Disallow SET SESSION AUTHORIZATION pg_*

As part of reserving the pg_* namespace for default roles and in line
with SET ROLE and other previous efforts, disallow settings the role
to a default/reserved role using SET SESSION AUTHORIZATION.

These checks and restrictions on what is allowed regarding default /
reserved roles are under debate, but it seems prudent to ensure that
the existing checks at least cover the intended cases while the
debate rages on.  On me to clean it up if the consensus decision is
to remove these checks.

diff --git a/src/backend/commands/variable.c b/src/backend/commands/variable.c
index 57da0149d9fc35c844860078cb39cb71e409482a..05e59a6e0977dcc9e3c9ff385f93c5e292f57312 100644 (file)
--- a/src/backend/commands/variable.c
+++ b/src/backend/commands/variable.c
@@ -794,6 +794,10 @@ check_session_authorization(char **newval, void **extra, GucSource source)
                return false;
        }
 
+       /* Do not allow setting role to a reserved role. */
+       if (strncmp(*newval, "pg_", 3) == 0)
+               return false;
+
        /* Look up the username */
        roleTup = SearchSysCache1(AUTHNAME, PointerGetDatum(*newval));
        if (!HeapTupleIsValid(roleTup))