Skip to content

Disable COPY FROM PROGRAM under separate build-time option #1956

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
reshke wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Disable COPY FROM PROGRAM under separate build-time option #1956

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
28 changes: 28 additions & 0 deletions configure
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -796,6 +796,7 @@ CLANG
LLVM_CONFIG
AWK
with_llvm
with_copy_program
SUN_STUDIO_CC
ac_ct_CXX
CXXFLAGS
Expand Down Expand Up @@ -904,6 +905,7 @@ with_segsize_blocks
with_wal_blocksize
with_CC
with_llvm
with_copy_program
enable_depend
enable_cassert
enable_orca
Expand Down Expand Up @@ -1670,6 +1672,7 @@ Optional Packages:
set WAL block size in kB [8]
--with-CC=CMD set compiler (deprecated)
--with-llvm build with LLVM based JIT support
--without-copy-program build without COPY TO/FROM PROGRAM support
--without-icu build without ICU support
--with-tcl build Tcl modules (PL/Tcl)
--with-tclconfig=DIR tclConfig.sh is in DIR
Expand Down Expand Up @@ -5380,6 +5383,31 @@ else
fi


# Check whether --with-copy-program was given.
if test "${with_copy_program+set}" = set; then :
withval=$with_copy_program;
case $withval in
yes)

$as_echo "#define USE_COPY_PROGRAM 1" >>confdefs.h

;;
no)
:
;;
*)
as_fn_error $? "no argument expected for --with-copy-program option" "$LINENO" 5
;;
esac

else
with_copy_program=yes

$as_echo "#define USE_COPY_PROGRAM 1" >>confdefs.h

fi



for ac_prog in gawk mawk nawk awk
do
Expand Down
10 changes: 10 additions & 0 deletions configure.ac
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -468,6 +468,16 @@ AS_IF([test "$with_llvm" = yes], [
PGAC_LLVM_SUPPORT()
]) # fi

#
# --without-copy-program disables COPY TO/FROM PROGRAM
#
PGAC_ARG_BOOL(with, copy-program, yes,
[build with COPY TO/FROM PROGRAM support],
[AC_DEFINE([USE_COPY_PROGRAM], 1,
[Define to 1 to build with COPY TO/FROM PROGRAM support. (--with-copy-program)])])
AC_MSG_RESULT([checking whether to build with COPY PROGRAM... $with_copy_program])
AC_SUBST(with_copy_program)


unset CFLAGS
unset CXXFLAGS
Expand Down
8 changes: 8 additions & 0 deletions contrib/file_fdw/file_fdw.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -413,10 +413,18 @@ fileGetOptions(Oid foreigntableid,
}
else if (strcmp(def->defname, "program") == 0)
{
#ifndef USE_COPY_PROGRAM
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
errmsg("permission denied to use program option in file_fdw"),
errhint("Anyone can COPY to stdout or from stdin. "
"psql's \\copy command also works for anyone.")));
#else
*filename = defGetString(def);
*is_program = true;
options = foreach_delete_current(options, lc);
break;
#endif
}
}

Expand Down
18 changes: 16 additions & 2 deletions doc/src/sgml/installation.sgml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -989,9 +989,23 @@ build-postgresql:
environment variable).
</para>
</listitem>
</varlistentry>
</varlistentry>

<varlistentry id="configure-without-copy-program">
<term><option>--without-copy-program</option></term>
<listitem>
<para>
Build without support for <command>COPY TO/FROM PROGRAM</command>.
By default, this feature is enabled. When built with
<option>--without-copy-program</option>, any attempt to use
<command>COPY</command> with the <literal>PROGRAM</literal>
option will result in an error, regardless of the user's
privileges.
</para>
</listitem>
</varlistentry>

<varlistentry id="configure-option-with-lz4">
<varlistentry id="configure-option-with-lz4">
<term><option>--with-lz4</option></term>
<listitem>
<para>
Expand Down
10 changes: 10 additions & 0 deletions meson.build
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -817,6 +817,16 @@ endif



###############################################################
# Option: copy_program
###############################################################

if get_option('copy_program').enabled()
cdata.set('USE_COPY_PROGRAM', 1)
endif



###############################################################
# Library: icu
###############################################################
Expand Down
3 changes: 3 additions & 0 deletions meson_options.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -115,6 +115,9 @@ option('llvm', type: 'feature', value: 'disabled',
option('lz4', type: 'feature', value: 'auto',
description: 'LZ4 support')

option('copy_program', type: 'feature', value: 'enabled',
description: 'COPY TO/FROM PROGRAM support')

option('nls', type: 'feature', value: 'auto',
description: 'Native language support')

Expand Down
1 change: 1 addition & 0 deletions src/Makefile.global.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -204,6 +204,7 @@ with_ldap = @with_ldap@
with_libxml = @with_libxml@
with_libxslt = @with_libxslt@
with_llvm ?= @with_llvm@
with_copy_program ?= @with_copy_program@
with_system_tzdata = @with_system_tzdata@
with_uuid = @with_uuid@
with_zlib = @with_zlib@
Expand Down
8 changes: 8 additions & 0 deletions src/backend/commands/copy.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,7 @@ DoCopy(ParseState *pstate, const CopyStmt *stmt,
{
if (stmt->is_program)
{
#ifdef USE_COPY_PROGRAM
if (!has_privs_of_role(GetUserId(), ROLE_PG_EXECUTE_SERVER_PROGRAM))
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
Expand All @@ -154,6 +155,13 @@ DoCopy(ParseState *pstate, const CopyStmt *stmt,
"pg_execute_server_program"),
errhint("Anyone can COPY to stdout or from stdin. "
"psql's \\copy command also works for anyone.")));
#else
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
errmsg("permission denied to COPY to or from an external program"),
errhint("Anyone can COPY to stdout or from stdin. "
"psql's \\copy command also works for anyone.")));
#endif
}
else
{
Expand Down
3 changes: 3 additions & 0 deletions src/include/pg_config.h.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -880,6 +880,9 @@
(--enable-link-postgres-with-shared) */
#undef USE_LINK_POSTGRES_WITH_SHARED

/* Define to 1 to build with COPY TO/FROM PROGRAM support. (--with-copy-program) */
#undef USE_COPY_PROGRAM

/* Define to 1 to build with LLVM based JIT support. (--with-llvm) */
#undef USE_LLVM

Expand Down
3 changes: 3 additions & 0 deletions src/include/pg_config.h.win32
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -762,6 +762,9 @@
/* Define to 1 to build with LDAP support. (--with-ldap) */
/* #undef USE_LDAP */

/* Define to 1 to build with COPY TO/FROM PROGRAM support. (--with-copy-program) */
#define USE_COPY_PROGRAM 1

/* Define to 1 to build with LLVM based JIT support. (--with-llvm) */
/* #undef USE_LLVM */

Expand Down
1 change: 1 addition & 0 deletions src/tools/msvc/Solution.pm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -435,6 +435,7 @@ sub GenerateFiles
USE_LZ4 => undef,
USE_LDAP => $self->{options}->{ldap} ? 1 : undef,
USE_LLVM => undef,
USE_COPY_PROGRAM => 1,
USE_NAMED_POSIX_SEMAPHORES => undef,
USE_OPENSSL => undef,
USE_PAM => undef,
Expand Down
Loading