PostgreSQL set_user Extension Module-Crunchy Data.pdf
免费下载
PostgreSQL set_user Extension Module
Syntax
set_user(text rolename) returns text
set_user(text rolename, text token) returns text
set_user_u(text rolename) returns text
reset_user() returns text
reset_user(text token) returns text
set_session_auth(text rolename) returns text
Inputs
rolename
is the role to be transitioned to.
token
if provided during set_user is
saved, and then required to be provided again for reset.
Configuration Options
• Add set_user to shared_preload_libraries in postgresql.conf.
•
Optionally, the following custom parameters may be set to control their
respective commands:
• set_user.block_alter_system = off (defaults to “on”)
• set_user.block_copy_program = off (defaults to “on”)
• set_user.block_log_statement = off (defaults to “on”)
• set_user.superuser_allowlist = ’<role list>’
– <role list> can contain any of the following:
– list of user roles (i.e. <role1>, <role2>,...,<roleN>)
– Group roles may be indicated by +<roleN>
– The wildcard character *
• set_user.nosuperuser_target_allowlist = ’<role list>’
– <role list> can contain any of the following:
– list of user roles (i.e. <role1>, <role2>,...,<roleN>)
– Group roles may be indicated by +<roleN>
– The wildcard character *
• set_user.exit_on_error = off (defaults to “on”)
•
To make use of the optional
set_user
and
reset_user
hooks, please refer
to the hooks section.
1
Description
This PostgreSQL extension allows switching users and optional privilege escala-
tion with enhanced logging and control. It provides an additional layer of logging
and control when unprivileged users must escalate themselves to superuser or
object owner roles in order to perform needed maintenance tasks. Specifically,
when an allowed user executes
set_user(text)
or
set_user_u(text)
, several
actions occur:
• The current effective user becomes rolename.
•
The role transition is logged, with a specific notation if
rolename
is a
superuser.
• log_statement
setting is set to “all”, meaning every SQL statement
executed while in this state will also get logged.
•
If
set_user.block_alter_system
is set to “on”,
ALTER SYSTEM
com-
mands will be blocked.
•
If
set_user.block_copy_program
is set to “on”,
COPY PROGRAM
com-
mands will be blocked.
•
If
set_user.block_log_statement
is set to “on”,
SET log_statement
and variations will be blocked.
•
If
set_user.block_log_statement
is set to “on” and
rolename
is a
database superuser, the current
log_statement
setting is changed to
“all”, meaning every SQL statement executed
•
If
set_user.superuser_audit_tag
is set, the string value will
be appended to
log_line_prefix
upon superuser escalation. All
logs after superuser escalation will be tagged with the value of
set_user.superuser_audit_tag. This value defaults to ’AUDIT’.
•
If
set_user.exit_on_error
is set to “on”, the backend process will exit
on ERROR during calls to set_session_auth().
• Post-execution hook for set_user is called if it is set.
Only users with
EXECUTE
permission on
set_user_u(text)
may esca-
late to superuser. Additionally, all rules in Superuser Allowlist apply to
set_user.superuser_allowlist and set_user_u(text).
Postgres roles calling
set_user(text)
can only transition to roles listed or
included in
set_user.nosuperuser_target_allowlist
(defaults to all roles).
Additionally the logic in Nosuperuser Allowlist applies to
current_user
when
set_user() is invoked.
Additionally, with
set_user(’rolename’,’token’)
the
token
is stored for the
lifetime of the session.
When finished with required actions as
rolename
, the
reset_user()
function
is executed to restore the original user. At that point, these actions occur:
2
of 17
免费下载
【版权声明】本文为墨天轮用户原创内容，转载时必须标注文档的来源（墨天轮），文档链接，文档作者等基本信息，否则作者和墨天轮有权追究责任。如果您发现墨天轮中有涉嫌抄袭或者侵权的内容，欢迎发送邮件至：contact@modb.pro进行举报，并提供相关证据，一经查实，墨天轮将立刻删除相关内容。
下载排行榜
评论