mirror of
https://git.postgresql.org/git/postgresql.git
synced 2025-02-23 19:39:53 +08:00
Run pg_upgrade and pg_resetxlog with restricted token on Windows
As with initdb these programs need to run with a restricted token, and if they don't pg_upgrade will fail when run as a user with Adminstrator privileges. Backpatch to all live branches. On the development branch the code is reorganized so that the restricted token code is now in a single location. On the stable bramches a less invasive change is made by simply copying the relevant code to pg_upgrade.c and pg_resetxlog.c. Patches and bug report from Muhammad Asif Naeem, reviewed by Michael Paquier, slightly edited by me.
This commit is contained in:
Andrew Dunstan
parent
8f3c577212
commit
bf22a8e585
@ -21,7 +21,16 @@ static void copy_clog_xlog_xid(migratorContext *ctx);
|
||||
static void set_frozenxids(migratorContext *ctx);
|
||||
static void setup(migratorContext *ctx, char *argv0, bool live_check);
|
||||
static void cleanup(migratorContext *ctx);
|
||||
static void get_restricted_token(const char *progname);
|
||||
|
||||
#ifdef WIN32
|
||||
static char * pg_strdupn(const char *str);
|
||||
static int CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo, const char *progname);
|
||||
#endif
|
||||
|
||||
#ifdef WIN32
|
||||
static char *restrict_env;
|
||||
#endif
|
||||
|
||||
int
|
||||
main(int argc, char **argv)
|
||||
@ -35,6 +44,8 @@ main(int argc, char **argv)
|
||||
|
||||
parseCommandLine(&ctx, argc, argv);
|
||||
|
||||
get_restricted_token(ctx.progname);
|
||||
|
||||
output_check_banner(&ctx, &live_check);
|
||||
|
||||
setup(&ctx, argv[0], live_check);
|
||||
@ -103,6 +114,162 @@ main(int argc, char **argv)
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifdef WIN32
|
||||
typedef BOOL(WINAPI * __CreateRestrictedToken) (HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD, PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
|
||||
|
||||
/* Windows API define missing from some versions of MingW headers */
|
||||
#ifndef DISABLE_MAX_PRIVILEGE
|
||||
#define DISABLE_MAX_PRIVILEGE 0x1
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Create a restricted token and execute the specified process with it.
|
||||
*
|
||||
* Returns 0 on failure, non-zero on success, same as CreateProcess().
|
||||
*
|
||||
* On NT4, or any other system not containing the required functions, will
|
||||
* NOT execute anything.
|
||||
*/
|
||||
static int
|
||||
CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo, const char *progname)
|
||||
{
|
||||
BOOL b;
|
||||
STARTUPINFO si;
|
||||
HANDLE origToken;
|
||||
HANDLE restrictedToken;
|
||||
SID_IDENTIFIER_AUTHORITY NtAuthority = { SECURITY_NT_AUTHORITY };
|
||||
SID_AND_ATTRIBUTES dropSids[2];
|
||||
__CreateRestrictedToken _CreateRestrictedToken = NULL;
|
||||
HANDLE Advapi32Handle;
|
||||
|
||||
ZeroMemory(&si, sizeof(si));
|
||||
si.cb = sizeof(si);
|
||||
|
||||
Advapi32Handle = LoadLibrary("ADVAPI32.DLL");
|
||||
if (Advapi32Handle != NULL)
|
||||
{
|
||||
_CreateRestrictedToken = (__CreateRestrictedToken)GetProcAddress(Advapi32Handle, "CreateRestrictedToken");
