Skip to content

Commit 0edad86

Browse files
committed
Parallel workers use AuthenticatedUserId for connection privilege checks.
Commit 5a2fed9 had an unexpected side-effect: the parallel worker launched for the new test case would fail if it couldn't use a superuser-reserved connection slot. The reason that test failed while all our pre-existing ones worked is that the connection privilege tests in InitPostgres had been based on the superuserness of the leader's AuthenticatedUserId, but after the rearrangements of 5a2fed9 we were testing the superuserness of CurrentUserId, which the new test case deliberately made to be a non-superuser. This all seems very accidental and probably not the behavior we really want, but a security patch is no time to be redesigning things. Pending some discussion about desirable semantics, hack it so that InitPostgres continues to pay attention to the superuserness of AuthenticatedUserId when starting a parallel worker. Nathan Bossart and Tom Lane, per buildfarm member sawshark. Security: CVE-2024-10978
1 parent 9fc1c3a commit 0edad86

File tree

1 file changed

+18
-1
lines changed

1 file changed

+18
-1
lines changed

src/backend/utils/init/postinit.c

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include "access/genam.h"
2323
#include "access/heapam.h"
2424
#include "access/htup_details.h"
25+
#include "access/parallel.h"
2526
#include "access/session.h"
2627
#include "access/sysattr.h"
2728
#include "access/tableam.h"
@@ -764,7 +765,23 @@ InitPostgres(const char *in_dbname, Oid dboid, const char *username,
764765
else
765766
{
766767
InitializeSessionUserId(username, useroid);
767-
am_superuser = superuser();
768+
769+
/*
770+
* In a parallel worker, set am_superuser based on the
771+
* authenticated user ID, not the current role. This is pretty
772+
* dubious but it matches our historical behavior. Note that this
773+
* value of am_superuser is used only for connection-privilege
774+
* checks here and in CheckMyDatabase (we won't reach
775+
* process_startup_options in a background worker).
776+
*
777+
* In other cases, there's been no opportunity for the current
778+
* role to diverge from the authenticated user ID yet, so we can
779+
* just rely on superuser() and avoid an extra catalog lookup.
780+
*/
781+
if (InitializingParallelWorker)
782+
am_superuser = superuser_arg(GetAuthenticatedUserId());
783+
else
784+
am_superuser = superuser();
768785
}
769786
}
770787
else

0 commit comments

Comments
 (0)