[check_postgres] NO_PSQL_OPTION useless ?

[Jehan-Guillaume (ioguix) de Rorthais]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Le 28/12/2010 21:12, Greg Sabino Mullane a écrit :
> On Tue, Dec 28, 2010 at 06:49:43PM +0100, Jehan-Guillaume (ioguix) de Rorthais wrote:
> ...
>> What is the point of the NO_PSQL_OPTION variable exactly ?
> 
> To prevent system calls to arbitrary programs.

Ok. I didn't thought about arbitrary programs. check_postgres checks the psql
version, so I guess it can check if the program is actually psql or not. But
even then, the malicious program can cheat I guess...

>> There is many other way to cheat check_postgres.pl about the psql version to
>> use. Using "PGBINDIR=/whatever/pgsql/bin /tmp/check_postgres.pl --blah" is one
>> amongst some others...
>>
>> In my opnion this issue is not in the check_postgres scope. A simple user should
>> be restricted from the system itself first.
> 
> The cheating is prevented by setting $PSQL inside the script. That plus 
> NO_PSQL_OPTION prevents it from being changed, even with PGBINDIR.

Ok, there's my point. Nobody should be able to edit this script on a system
secured enough. Or maybe in their $HOME and then, they shouldn't have enough
rights to break anything anyway.
Again, in my opinion this is related to system security.

>> It's much easier to maintain one version of check_postgres in all monitored
>> servers than having corner case here and there. And as we always have corner
>> case anyway, we should be able to use the configuration file :)
> 
> Sure, it's a corner case. Overall, though, I don't think it's anything to 
> worry about - it does no harm that I can see. If you feel strongly though, 
> feel free to continue the conversation. :)

well, sure, it does no harm as far as we can use a workaround like changing PATH
or PGBINDIR...

- -- 
Jehan-Guillaume de Rorthais
DBA
http://www.dalibo.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAk0a9dEACgkQXu9L1HbaT6LWOwCgkAjbfbegTXhTz7OjYOSqVqQd
tcgAoPE+ObFKbHaEnWePDNPiQuEpJ9PX
=QGkN
-----END PGP SIGNATURE-----