Make REPLICATION privilege checks test current user not authenticated user.

The pg_start_backup() and pg_stop_backup() functions checked the privileges
of the initially-authenticated user rather than the current user, which is
wrong.  For example, a user-defined index function could successfully call
these functions when executed by ANALYZE within autovacuum.  This could
allow an attacker with valid but low-privilege database access to interfere
with creation of routine backups.  Reported and fixed by Noah Misch.

Security: CVE-2013-1901

diff --git a/src/backend/access/transam/xlog.c b/src/backend/access/transam/xlog.c
index a4bc8c88eb69da0824461a9a22f4558a6f9780bf..690077ce821da818e5f7e125071093c6e98d6287 100644 (file)
--- a/src/backend/access/transam/xlog.c
+++ b/src/backend/access/transam/xlog.c
@@ -9413,7 +9413,7 @@ do_pg_start_backup(const char *backupidstr, bool fast, char **labelfile)
 
        backup_started_in_recovery = RecoveryInProgress();
 
-       if (!superuser() && !is_authenticated_user_replication_role())
+       if (!superuser() && !has_rolreplication(GetUserId()))
                ereport(ERROR,
                                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                   errmsg("must be superuser or replication role to run a backup")));
@@ -9743,7 +9743,7 @@ do_pg_stop_backup(char *labelfile, bool waitforarchive)
 
        backup_started_in_recovery = RecoveryInProgress();
 
-       if (!superuser() && !is_authenticated_user_replication_role())
+       if (!superuser() && !has_rolreplication(GetUserId()))
                ereport(ERROR,
                                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                 (errmsg("must be superuser or replication role to run a backup"))));

diff --git a/src/backend/utils/init/miscinit.c b/src/backend/utils/init/miscinit.c
index b28567e6521cfa25c6cc7a66010cfa95a3941c3c..0a40bcf5270645c4a768fe12cab32043edb3fa7e 100644 (file)
--- a/src/backend/utils/init/miscinit.c
+++ b/src/backend/utils/init/miscinit.c
@@ -389,15 +389,15 @@ SetUserIdAndContext(Oid userid, bool sec_def_context)
 
 
 /*
- * Check if the authenticated user is a replication role
+ * Check whether specified role has explicit REPLICATION privilege
  */
 bool
-is_authenticated_user_replication_role(void)
+has_rolreplication(Oid roleid)
 {
        bool            result = false;
        HeapTuple       utup;
 
-       utup = SearchSysCache1(AUTHOID, ObjectIdGetDatum(AuthenticatedUserId));
+       utup = SearchSysCache1(AUTHOID, ObjectIdGetDatum(roleid));
        if (HeapTupleIsValid(utup))
        {
                result = ((Form_pg_authid) GETSTRUCT(utup))->rolreplication;

diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
index ba0eba556895b31b9a66bf6e05eb113da2b2f566..3dc5331772eeb09ed3dc3383048e2fc2de5b54c8 100644 (file)
--- a/src/backend/utils/init/postinit.c
+++ b/src/backend/utils/init/postinit.c
@@ -668,7 +668,7 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
        {
                Assert(!bootstrap);
 
-               if (!superuser() && !is_authenticated_user_replication_role())
+               if (!superuser() && !has_rolreplication(GetUserId()))
                        ereport(FATAL,
                                        (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                                         errmsg("must be superuser or replication role to start walsender")));

diff --git a/src/include/miscadmin.h b/src/include/miscadmin.h
index 8df2a28126a1f24e7a72513fb253da5c3f87773f..5b92767682d174dd1de8205b78851bc696db971d 100644 (file)
--- a/src/include/miscadmin.h
+++ b/src/include/miscadmin.h
@@ -436,7 +436,7 @@ extern void ValidatePgVersion(const char *path);
 extern void process_shared_preload_libraries(void);
 extern void process_local_preload_libraries(void);
 extern void pg_bindtextdomain(const char *domain);
-extern bool is_authenticated_user_replication_role(void);
+extern bool has_rolreplication(Oid roleid);
 
 /* in access/transam/xlog.c */
 extern bool BackupInProgress(void);