From: Dominik Csapak <d.csapak@proxmox.com>
To: pmg-devel@lists.proxmox.com
Subject: [pmg-devel] [PATCH pmg-api v2] dbtools: grant permissions public schema for created databases
Date: Mon, 26 Jun 2023 16:10:26 +0200 [thread overview]
Message-ID: <20230626141026.1281109-1-d.csapak@proxmox.com> (raw)
since postgres 15, the public schema is not world writeable anymore for
security reasons. In our environment, where the db is not externaly
reachable and no database users should exists except the ones we create,
we can safely give the permissions again to be able to use
the root/www-data user without modification of the remaining
code/privileges for postgres.
Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
---
changes from v1:
* rename cmd to $grantcmd
* actually use it and execute it with postgres_admin_cmd/psql
src/PMG/DBTools.pm | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/src/PMG/DBTools.pm b/src/PMG/DBTools.pm
index 0b37361..a437eb6 100644
--- a/src/PMG/DBTools.pm
+++ b/src/PMG/DBTools.pm
@@ -344,6 +344,16 @@ my $createdb = sub {
'--lc-ctype=C',
$dbname,
);
+
+ # allow root and www-data to access the public SCHEMA like pre prostgres15
+ # this is not a security issue, since the db is not externally reachable anyway and no
+ # other users should exist
+ my $grantcmd = "GRANT CREATE ON SCHEMA public To \"root\";"
+ ."GRANT USAGE ON SCHEMA public To \"root\";"
+ ."GRANT CREATE ON SCHEMA public To \"www-data\";"
+ ."GRANT USAGE ON SCHEMA public To \"www-data\";";
+
+ postgres_admin_cmd('psql', { input => $grantcmd }, '-d', $dbname);
};
sub create_ruledb {
--
2.30.2
next reply other threads:[~2023-06-26 14:10 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-26 14:10 Dominik Csapak [this message]
2023-06-26 19:58 ` [pmg-devel] applied: " Thomas Lamprecht
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230626141026.1281109-1-d.csapak@proxmox.com \
--to=d.csapak@proxmox.com \
--cc=pmg-devel@lists.proxmox.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox