Skip to content

Commit 2366761

Browse files
adunstanadunstan
committed
Run pg_upgrade and pg_resetxlog with restricted token on Windows
As with initdb these programs need to run with a restricted token, and if they don't pg_upgrade will fail when run as a user with Adminstrator privileges. Backpatch to all live branches. On the development branch the code is reorganized so that the restricted token code is now in a single location. On the stable bramches a less invasive change is made by simply copying the relevant code to pg_upgrade.c and pg_resetxlog.c. Patches and bug report from Muhammad Asif Naeem, reviewed by Michael Paquier, slightly edited by me.
1 parent a6a8bf5 commit 2366761

File tree

2 files changed

+332
-0
lines changed

2 files changed

+332
-0
lines changed

‎contrib/pg_upgrade/pg_upgrade.c

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,11 @@ static void copy_clog_xlog_xid(void);
4949
static void set_frozenxids(bool minmxid_only);
5050
static void setup(char *argv0, bool *live_check);
5151
static void cleanup(void);
52+
static void get_restricted_token(const char *progname);
53+
54+
#ifdef WIN32
55+
static int CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo, const char *progname);
56+
#endif
5257

5358
ClusterInfo old_cluster,
5459
new_cluster;
@@ -65,6 +70,9 @@ char *output_files[] = {
6570
NULL
6671
};
6772

73+
#ifdef WIN32
74+
static char *restrict_env;
75+
#endif
6876

6977
int
7078
main(int argc, char **argv)
@@ -76,6 +84,8 @@ main(int argc, char **argv)
7684

7785
parseCommandLine(argc, argv);
7886

87+
get_restricted_token(os_info.progname);
88+
7989
adjust_data_dir(&old_cluster);
8090
adjust_data_dir(&new_cluster);
8191

@@ -174,6 +184,162 @@ main(int argc, char **argv)
174184
return 0;
175185
}
176186

187+
#ifdef WIN32
188+
typedef BOOL(WINAPI * __CreateRestrictedToken) (HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD, PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
189+
190+
/* Windows API define missing from some versions of MingW headers */
191+
#ifndef DISABLE_MAX_PRIVILEGE
192+
#define DISABLE_MAX_PRIVILEGE 0x1
193+
#endif
194+
195+
/*
196+
* Create a restricted token and execute the specified process with it.
197+
*
198+
* Returns 0 on failure, non-zero on success, same as CreateProcess().
199+
*
200+
* On NT4, or any other system not containing the required functions, will
201+
* NOT execute anything.
202+
*/
203+
static int
204+
CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo, const char *progname)
205+
{
206+
BOOL b;
207+
STARTUPINFO si;
208+
HANDLE origToken;
209+
HANDLE restrictedToken;
210+
SID_IDENTIFIER_AUTHORITY NtAuthority = { SECURITY_NT_AUTHORITY };
211+
SID_AND_ATTRIBUTES dropSids[2];
212+
__CreateRestrictedToken _CreateRestrictedToken = NULL;
213+
HANDLE Advapi32Handle;
214+
215+
ZeroMemory(&si, sizeof(si));
216+
si.cb = sizeof(si);
217+
218+
Advapi32Handle = LoadLibrary("ADVAPI32.DLL");
219+
if (Advapi32Handle != NULL)
220+
{
221+
_CreateRestrictedToken = (__CreateRestrictedToken)GetProcAddress(Advapi32Handle, "CreateRestrictedToken");
222+
}
223+
224+
if (_CreateRestrictedToken == NULL)
225+
{
226+
fprintf(stderr, _("%s: WARNING: cannot create restricted tokens on this platform\n"), progname);
227+
if (Advapi32Handle != NULL)
228+
FreeLibrary(Advapi32Handle);
229+
return 0;
230+
}
231+
232+
/* Open the current token to use as a base for the restricted one */
233+
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &origToken))
234+
{
235+
fprintf(stderr, _("%s: could not open process token: error code %lu\n"), progname, GetLastError());
236+
return 0;
237+
}
238+
239+
/* Allocate list of SIDs to remove */
240+
ZeroMemory(&dropSids, sizeof(dropSids));
241+
if (!AllocateAndInitializeSid(&NtAuthority, 2,
242+
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0,
243+
0, &dropSids[0].Sid) ||
244+
!AllocateAndInitializeSid(&NtAuthority, 2,
245+
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS, 0, 0, 0, 0, 0,
246+
0, &dropSids[1].Sid))
247+
{
248+
fprintf(stderr, _("%s: could not to allocate SIDs: error code %lu\n"), progname, GetLastError());
249+
return 0;
250+
}
251+
252+
b = _CreateRestrictedToken(origToken,
253+
DISABLE_MAX_PRIVILEGE,
254+
sizeof(dropSids) / sizeof(dropSids[0]),
255+
dropSids,
256+
0, NULL,
257+
0, NULL,
258+
&restrictedToken);
259+
260+
FreeSid(dropSids[1].Sid);
261+
FreeSid(dropSids[0].Sid);
262+
CloseHandle(origToken);
263+
FreeLibrary(Advapi32Handle);
264+
265+
if (!b)
266+
{
267+
fprintf(stderr, _("%s: could not create restricted token: error code %lu\n"), progname, GetLastError());
268+
return 0;
269+
}
270+
271+
#ifndef __CYGWIN__
272+
AddUserToTokenDacl(restrictedToken);
273+
#endif
274+
275+
if (!CreateProcessAsUser(restrictedToken,
276+
NULL,
277+
cmd,
278+
NULL,
279+
NULL,
280+
TRUE,
281+
CREATE_SUSPENDED,
282+
NULL,
283+
NULL,
284+
&si,
285+
processInfo))
286+
287+
{
288+
fprintf(stderr, _("%s: could not start process for command \"%s\": error code %lu\n"), progname, cmd, GetLastError());
289+
return 0;
290+
}
291+
292+
return ResumeThread(processInfo->hThread);
293+
}
294+
#endif
295+
296+
void
297+
get_restricted_token(const char *progname)
298+
{
299+
#ifdef WIN32
300+
301+
/*
302+
* Before we execute another program, make sure that we are running with a
303+
* restricted token. If not, re-execute ourselves with one.
304+
*/
305+
306+
if ((restrict_env = getenv("PG_RESTRICT_EXEC")) == NULL
307+
|| strcmp(restrict_env, "1") != 0)
308+
{
309+
PROCESS_INFORMATION pi;
310+
char *cmdline;
311+
312+
ZeroMemory(&pi, sizeof(pi));
313+
314+
cmdline = pg_strdup(GetCommandLine());
315+
316+
putenv("PG_RESTRICT_EXEC=1");
317+
318+
if (!CreateRestrictedProcess(cmdline, &pi, progname))
319+
{
320+
fprintf(stderr, _("%s: could not re-execute with restricted token: error code %lu\n"), progname, GetLastError());
321+
}
322+
else
323+
{
324+
/*
325+
* Successfully re-execed. Now wait for child process to capture
326+
* exitcode.
327+
*/
328+
DWORD x;
329+
330+
CloseHandle(pi.hThread);
331+
WaitForSingleObject(pi.hProcess, INFINITE);
332+
333+
if (!GetExitCodeProcess(pi.hProcess, &x))
334+
{
335+
fprintf(stderr, _("%s: could not get exit code from subprocess: error code %lu\n"), progname, GetLastError());
336+
exit(1);
337+
}
338+
exit(x);
339+
}
340+
}
341+
#endif
342+
}
177343

