Ensure excessive function privileges are revoked

中レベル 1手動レビューyugabytedb

説明

In certain situations, to provide the required functionality, YugabyteDB needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided ... Assessed manually here: the benchmark check is environment-specific and cannot be evaluated reliably by a single command.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Run SELECT nspname, proname, prosecdef, rolname, proconfig FROM pg_proc p JOIN pg_namespace n ON p.pronamespace = n.oid JOIN pg_authid a ON a.oid = p.proowner WHERE prosecdef OR NOT proconfig IS NULL; Every SECURITY DEFINER function (prosecdef = t) must be justified, owned by an appropriate role and have a fixed search_path; unjustified ones are a finding.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Where possible, revoke SECURITY DEFINER on YugabyteDB functions. To change a SECURITY DEFINER function to SECURITY INVOKER, run the following YSQL: # whoami root # sudo su - yugabyte # ysqlsh -c "ALTER FUNCTION [functionname] SECURITY INVOKER;" If it is not possible to revoke SECURITY DEFINER, ensure the function can be executed by only the accounts that absolutely need such functionality: yugabyte=# SELECT proname, proacl FROM pg_proc WHERE ...

プロパティ

オペレーティングシステム: すべて
タグ: yugabytedbprivileges
参照: CIS YugabyteDB Benchmark v2.0.0 - 4.3 Ensure excessive function privileges are revoked