TMA-POSTGRES-4.5

Ensure excessive function privileges are revoked

MittelStufe 1Automatisiertpostgres

Beschreibung

In certain situations, to provide the required functionality, PostgreSQL needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. Counts SECURITY DEFINER functions outside pg_catalog/information_schema that are not owned by an extension, in the database it connects to (set PGDATABASE to check each database); accept justified functions as exceptions. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

So wird geprüft

Prüfmethode: SQL-Abfrage

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT count(*) FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace WHERE p.prosecdef AND n.nspname NOT IN ('pg_catalog','information_schema') AND p.proname NOT LIKE 'pgaudit%' AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.classid = 'pg_proc'::regclass AND d.objid = p.oid AND d.deptype = 'e')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Erwartete Ausgabe: 0

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Review each SECURITY DEFINER function; switch it with ALTER FUNCTION <name>(<args>) SECURITY INVOKER; or, if elevation is required, REVOKE EXECUTE ON FUNCTION <name>(<args>) FROM PUBLIC/<roles> so only the accounts that need it can run it.

Eigenschaften

Betriebssysteme: Beliebig
Tags: postgresdatabaseauthorization
Referenz: CIS PostgreSQL 18 Benchmark v1.0.0 - 4.5 Ensure excessive function privileges are revoked

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target postgres