178344
static void
179345
setup(char *argv0, bool *live_check)

‎src/bin/pg_resetxlog/pg_resetxlog.c

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,10 @@ static MultiXactOffset set_mxoff = (MultiXactOffset) -1;
6868
static uint32 minXlogTli = 0;
6969
static XLogSegNo minXlogSegNo = 0;
7070

71+
#ifdef WIN32
72+
static char *restrict_env;
73+
#endif
74+
7175
static bool ReadControlFile(void);
7276
static void GuessControlValues(void);
7377
static void PrintControlValues(bool guessed);
@@ -78,6 +82,11 @@ static void KillExistingXLOG(void);
7882
static void KillExistingArchiveStatus(void);
7983
static void WriteEmptyXLOG(void);
8084
static void usage(void);
85+
static void get_restricted_token(const char *progname);
86+
87+
#ifdef WIN32
88+
static int CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo, const char *progname);
89+
#endif
8190

8291

8392
int
@@ -257,6 +266,7 @@ main(int argc, char *argv[])
257266
}
258267
#endif
259268

269+
get_restricted_token(progname);
260270
DataDir = argv[optind];
261271

262272
if (chdir(DataDir) < 0)
@@ -1072,6 +1082,162 @@ WriteEmptyXLOG(void)
10721082
close(fd);
10731083
}
10741084

