usercontext.c File Reference

#include "postgres.h"
#include "miscadmin.h"
#include "utils/acl.h"
#include "utils/guc.h"
#include "utils/usercontext.h"

Include dependency graph for usercontext.c:

Go to the source code of this file.

Functions
void	SwitchToUntrustedUser (Oid userid, UserContext *context)
void	RestoreUserContext (UserContext *context)

Function Documentation

RestoreUserContext()

void RestoreUserContext

(

UserContext *

context

)

Definition at line 87 of file usercontext.c.

{
    if (context->save_nestlevel != -1)
        AtEOXact_GUC(false, context->save_nestlevel);
    SetUserIdAndSecContext(context->save_userid, context->save_sec_context);
}

References AtEOXact_GUC(), context, and SetUserIdAndSecContext().

Referenced by apply_handle_delete(), apply_handle_insert(), apply_handle_update(), ExecuteTruncateGuts(), and LogicalRepSyncTableStart().

SwitchToUntrustedUser()

void SwitchToUntrustedUser	(	Oid	userid,
		UserContext *	context
	)

Definition at line 33 of file usercontext.c.

{
    /* Get the current user ID and security context. */
    GetUserIdAndSecContext(&context->save_userid,
                           &context->save_sec_context);
 
    /* Check that we have sufficient privileges to assume the target role. */
    if (!member_can_set_role(context->save_userid, userid))
        ereport(ERROR,
                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                 errmsg("role \"%s\" cannot SET ROLE to \"%s\"",
                        GetUserNameFromId(context->save_userid, false),
                        GetUserNameFromId(userid, false))));
 
    /*
     * Try to prevent the user to which we're switching from assuming the
     * privileges of the current user, unless they can SET ROLE to that user
     * anyway.
     */
    if (member_can_set_role(userid, context->save_userid))
    {
        /*
         * Each user can SET ROLE to the other, so there's no point in
         * imposing any security restrictions. Just let the user do whatever
         * they want.
         */
        SetUserIdAndSecContext(userid, context->save_sec_context);
        context->save_nestlevel = -1;
    }
    else
    {
        int         sec_context = context->save_sec_context;
 
        /*
         * This user can SET ROLE to the target user, but not the other way
         * around, so protect ourselves against the target user by setting
         * SECURITY_RESTRICTED_OPERATION to prevent certain changes to the
         * session state. Also set up a new GUC nest level, so that we can
         * roll back any GUC changes that may be made by code running as the
         * target user, inasmuch as they could be malicious.
         */
        sec_context |= SECURITY_RESTRICTED_OPERATION;
        SetUserIdAndSecContext(userid, sec_context);
        context->save_nestlevel = NewGUCNestLevel();
    }
}

References context, ereport, errcode(), errmsg(), ERROR, GetUserIdAndSecContext(), GetUserNameFromId(), member_can_set_role(), NewGUCNestLevel(), SECURITY_RESTRICTED_OPERATION, and SetUserIdAndSecContext().

Referenced by apply_handle_delete(), apply_handle_insert(), apply_handle_update(), ExecuteTruncateGuts(), and LogicalRepSyncTableStart().