Re: [HACKERS] reuse sysids security hole?

2003-08-14 Thread Alvaro Herrera Munoz
On Tue, Aug 12, 2003 at 04:01:33PM -0400, Tom Lane wrote: Bruce Momjian [EMAIL PROTECTED] writes: Can I have a TODO for this? * Prevent accidental re-use of sysids for dropped users and groups The other part of the thread was something like * Prevent dropping user that still owns

[HACKERS] reuse sysids security hole?

2003-08-14 Thread Andrew Dunstan
(Thought triggered by something Tom said the other day) Is this a security hole? Looks like one to me. Would it be better to use a sequence generator for sysids instead of using max+1 on the user table? Or else store the last sysid used somewhere? andrew facetest=# create user blurfl; CREATE

Re: [HACKERS] reuse sysids security hole?

2003-08-14 Thread Tom Lane
Bruce Momjian [EMAIL PROTECTED] writes: Can I have a TODO for this? * Prevent accidental re-use of sysids for dropped users and groups The other part of the thread was something like * Prevent dropping user that still owns objects, or auto-drop the objects which if successful would eliminate

Re: [HACKERS] reuse sysids security hole?

2003-08-14 Thread Bruce Momjian
Can I have a TODO for this? --- Tom Lane wrote: Gavin Sherry [EMAIL PROTECTED] writes: On Tue, 12 Aug 2003, Andrew Dunstan wrote: Is this a security hole? Looks like one to me. Would it be better to use a sequence

Re: [HACKERS] reuse sysids security hole?

2003-08-14 Thread Andreas Pflug
Andrew Dunstan wrote: Regarding second item, I don't think anyone suggested autodropping objects, or else I misunderstood. (That would be dangerous, to say the least, IMHO). I agree, but some applications might use tables dedicated to a specific user. While this is IMHO not a good style to

Re: [HACKERS] reuse sysids security hole?

2003-08-14 Thread Tom Lane
Gavin Sherry [EMAIL PROTECTED] writes: On Tue, 12 Aug 2003, Andrew Dunstan wrote: Is this a security hole? Looks like one to me. Would it be better to use a sequence generator for sysids instead of using max+1 on the user table? Or else store the last sysid used somewhere? This issue has

Re: [HACKERS] reuse sysids security hole?

2003-08-14 Thread Bruce Momjian
Thanks. Added. --- Tom Lane wrote: Bruce Momjian [EMAIL PROTECTED] writes: Can I have a TODO for this? * Prevent accidental re-use of sysids for dropped users and groups The other part of the thread was something

Re: [HACKERS] reuse sysids security hole?

2003-08-14 Thread Tom Lane
Alvaro Herrera Munoz [EMAIL PROTECTED] writes: What about the use of a shared sequence object to generate sysids? I didn't think it needed its own mention in the TODO item, but if you want to... regards, tom lane ---(end of

Re: [HACKERS] reuse sysids security hole?

2003-08-14 Thread Gavin Sherry
On Tue, 12 Aug 2003, Andrew Dunstan wrote: (Thought triggered by something Tom said the other day) Is this a security hole? Looks like one to me. Would it be better to use a sequence generator for sysids instead of using max+1 on the user table? Or else store the last sysid used

Re: [HACKERS] reuse sysids security hole?

2003-08-12 Thread Andrew Dunstan
I like the sequence generator idea too. I know Unix is bad in this area - but that's no reason for us to be bad too. This is actually one of the (few) areas where Windows is better than Unix. Let's go for best practice. (new todo item Prevent automatic reuse of sysids ?) andrew Tom Lane