Ensure excessive function privileges are revoked

СредњаНиво 1Аутоматскаpostgres

Опис

In certain situations, to provide the required functionality, PostgreSQL needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. Counts SECURITY DEFINER functions outside pg_catalog/information_schema that are not owned by an extension, in the database it connects to (set PGDATABASE to check each database); accept justified functions as exceptions. Runs psql as ${PGUSER:-postgres} against ${PGDATABASE:-postgres}; set PGHOST/PGPORT and use ~/.pgpass (not PGPASSWORD, see 1.6/1.7) when peer authentication is not available.

Како се проверава

Метод провере: SQL упит

sql_query

out=$(psql -X -U "${PGUSER:-postgres}" -d "${PGDATABASE:-postgres}" -tAc "SELECT count(*) FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace WHERE p.prosecdef AND n.nspname NOT IN ('pg_catalog','information_schema') AND p.proname NOT LIKE 'pgaudit%' AND NOT EXISTS (SELECT 1 FROM pg_depend d WHERE d.classid = 'pg_proc'::regclass AND d.objid = p.oid AND d.deptype = 'e')" 2>/dev/null) || exit 1; printf '%s\n' "$out"

Очекивани излаз: 0

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Review each SECURITY DEFINER function; switch it with ALTER FUNCTION <name>(<args>) SECURITY INVOKER; or, if elevation is required, REVOKE EXECUTE ON FUNCTION <name>(<args>) FROM PUBLIC/<roles> so only the accounts that need it can run it.

Својства

Оперативни системи: Било који
Ознаке: postgresdatabaseauthorization
Референца: CIS PostgreSQL 18 Benchmark v1.0.0 - 4.5 Ensure excessive function privileges are revoked

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target postgres