1085+
#ifdef WIN32
1086+
typedef BOOL(WINAPI * __CreateRestrictedToken) (HANDLE, DWORD, DWORD, PSID_AND_ATTRIBUTES, DWORD, PLUID_AND_ATTRIBUTES, DWORD, PSID_AND_ATTRIBUTES, PHANDLE);
1087+
1088+
/* Windows API define missing from some versions of MingW headers */
1089+
#ifndef DISABLE_MAX_PRIVILEGE
1090+
#define DISABLE_MAX_PRIVILEGE 0x1
1091+
#endif
1092+
1093+
/*
1094+
* Create a restricted token and execute the specified process with it.
1095+
*
1096+
* Returns 0 on failure, non-zero on success, same as CreateProcess().
1097+
*
1098+
* On NT4, or any other system not containing the required functions, will
1099+
* NOT execute anything.
1100+
*/
1101+
static int
1102+
CreateRestrictedProcess(char *cmd, PROCESS_INFORMATION *processInfo, const char *progname)
1103+
{
1104+
BOOL b;
1105+
STARTUPINFO si;
1106+
HANDLE origToken;
1107+
HANDLE restrictedToken;
1108+
SID_IDENTIFIER_AUTHORITY NtAuthority = { SECURITY_NT_AUTHORITY };
1109+
SID_AND_ATTRIBUTES dropSids[2];
1110+
__CreateRestrictedToken _CreateRestrictedToken = NULL;
1111+
HANDLE Advapi32Handle;
1112+
1113+
ZeroMemory(&si, sizeof(si));
1114+
si.cb = sizeof(si);
1115+
1116+
Advapi32Handle = LoadLibrary("ADVAPI32.DLL");
1117+
if (Advapi32Handle != NULL)
1118+
{
1119+
_CreateRestrictedToken = (__CreateRestrictedToken)GetProcAddress(Advapi32Handle, "CreateRestrictedToken");
1120+
}
1121+
1122+
if (_CreateRestrictedToken == NULL)
1123+
{
1124+
fprintf(stderr, _("%s: WARNING: cannot create restricted tokens on this platform\n"), progname);
1125+
if (Advapi32Handle != NULL)
1126+
FreeLibrary(Advapi32Handle);
1127+
return 0;
1128+
}
1129+
1130+
/* Open the current token to use as a base for the restricted one */
1131+
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &origToken))
1132+
{
1133+
fprintf(stderr, _("%s: could not open process token: error code %lu\n"), progname, GetLastError());
1134+
return 0;
1135+
}
1136+
1137+
/* Allocate list of SIDs to remove */
1138+
ZeroMemory(&dropSids, sizeof(dropSids));
1139+
if (!AllocateAndInitializeSid(&NtAuthority, 2,
1140+
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0,
1141+
0, &dropSids[0].Sid) ||
1142+
!AllocateAndInitializeSid(&NtAuthority, 2,
1143+
SECURITY_BUILTIN_DOMAIN_RID, DOMAIN_ALIAS_RID_POWER_USERS, 0, 0, 0, 0, 0,
1144+
0, &dropSids[1].Sid))
1145+
{
1146+
fprintf(stderr, _("%s: could not to allocate SIDs: error code %lu\n"), progname, GetLastError());
1147+
return 0;
1148+
}
1149+
1150+
b = _CreateRestrictedToken(origToken,
1151+
DISABLE_MAX_PRIVILEGE,
1152+
sizeof(dropSids) / sizeof(dropSids[0]),
1153+
dropSids,
1154+
0, NULL,
1155+
0, NULL,
1156+
&restrictedToken);
1157+
1158+
FreeSid(dropSids[1].Sid);
1159+
FreeSid(dropSids[0].Sid);
1160+
CloseHandle(origToken);
1161+
FreeLibrary(Advapi32Handle);
1162+
1163+
if (!b)
1164+
{
1165+
fprintf(stderr, _("%s: could not create restricted token: error code %lu\n"), progname, GetLastError());
1166+
return 0;
1167+
}
1168+
1169+
#ifndef __CYGWIN__
1170+
AddUserToTokenDacl(restrictedToken);
1171+
#endif
1172+
1173+
if (!CreateProcessAsUser(restrictedToken,
1174+
NULL,
1175+
cmd,
1176+
NULL,
1177+
NULL,
1178+
TRUE,
1179+
CREATE_SUSPENDED,
1180+
NULL,
1181+
NULL,
1182+
&si,
1183+
processInfo))
1184+
1185+
{
1186+
fprintf(stderr, _("%s: could not start process for command \"%s\": error code %lu\n"), progname, cmd, GetLastError());
1187+
return 0;
1188+
}
1189+
1190+
return ResumeThread(processInfo->hThread);
1191+
}
1192+
#endif
1193+
1194+
void
1195+
get_restricted_token(const char *progname)
1196+
{
1197+
#ifdef WIN32
1198+
1199+
/*
1200+
* Before we execute another program, make sure that we are running with a
1201+
* restricted token. If not, re-execute ourselves with one.
1202+
*/
1203+
1204+
if ((restrict_env = getenv("PG_RESTRICT_EXEC")) == NULL
1205+
|| strcmp(restrict_env, "1") != 0)
1206+
{
1207+
PROCESS_INFORMATION pi;
1208+
char *cmdline;
1209+
1210+
ZeroMemory(&pi, sizeof(pi));
1211+
1212+
cmdline = pg_strdup(GetCommandLine());
1213+
1214+
putenv("PG_RESTRICT_EXEC=1");
1215+
1216+
if (!CreateRestrictedProcess(cmdline, &pi, progname))
1217+
{
1218+
fprintf(stderr, _("%s: could not re-execute with restricted token: error code %lu\n"), progname, GetLastError());
1219+
}
1220+
else
1221+
{
1222+
/*
1223+
* Successfully re-execed. Now wait for child process to capture
1224+
* exitcode.
1225+
*/
1226+
DWORD x;
1227+
1228+
CloseHandle(pi.hThread);
1229+
WaitForSingleObject(pi.hProcess, INFINITE);
1230+
1231+
if (!GetExitCodeProcess(pi.hProcess, &x))
1232+
{
1233+
fprintf(stderr, _("%s: could not get exit code from subprocess: error code %lu\n"), progname, GetLastError());
1234+
exit(1);
1235+
}
1236+
exit(x);
1237+
}
1238+
}
1239+
#endif
1240+
}
10751241

10761242
static void
10771243
usage(void)

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy