Re: pg_settings.sourcefile patch is a security breach

Поиск
Список
Период
Сортировка
От Magnus Hagander
Тема Re: pg_settings.sourcefile patch is a security breach
Дата
Msg-id 48D694B4.3010504@hagander.net
обсуждение исходный текст
Ответ на pg_settings.sourcefile patch is a security breach  (Tom Lane <tgl@sss.pgh.pa.us>)
Ответы Re: pg_settings.sourcefile patch is a security breach
Список pgsql-hackers
Tom Lane wrote:
> We go to some lengths to prevent non-superusers from examining
> data_directory and other values that would tell them exactly where the
> PG data directory is in the server's filesystem.  The recently applied
> patch to expose full pathnames of GUC variables' source files blows a
> hole a mile wide in that.
> 
> Possible answers: don't show the path, only the file name; or
> show sourcefile/sourceline as NULL to non-superusers.

My vote goes for showing it as NULL to non-superusers. If we remove the
path, that makes it pretty darn useless for admin tools - which was the
main reason it was added in the first place..

And "showing full path for superuser, just filename for non-superusers"
just seems to be way too ugly to consider :-)

//Magnus



В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: pg_settings.sourcefile patch is a security breach
Следующее
От: "Dmitry Koterov"
Дата:
Сообщение: Re: Foreign key constraint for array-field?