• Noah Misch's avatar
    Secure Unix-domain sockets of "make check" temporary clusters. · 31c6e54e
    Noah Misch authored
    Any OS user able to access the socket can connect as the bootstrap
    superuser and in turn execute arbitrary code as the OS user running the
    test.  Protect against that by placing the socket in the temporary data
    directory, which has mode 0700 thanks to initdb.  Back-patch to 8.4 (all
    supported versions).  The hazard remains wherever the temporary cluster
    accepts TCP connections, notably on Windows.
    
    Attempts to run "make check" from a directory with a long name will now
    fail.  An alternative not sharing that problem was to place the socket
    in a subdirectory of /tmp, but that is only secure if /tmp is sticky.
    The PG_REGRESS_SOCK_DIR environment variable is available as a
    workaround when testing from long directory paths.
    
    As a convenient side effect, this lets testing proceed smoothly in
    builds that override DEFAULT_PGSOCKET_DIR.  Popular non-default values
    like /var/run/postgresql are often unwritable to the build user.
    
    Security: CVE-2014-0067
    31c6e54e
pg_regress.c 61 KB