02:31:15AM -0400, Noah Misch wrote:
> It then dawned on me that every Windows build of PostgreSQL already has a way
> to limit connections to a particular OS user. SSPI authentication is
> essentially the Windows equivalent of peer authentication. A brief trial
> thereof looked promising. Regression runs will need a pg_ident.conf listing
> each role used in the regression tests. That's not ideal, but the buildfarm
> will quickly reveal any omissions. Unless someone sees a problem here, I will
> look at fleshing this out into a complete patch. I bet it will even turn out
> to be back-patchable.

That worked out nicely. "pg_regress --temp-install" rewrites pg_ident.conf
and pg_hba.conf such that the current OS user may authenticate as the
bootstrap superuser and as any user named in --create-role. Suites not using
--temp-install (pg_upgrade, TAP) call "pg_regress --config-auth=DATADIR" to
pick up those same configuration changes. My hope is that out-of-tree test
harnesses wanting this hardening can do likewise. On non-Windows systems,
"pg_regress --config-auth" does nothing.

The TAP suite did not and does not succeed on Windows. I have good confidence
in my changes to make it use SSPI, but I tested them fully on GNU/Linux only.

Adding the explicit PGHOST=localhost to the pg_upgrade test suite is necessary
to avoid the "host name must be specified" error under SSPI authentication. I
tentatively view that as a bug in libpq, but it's orthogonal to this patch.
pg_regress.c already sets PGHOST explicitly.

Since I was rewriting various test suite "initdb" calls anyway, I made a few
use "-N" that weren't using it previously.

Thanks,
nm