Detections
Analytics
4.3 Ensure excessive function privileges are revoked
Information
In certain situations, to provide required functionality, PostgreSQL needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by their organization. This is known as privilege elevation. Privilege elevation must be utilized only where necessary. Execute privileges for application functions should be restricted to authorized users only.Rationale:
Ideally, all application source code should be vetted to validate interactions between the application and the logic in the database, but this is usually not possible or feasible with available resources even if the source code is available. The DBA should attempt to obtain assurances from the development organization that this issue has been addressed and should document what has been discovered. The DBA should also inspect all application logic stored in the database (in the form of functions, rules, and triggers) for excessive privileges.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
Where possible, revoke SECURITY DEFINER on PostgreSQL functions. To change a SECURITY DEFINER function to SECURITY INVOKER, run the following SQL:$ whoami
root
$ sudo su - postgres
$ psql -c "ALTER FUNCTION [functionname] SECURITY INVOKER;"
If it is not possible to revoke SECURITY DEFINER, ensure the function can be executed by only the accounts that absolutely need such functionality:
REVOKE EXECUTE ON FUNCTION delete_customer(integer,boolean) FROM appreader;
REVOKE
Confirm that the appreader user may no longer execute the function:
SELECT proname, proacl FROM pg_proc WHERE proname = 'delete_customer';
proname | proacl
-----------------+--------------------------------------------------------
delete_customer | {=X/postgres,postgres=X/postgres,appwriter=X/postgres}
(1 row)
Based on output above, appreader=X/postgres no longer exists in the proacl column results returned from query and confirms appreader is no longer granted execute privilege on the function.
See Also
Item Details
Audit Name: CIS PostgreSQL 11 OS v1.0.0
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, CSCv6|5.1, CSCv7|5.1
Plugin: Unix
Control ID: f2e3614a355191d3db5fe9f313d1bbb3df7bfe1163c4f1dde4f8f50275f359ad