Ensure excessive function privileges are revoked

SrednjaNivo 1Ručni pregledyugabytedb

Opis

In certain situations, to provide the required functionality, YugabyteDB needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided ... Assessed manually here: the benchmark check is environment-specific and cannot be evaluated reliably by a single command.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Run SELECT nspname, proname, prosecdef, rolname, proconfig FROM pg_proc p JOIN pg_namespace n ON p.pronamespace = n.oid JOIN pg_authid a ON a.oid = p.proowner WHERE prosecdef OR NOT proconfig IS NULL; Every SECURITY DEFINER function (prosecdef = t) must be justified, owned by an appropriate role and have a fixed search_path; unjustified ones are a finding.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Where possible, revoke SECURITY DEFINER on YugabyteDB functions. To change a SECURITY DEFINER function to SECURITY INVOKER, run the following YSQL: # whoami root # sudo su - yugabyte # ysqlsh -c "ALTER FUNCTION [functionname] SECURITY INVOKER;" If it is not possible to revoke SECURITY DEFINER, ensure the function can be executed by only the accounts that absolutely need such functionality: yugabyte=# SELECT proname, proacl FROM pg_proc WHERE ...

Svojstva

Operativni sistemi: Bilo koji
Oznake: yugabytedbprivileges
Referenca: CIS YugabyteDB Benchmark v2.0.0 - 4.3 Ensure excessive function privileges are revoked