Re: Unprivileged user can induce crash by using an SUSET param in PGOPTIONS

Nathan Bossart <nathandbossart@gmail.com> writes:
> On Fri, Jul 22, 2022 at 02:56:22PM -0400, Tom Lane wrote:
>> +    if (!bootstrap &&
>> +        !IsAutoVacuumWorkerProcess() &&
>> +        !IsBackgroundWorker &&
>> +        !am_walsender)
>> +        process_session_preload_libraries();

> I worry that this will be easily missed when adding new types of
> non-interactive sessions, but I can't claim to have a better idea.

Yeah, that bothered me too.  A variant that I'd considered is to
create a local variable "bool interactive" and set it properly
in each of the arms of the if-chain dealing with authentication
(starting about postinit.c:800).  While that approach would cover
most of the tests shown above, it would not have exposed the issue
of needing to check am_walsender, so I'm not very convinced that
it'd be any better.

Another idea is to add a "bool interactive" parameter to InitPostgres,
thereby shoving the issue out to the call sites.  Still wouldn't
expose the am_walsender angle, but conceivably it'd be more
future-proof anyway?

            regards, tom lane