|
| 1 | +-- enable logging skipped event triggers |
| 2 | +set supautils.log_skipped_evtrigs = true; |
| 3 | +\echo |
| 4 | + |
1 | 5 | -- create a function owned by a non-superuser
|
2 | 6 | set role privileged_role;
|
3 | 7 | \echo
|
@@ -65,24 +69,34 @@ set role supabase_storage_admin;
|
65 | 69 | \echo
|
66 | 70 |
|
67 | 71 | create table storage_stuff();
|
| 72 | +NOTICE: Skipping event trigger function "show_current_user" for user "supabase_storage_admin" |
| 73 | +DETAIL: "supabase_storage_admin" is a reserved role and the function "show_current_user" is not superuser-owned, it's owned by "privileged_role" |
68 | 74 | \echo
|
69 | 75 |
|
70 | 76 | drop table storage_stuff;
|
| 77 | +NOTICE: Skipping event trigger function "show_current_user" for user "supabase_storage_admin" |
| 78 | +DETAIL: "supabase_storage_admin" is a reserved role and the function "show_current_user" is not superuser-owned, it's owned by "privileged_role" |
71 | 79 | \echo
|
72 | 80 |
|
73 | 81 | -- A superuser role shouldn't execute the event trigger function
|
74 | 82 | set role postgres;
|
75 | 83 | \echo
|
76 | 84 |
|
77 | 85 | create table super_stuff();
|
| 86 | +NOTICE: Skipping event trigger function "show_current_user" for user "postgres" |
| 87 | +DETAIL: "postgres" is a superuser and the function "show_current_user" is not superuser-owned, it's owned by "privileged_role" |
78 | 88 | \echo
|
79 | 89 |
|
80 | 90 | -- extensions won't execute the event trigger function (since they're executed by superuser under our implementation)
|
81 | 91 | set role rolecreator;
|
82 | 92 | \echo
|
83 | 93 |
|
84 | 94 | create extension postgres_fdw;
|
| 95 | +NOTICE: Skipping event trigger function "show_current_user" for user "postgres" |
| 96 | +DETAIL: "postgres" is a superuser and the function "show_current_user" is not superuser-owned, it's owned by "privileged_role" |
85 | 97 | drop extension postgres_fdw;
|
| 98 | +NOTICE: Skipping event trigger function "show_current_user" for user "postgres" |
| 99 | +DETAIL: "postgres" is a superuser and the function "show_current_user" is not superuser-owned, it's owned by "privileged_role" |
86 | 100 | \echo
|
87 | 101 |
|
88 | 102 | -- privesc shouldn't happen due to superuser tripping over a user-defined event trigger
|
@@ -110,34 +124,33 @@ set role postgres;
|
110 | 124 | \echo
|
111 | 125 |
|
112 | 126 | create table super_duper_stuff();
|
| 127 | +NOTICE: Skipping event trigger function "show_current_user" for user "postgres" |
| 128 | +DETAIL: "postgres" is a superuser and the function "show_current_user" is not superuser-owned, it's owned by "privileged_role" |
| 129 | +NOTICE: Skipping event trigger function "become_super" for user "postgres" |
| 130 | +DETAIL: "postgres" is a superuser and the function "become_super" is not superuser-owned, it's owned by "privileged_role" |
| 131 | +\echo |
| 132 | + |
113 | 133 | select count(*) = 1 as only_one_super from pg_roles where rolsuper;
|
114 | 134 | only_one_super
|
115 | 135 | ----------------
|
116 | 136 | t
|
117 | 137 | (1 row)
|
118 | 138 |
|
119 |
| --- ensure logging skipped event triggers happens when enabled, for superusers and reserved roles |
120 |
| -set supautils.log_skipped_evtrigs = true; |
| 139 | +-- ensure logging doesn't happen when the GUC is disabled |
| 140 | +set supautils.log_skipped_evtrigs = false; |
121 | 141 | \echo
|
122 | 142 |
|
123 | 143 | create table supa_stuff();
|
124 |
| -NOTICE: Skipping event trigger function "show_current_user" for user "postgres" |
125 |
| -DETAIL: "postgres" is a superuser and the function "show_current_user" is not superuser-owned, it's owned by "privileged_role" |
126 |
| -NOTICE: Skipping event trigger function "become_super" for user "postgres" |
127 |
| -DETAIL: "postgres" is a superuser and the function "become_super" is not superuser-owned, it's owned by "privileged_role" |
128 | 144 | \echo
|
129 | 145 |
|
130 | 146 | set role supabase_storage_admin;
|
131 | 147 | \echo
|
132 | 148 |
|
133 | 149 | create table some_stuff();
|
134 |
| -NOTICE: Skipping event trigger function "show_current_user" for user "supabase_storage_admin" |
135 |
| -DETAIL: "supabase_storage_admin" is a reserved role and the function "show_current_user" is not superuser-owned, it's owned by "privileged_role" |
136 |
| -NOTICE: Skipping event trigger function "become_super" for user "supabase_storage_admin" |
137 |
| -DETAIL: "supabase_storage_admin" is a reserved role and the function "become_super" is not superuser-owned, it's owned by "privileged_role" |
138 | 150 | \echo
|
139 | 151 |
|
140 |
| -reset supautils.log_skipped_evtrigs; |
| 152 | +-- restablish logging for the rest of the tests |
| 153 | +set supautils.log_skipped_evtrigs = true; |
141 | 154 | \echo
|
142 | 155 |
|
143 | 156 | -- privesc won't happen because the event trigger function will fire with the privileges
|
@@ -203,11 +216,15 @@ execute procedure secdef_show_current_user();
|
203 | 216 | -- secdef won't be executed for superuser
|
204 | 217 | set role postgres;
|
205 | 218 | create table super_foo();
|
| 219 | +NOTICE: Skipping event trigger function "secdef_show_current_user" for user "postgres" |
| 220 | +DETAIL: "postgres" is a superuser and the function "secdef_show_current_user" is not superuser-owned, it's owned by "privileged_role" |
206 | 221 | \echo
|
207 | 222 |
|
208 | 223 | -- secdef won't be executed for reserved roles
|
209 | 224 | set role supabase_storage_admin;
|
210 | 225 | create table storage_foo();
|
| 226 | +NOTICE: Skipping event trigger function "secdef_show_current_user" for user "supabase_storage_admin" |
| 227 | +DETAIL: "supabase_storage_admin" is a reserved role and the function "secdef_show_current_user" is not superuser-owned, it's owned by "privileged_role" |
211 | 228 | \echo
|
212 | 229 |
|
213 | 230 | -- secdef will be executed for other roles
|
|
0 commit comments