Detections
Analytics
4.5 Ensure excessive function privileges are revoked
Information
In certain situations, to provide the required functionality, PostgreSQL needs to execute internal logic (stored procedures, functions, triggers, etc.) and/or external code modules with elevated privileges. However, if the privileges required for execution are at a higher level than the privileges assigned to organizational users invoking the functionality applications/programs, those users are indirectly provided with greater privileges than assigned by their organization. This is known as privilege elevation. Privilege elevation must be utilized only where necessary. Execute privileges for application functions should be restricted to authorized users only.Rationale:
Ideally, all application source code should be vetted to validate interactions between the application and the logic in the database, but this is usually not possible or feasible with available resources even if the source code is available. The DBA should attempt to obtain assurances from the development organization that this issue has been addressed and should document what has been discovered. The DBA should also inspect all application logic stored in the database (in the form of functions, rules, and triggers) for excessive privileges.
Solution
Where possible, revoke SECURITY DEFINER on PostgreSQL functions. To change a SECURITY DEFINER function to SECURITY INVOKER, run the following SQL:# whoami
root
# sudo -iu postgres
# psql -c 'ALTER FUNCTION [functionname] SECURITY INVOKER;'
If it is not possible to revoke SECURITY DEFINER, ensure the function can be executed by only the accounts that absolutely need such functionality:
postgres=# SELECT proname, proacl FROM pg_proc WHERE proname = 'delete_customer';
proname | proacl
-----------------+--------------------------------------------------------
delete_customer | {=X/postgres,postgres=X/postgres,appreader=X/postgres}
(1 row)
postgres=# REVOKE EXECUTE ON FUNCTION delete_customer(integer,boolean) FROM appreader;
REVOKE
postgres=# SELECT proname, proacl FROM pg_proc WHERE proname = 'delete_customer';
proname | proacl
-----------------+--------------------------------------------------------
delete_customer | {=X/postgres,postgres=X/postgres}
(1 row)
Based on the output above, appreader=X/postgres no longer exists in the proacl column results returned from the query and confirms appreader is no longer granted execute privilege on the function.
See Also
Item Details
Audit Name: CIS PostgreSQL 14 DB v 1.2.0
Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION
References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|5.1
Plugin: PostgreSQLDB
Control ID: bea50f75a79a8e7975ece6662cc289e6be35b9f6c2cd8d12520eb339544bbe58