From 5883be37ad69f31e1b6ca78cb12900a8a313fa24 Mon Sep 17 00:00:00 2001 From: jcoleman Date: Wed, 2 Feb 2022 20:49:11 +0000 Subject: [PATCH 1/3] Support creation of non-superusers in tests --- t/CP_Testing.pm | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/t/CP_Testing.pm b/t/CP_Testing.pm index e15a4f7f..4260349a 100644 --- a/t/CP_Testing.pm +++ b/t/CP_Testing.pm @@ -25,6 +25,7 @@ sub new { started => time(), dbdir => $arg->{dbdir} || 'test_database_check_postgres', testuser => $arg->{testuser} || 'check_postgres_testing', + testuser_is_nosuper => $arg->{testuser_is_nosuper}, testuser2 => $arg->{testuser2} || 'powerless_pete', }; if (exists $arg->{default_action}) { @@ -285,7 +286,11 @@ sub _test_database_handle { if ($res !~ /$newuser/) { $COM = qq{psql -d template1 -q -h "$host" -c "CREATE USER $newuser"}; system $COM; - $SQL = qq{UPDATE pg_shadow SET usesuper='t' WHERE usename = '$newuser'}; + if ($self->{testuser_is_nosuper}) { + $SQL = qq{UPDATE pg_shadow SET usesuper='f' WHERE usename = '$newuser'}; + } else { + $SQL = qq{UPDATE pg_shadow SET usesuper='t' WHERE usename = '$newuser'}; + } $COM = qq{psql -d postgres -q -h "$host" -c "$SQL"}; system $COM; } @@ -347,7 +352,11 @@ sub _test_database_handle { delete $ENV{PGUSER}; @tempdsn = ($dsn, '', '', {AutoCommit=>1,RaiseError=>1,PrintError=>0}); $tempdbh = DBI->connect(@tempdsn); - $tempdbh->do("CREATE USER $dbuser SUPERUSER"); + if ($self->{testuser_is_nosuper}) { + $tempdbh->do("CREATE USER $dbuser"); + } else { + $tempdbh->do("CREATE USER $dbuser SUPERUSER"); + } $tempdbh->disconnect(); $dbh = DBI->connect(@superdsn); } @@ -376,7 +385,11 @@ sub _test_database_handle { $sth->execute($dbuser); $count = $sth->fetchall_arrayref()->[0][0]; if (!$count) { - $dbh->do("CREATE USER $dbuser SUPERUSER"); + if ($self->{testuser_is_nosuper}) { + $dbh->do("CREATE USER $dbuser"); + } else { + $dbh->do("CREATE USER $dbuser SUPERUSER"); + } } my $user2 = $self->{testuser2}; $sth->execute($user2); From 6b029f73ae58e7e39b4d827be0517bc19e22459b Mon Sep 17 00:00:00 2001 From: jcoleman Date: Wed, 2 Feb 2022 20:50:05 +0000 Subject: [PATCH 2/3] Fix broken insufficient privileges detection This hasn't worked for quite some time because `pg_stat_activity` columns `state_change` and `backend_type` are `null` when the user isn't a superuser. --- check_postgres.pl | 4 ++-- t/02_query_time.t | 29 ++++++++++++++++++++++++++++- 2 files changed, 30 insertions(+), 3 deletions(-) diff --git a/check_postgres.pl b/check_postgres.pl index 37d334ad..69aaa460 100755 --- a/check_postgres.pl +++ b/check_postgres.pl @@ -6931,7 +6931,7 @@ sub check_query_time { msg('queries'), msg('query-time'), 'query_start', - q{query_start IS NOT NULL AND current_query NOT LIKE '%'}); + q{current_query NOT LIKE '%'}); return; @@ -8703,7 +8703,7 @@ sub check_txn_idle { $SQL3 =~ s/query_start/state_change/g; ## For Pg 10 and above, consider only client backends - ($SQL4 = $SQL3) =~ s/ WHERE / WHERE backend_type = 'client backend' AND /; + ($SQL4 = $SQL3) =~ s/ WHERE / WHERE (backend_type = 'client backend' OR backend_type IS NULL) AND /; my $info = run_command($SQL, { emptyok => 1 , version => [ "<8.3 $SQL2", ">9.6 $SQL4", ">9.1 $SQL3" ] } ); diff --git a/t/02_query_time.t b/t/02_query_time.t index cff23c7c..44b467f9 100644 --- a/t/02_query_time.t +++ b/t/02_query_time.t @@ -6,7 +6,7 @@ use 5.008; use strict; use warnings; use Data::Dumper; -use Test::More tests => 13; +use Test::More tests => 14; use lib 't','.'; use CP_Testing; @@ -75,4 +75,31 @@ like ($cp->run(q{-w 1 -vv}), qr{$label WARNING:}, $t); $dbh->rollback(); $dbh->disconnect(); +waitpid $child, 0; + +## Tests for non-superuser + +my $cp_nosuper = CP_Testing->new( {default_action => 'query_time', testuser => 'non_superuser', testuser_is_nosuper => 1 } ); + +# Test that a non-superuser shows the unknown data alert. +$child = fork(); +if (0 == $child) { + my $kiddbh = $cp->test_database_handle(); + $cp->database_sleep($kiddbh, 3); + $kiddbh->rollback(); + $kiddbh->disconnect(); + exit; +} + +my $dbh_nosuper = $cp_nosuper->test_database_handle(); +sleep 1; +$t = qq{$S detects non-superuser access}; +like ($cp_nosuper->run(q{-w 1 -vv}), qr{$label UNKNOWN.+superuser}, $t); +$dbh_nosuper->rollback(); +$dbh_nosuper->disconnect(); + +$dbh->disconnect(); + +waitpid $child, 0; + exit; From 7fe3c1e10aa70aefcaf92f093e8fa899d5a5e914 Mon Sep 17 00:00:00 2001 From: James Coleman Date: Wed, 26 Jan 2022 15:38:30 -0500 Subject: [PATCH 3/3] Fix false positive non-superuser errors Regex matching solely against the word "insufficient" means that it's trivial to cause this to alert unnecessarily by merely including the string "insufficient" in one's real query. Instead verify that we don't actually have a real query and know for certain this is an error condition. --- check_postgres.pl | 2 +- t/02_query_time.t | 24 +++++++++++++++++++++++- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/check_postgres.pl b/check_postgres.pl index 69aaa460..bbb9531f 100755 --- a/check_postgres.pl +++ b/check_postgres.pl @@ -8737,7 +8737,7 @@ sub check_txn_idle { my $st = defined($r->{state}) ? $r->{state} : ''; ## Return unknown if we cannot see because we are a non-superuser - if ($cq =~ /insufficient/) { + if ($cq eq '') { add_unknown msg('psa-nosuper'); return; } diff --git a/t/02_query_time.t b/t/02_query_time.t index 44b467f9..6c435070 100644 --- a/t/02_query_time.t +++ b/t/02_query_time.t @@ -6,7 +6,7 @@ use 5.008; use strict; use warnings; use Data::Dumper; -use Test::More tests => 14; +use Test::More tests => 15; use lib 't','.'; use CP_Testing; @@ -102,4 +102,26 @@ $dbh->disconnect(); waitpid $child, 0; +# Test that a query using the word insufficient doesn't trigger the unknown data alert. + +$child = fork(); +if (0 == $child) { + my $kiddbh = $cp->test_database_handle(); + $kiddbh->do(qq{SELECT pg_sleep(3) AS insufficient}); + $kiddbh->rollback(); + $kiddbh->disconnect(); + exit; +} + +my $dbh = $cp->test_database_handle(); +sleep 1; +$t = qq{$S non-superuser access isn't fooled by the word insufficient}; +like ($cp->run(q{-w 1 -vv}), qr{$label WARNING}, $t); +$dbh->rollback(); +$dbh->disconnect(); + +$dbh->disconnect(); + +waitpid $child, 0; + exit;