|
||||
}
|
||||
|
||||
if (_CreateRestrictedToken == NULL)
|
||||
{
|
||||
fprintf(stderr, _("%s: WARNING: cannot create restricted tokens on this platform\n"), progname);
|
||||
if (Advapi32Handle != NULL)
|
||||
FreeLibrary(Advapi32Handle);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Open the current token to use as a base for the restricted one */
|
||||
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &origToken))
|
||||
{
|
||||
fprintf(stderr, _("%s: could not open process token: error code %lu\n"), progname, GetLastError());
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Allocate list of SIDs to remove */
|
||||
ZeroMemory(&dropSids, sizeof(dropSids));
|
||||
if (!AllocateAndInitializeSid(&NtAuthority, 2,
|
||||
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0,
|
||||
0, &dropSids[0].Sid) ||
|
||||
!AllocateAndInitializeSid(&NtAuthority, 2,
|
||||
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS, 0, 0, 0, 0, 0,
|
||||
0, &dropSids[1].Sid))
|
||||
{
|
||||
fprintf(stderr, _("%s: could not to allocate SIDs: error code %lu\n"), progname, GetLastError());
|
||||
return 0;
|
||||
}
|
||||
|
||||
b = _CreateRestrictedToken(origToken,
|
||||
DISABLE_MAX_PRIVILEGE,
|
||||
sizeof(dropSids) / sizeof(dropSids[0]),
|
||||
dropSids,
|
||||
0, NULL,
|
||||
0, NULL,
|
||||
&restrictedToken);
|
||||
|
||||
FreeSid(dropSids[1].Sid);
|
||||
FreeSid(dropSids[0].Sid);
|
||||
CloseHandle(origToken);
|
||||
FreeLibrary(Advapi32Handle);
|
||||
|
||||
if (!b)
|
||||
{
|
||||
fprintf(stderr, _("%s: could not create restricted token: error code %lu\n"), progname, GetLastError());
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifndef __CYGWIN__
|
||||
AddUserToTokenDacl(restrictedToken);
|
||||
#endif
|
||||
|
||||
if (!CreateProcessAsUser(restrictedToken,
|
||||
NULL,
|
||||
cmd,
|
||||
NULL,
|
||||
NULL,
|
||||
TRUE,
|
||||
CREATE_SUSPENDED,
|
||||
NULL,
|
||||
NULL,
|
||||
&si,
|
||||
processInfo))
|
||||
|
||||
{
|
||||
fprintf(stderr, _("%s: could not start process for command \"%s\": error code %lu\n"), progname, cmd, GetLastError());
|
||||
return 0;
|
||||
}
|
||||
|
||||
return ResumeThread(processInfo->hThread);
|
||||
}
|
||||
#endif
|
||||
|
||||
void
|
||||
get_restricted_token(const char *progname)
|
||||
{
|
||||
#ifdef WIN32
|
||||
|
||||
/*
|
||||
* Before we execute another program, make sure that we are running with a
|
||||
* restricted token. If not, re-execute ourselves with one.
|
||||
*/
|
||||
|
||||
if ((restrict_env = getenv("PG_RESTRICT_EXEC")) == NULL
|
||||
|| strcmp(restrict_env, "1") != 0)
|
||||
{
|
||||
PROCESS_INFORMATION pi;
|
||||
char *cmdline;
|
||||
|
||||
ZeroMemory(&pi, sizeof(pi));
|
||||
|
||||
cmdline = pg_strdupn(GetCommandLine());
|
||||
|
||||
putenv("PG_RESTRICT_EXEC=1");
|
||||
|
||||
if (!CreateRestrictedProcess(cmdline, &pi, progname))
|
||||
{
|
||||
fprintf(stderr, _("%s: could not re-execute with restricted token: error code %lu\n"), progname, GetLastError());
|
||||
}
|
||||
else
|
||||
{
|
||||
/*
|
||||
* Successfully re-execed. Now wait for child process to capture
|
||||
* exitcode.
|
||||
*/
|
||||
DWORD x;
|
||||
|
||||
CloseHandle(pi.hThread);
|
||||
WaitForSingleObject(pi.hProcess, INFINITE);
|
||||
|
||||
if (!GetExitCodeProcess(pi.hProcess, &x))
|
||||
{
|
||||
fprintf(stderr, _("%s: could not get exit code from subprocess: error code %lu\n"), progname, GetLastError());
|
||||
exit(1);
|
||||
}
|
||||
exit(x);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
static void
|
||||
setup(migratorContext *ctx, char *argv0, bool live_check)
|
||||
@ -443,3 +610,18 @@ cleanup(migratorContext *ctx)
|
||||
snprintf(filename, sizeof(filename), "%s/%s", ctx->cwd, DB_DUMP_FILE);
|
||||
unlink(filename);
|
||||
}
|
||||
|
||||
#ifdef WIN32
|
||||
static char *
|
||||
pg_strdupn(const char *str)
|
||||
{
|
||||
char *result = strdup(str);
|
||||
|
||||
if (!result)
|
||||
{
|
||||
fprintf(stderr, _("out of memory\n"));
|
||||
exit(1);
|
||||
}
|
||||
return result;
|
||||
}
|
||||
#endif
|
||||
|
||||
@ -65,6 +65,11 @@ static uint32 newXlogId,
|
||||
static bool guessed = false; /* T if we had to guess at any values */
|
||||
static const char *progname;
|
||||
|
||||
#ifdef WIN32
|
||||
static char *pg_strdup(const char *str);
|
||||
static char *restrict_env;
|
||||
#endif
|
||||
|
||||
static bool ReadControlFile(void);
|
||||
static void GuessControlValues(void);
|
||||
static void PrintControlValues(bool guessed);
|
||||
@ -74,7 +79,11 @@ static void KillExistingXLOG(void);
|
||||
static void KillExistingArchiveStatus(void);
|
||||
static void WriteEmptyXLOG(void);
|
||||
static void usage(void);
|
||||
static void get_restricted_token(const char *progname);
|
||||
|
||||
#ifdef WIN32
|
||||
static int CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo, const char *progname);
|
||||
#endif
|
||||
|
||||
int
|
||||
main(int argc, char *argv[])
|
||||
@ -256,6 +265,7 @@ main(int argc, char *argv[])
|
||||
}
|
||||
#endif
|
||||
|
||||
get_restricted_token(progname);
|
||||
DataDir = argv[optind];
|
||||
|
||||
if (chdir(DataDir) < 0)
|
||||
@ -380,6 +390,22 @@ main(int argc, char *argv[])
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifdef WIN32
|
||||
|
||||
static char *
|
||||
pg_strdup(const char *str)
|
||||
{
|
||||
char *result = strdup(str);
|
||||
|
||||
if (!result)
|
||||
{
|
||||
fprintf(stderr, _("out of memory\n"));
|
||||
exit(1);
|
||||
}
|
||||
return result;
|
||||
}
|
||||
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Try to read the existing pg_control file.
|
||||
@ -1016,6 +1042,162 @@ WriteEmptyXLOG(void)
|
||||
close(fd);
|
||||
}
|
||||
|
||||
#ifdef WIN32
|
||||
typedef BOOL(WINAPI * __CreateRestrictedToken) (HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD, PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
|
||||
|
||||
/* Windows API define missing from some versions of MingW headers */
|
||||
#ifndef DISABLE_MAX_PRIVILEGE
|
||||
#define DISABLE_MAX_PRIVILEGE 0x1
|
||||
#endif
|
||||
|
||||
/*
|
||||
* Create a restricted token and execute the specified process with it.
|
||||
*
|
||||
* Returns 0 on failure, non-zero on success, same as CreateProcess().
|
||||
*
|
||||
* On NT4, or any other system not containing the required functions, will
|
||||
* NOT execute anything.
|
||||
*/
|
||||
static int
|
||||
CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo, const char *progname)
|
||||
{
|
||||
BOOL b;
|
||||
STARTUPINFO si;
|
||||
HANDLE origToken;
|
||||
HANDLE restrictedToken;
|
||||
SID_IDENTIFIER_AUTHORITY NtAuthority = { SECURITY_NT_AUTHORITY };
|
||||
SID_AND_ATTRIBUTES dropSids[2];
|
||||
__CreateRestrictedToken _CreateRestrictedToken = NULL;
|
||||
HANDLE Advapi32Handle;
|
||||
|
||||
ZeroMemory(&si, sizeof(si));
|
||||
si.cb = sizeof(si);
|
||||
|
||||
Advapi32Handle = LoadLibrary("ADVAPI32.DLL");
|
||||
if (Advapi32Handle != NULL)
|
||||
{
|
||||
_CreateRestrictedToken = (__CreateRestrictedToken)GetProcAddress(Advapi32Handle, "CreateRestrictedToken");
|
||||
}
|
||||
|
||||
if (_CreateRestrictedToken == NULL)
|
||||
{
|
||||
fprintf(stderr, _("%s: WARNING: cannot create restricted tokens on this platform\n"), progname);
|
||||
if (Advapi32Handle != NULL)
|
||||
FreeLibrary(Advapi32Handle);
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Open the current token to use as a base for the restricted one */
|
||||
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &origToken))
|
||||
{
|
||||
fprintf(stderr, _("%s: could not open process token: error code %lu\n"), progname, GetLastError());
|
||||
return 0;
|
||||
}
|
||||
|
||||
/* Allocate list of SIDs to remove */
|
||||
ZeroMemory(&dropSids, sizeof(dropSids));
|
||||
if (!AllocateAndInitializeSid(&NtAuthority, 2,
|
||||
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0,
|
||||
0, &dropSids[0].Sid) ||
|
||||
!AllocateAndInitializeSid(&NtAuthority, 2,
|
||||
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS, 0, 0, 0, 0, 0,
|
||||
0, &dropSids[1].Sid))
|
||||
{
|
||||
fprintf(stderr, _("%s: could not to allocate SIDs: error code %lu\n"), progname, GetLastError());
|
||||
return 0;
|
||||
}
|
||||
|
||||
b = _CreateRestrictedToken(origToken,
|
||||
DISABLE_MAX_PRIVILEGE,
|
||||
sizeof(dropSids) / sizeof(dropSids[0]),
|
||||
dropSids,
|
||||
0, NULL,
|
||||
0, NULL,
|
||||
&restrictedToken);
|
||||
|
||||
FreeSid(dropSids[1].Sid);
|
||||
FreeSid(dropSids[0].Sid);
|
||||
CloseHandle(origToken);
|
||||
FreeLibrary(Advapi32Handle);
|
||||
|
||||
if (!b)
|
||||
{
|
||||
fprintf(stderr, _("%s: could not create restricted token: error code %lu\n"), progname, GetLastError());
|
||||
return 0;
|
||||
}
|
||||
|
||||
#ifndef __CYGWIN__
|
||||
AddUserToTokenDacl(restrictedToken);
|
||||
#endif
|
||||
|
||||
if (!CreateProcessAsUser(restrictedToken,
|
||||
NULL,
|
||||
cmd,
|
||||
NULL,
|
||||
NULL,
|
||||
TRUE,
|
||||
CREATE_SUSPENDED,
|
||||
NULL,
|
||||
NULL,
|
||||
&si,
|
||||
processInfo))
|
||||
|
||||
{
|
||||
fprintf(stderr, _("%s: could not start process for command \"%s\": error code %lu\n"), progname, cmd, GetLastError());
|
||||
return 0;
|
||||
}
|
||||
|
||||
return ResumeThread(processInfo->hThread);
|
||||
}
|
||||
#endif
|
||||
|
||||
void
|
||||
get_restricted_token(const char *progname)
|
||||
{
|
||||
#ifdef WIN32
|
||||
|
||||
/*
|
||||
* Before we execute another program, make sure that we are running with a
|
||||
* restricted token. If not, re-execute ourselves with one.
|
||||
*/
|
||||
|
||||
if ((restrict_env = getenv("PG_RESTRICT_EXEC")) == NULL
|
||||
|| strcmp(restrict_env, "1") != 0)
|
||||
{
|
||||
PROCESS_INFORMATION pi;
|
||||
char *cmdline;
|
||||
|
||||
ZeroMemory(&pi, sizeof(pi));
|
||||
|
||||
cmdline = pg_strdup(GetCommandLine());
|
||||
|
||||
putenv("PG_RESTRICT_EXEC=1");
|
||||
|
||||
if (!CreateRestrictedProcess(cmdline, &pi, progname))
|
||||
{
|
||||
fprintf(stderr, _("%s: could not re-execute with restricted token: error code %lu\n"), progname, GetLastError());
|
||||
}
|
||||
else
|
||||
{
|
||||
/*
|
||||
* Successfully re-execed. Now wait for child process to capture
|
||||
* exitcode.
|
||||
*/
|
||||
DWORD x;
|
||||
|
||||
CloseHandle(pi.hThread);
|
||||
WaitForSingleObject(pi.hProcess, INFINITE);
|
||||
|
||||
if (!GetExitCodeProcess(pi.hProcess, &x))
|
||||
{
|
||||
fprintf(stderr, _("%s: could not get exit code from subprocess: error code %lu\n"), progname, GetLastError());
|
||||
exit(1);
|
||||
}
|
||||
exit(x);
|
||||
}
|
||||
}
|
||||
#endif
|
||||
}
|
||||
|
||||
static void
|
||||
usage(void)
|
||||
|
||||
Loading…
Reference in New Issue
Block a user