Re: Securing "make check" (CVE-2014-0067)

Robert Haas <robertmhaas@gmail.com>

From: Robert Haas <robertmhaas@gmail.com>
To: Christoph Berg <cb@df7cb.de>, Noah Misch <noah@leadboat.com>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>, Tom Lane <tgl@sss.pgh.pa.us>, Bruce Momjian <bruce@momjian.us>
Date: 2014-03-31T18:56:59Z
Lists: pgsql-hackers
On Sun, Mar 30, 2014 at 3:52 PM, Christoph Berg <cb@df7cb.de> wrote:
> Re: Noah Misch 2014-03-30 <20140330014531.GE170273@tornado.leadboat.com>
>> On Sat, Mar 29, 2014 at 10:04:55AM +0100, Christoph Berg wrote:
>> > Fwiw, to relocate the pg_regress socket dir, there is already the
>> > possibility to run make check EXTRA_REGRESS_OPTS="--host=/tmp". (With
>> > the pending fix I sent yesterday to extend this to contrib/test_decoding.)
>>
>> That doesn't work for "make check", because the postmaster ends up with
>> "listen_addresses=/tmp".
>
> Oh, right. There's this other patch which apparently works so well
> that I already forgot it's there:
>
> Enable pg_regress --host=/path/to/socket:
> https://alioth.debian.org/scm/loggerhead/pkg-postgresql/postgresql-9.4/trunk/view/head:/debian/patches/60-pg_regress_socketdir.patch

Wasn't this patch submitted for inclusion in PostgreSQL at some point?
 Did we have some good reason for not accepting it?

-- 
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company


Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →
  1. Have config_sspi_auth() permit IPv6 localhost connections.

  2. Lock down regression testing temporary clusters on Windows.

  3. Use a separate temporary directory for the Unix-domain socket

  4. Secure Unix-domain sockets of "make check" temporary clusters.