Enhance security permissions

Поиск
Список
Период
Сортировка
От Ranier Vilela
Тема Enhance security permissions
Дата
Msg-id CAEudQAo0S06MbbS2AHXFzHgjnMULxhcwpVkVp4o9v_kkECA-Og@mail.gmail.com
обсуждение исходный текст
Ответы Re: Enhance security permissions
Список pgsql-hackers
Дерево обсуждения
Hi.

I noticed this while checking the source (src/interfaces/libpq/fe-connect.c).
It seems that S_IRWXU permission is harmful too.

In accord with [1] and [2] this should also be checked.
Also, all other places in the source,  S_IRWXU are checked.

So, I propose adding this check to enhance the security.

Maybe the error messages, do they need improvement as well?

patchs attached.

best regards,
Ranier Vilela

Вложения

В списке pgsql-hackers по дате отправления: