[check_postgres] NO_PSQL_OPTION useless ?
Jehan-Guillaume (ioguix) de Rorthais
jgdr at dalibo.com
Wed Dec 29 08:48:26 UTC 2010
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Le 28/12/2010 21:12, Greg Sabino Mullane a écrit :
> On Tue, Dec 28, 2010 at 06:49:43PM +0100, Jehan-Guillaume (ioguix) de Rorthais wrote:
> ...
>> What is the point of the NO_PSQL_OPTION variable exactly ?
>
> To prevent system calls to arbitrary programs.
Ok. I didn't thought about arbitrary programs. check_postgres checks the psql
version, so I guess it can check if the program is actually psql or not. But
even then, the malicious program can cheat I guess...
>> There is many other way to cheat check_postgres.pl about the psql version to
>> use. Using "PGBINDIR=/whatever/pgsql/bin /tmp/check_postgres.pl --blah" is one
>> amongst some others...
>>
>> In my opnion this issue is not in the check_postgres scope. A simple user should
>> be restricted from the system itself first.
>
> The cheating is prevented by setting $PSQL inside the script. That plus
> NO_PSQL_OPTION prevents it from being changed, even with PGBINDIR.
Ok, there's my point. Nobody should be able to edit this script on a system
secured enough. Or maybe in their $HOME and then, they shouldn't have enough
rights to break anything anyway.
Again, in my opinion this is related to system security.
>> It's much easier to maintain one version of check_postgres in all monitored
>> servers than having corner case here and there. And as we always have corner
>> case anyway, we should be able to use the configuration file :)
>
> Sure, it's a corner case. Overall, though, I don't think it's anything to
> worry about - it does no harm that I can see. If you feel strongly though,
> feel free to continue the conversation. :)
well, sure, it does no harm as far as we can use a workaround like changing PATH
or PGBINDIR...
- --
Jehan-Guillaume de Rorthais
DBA
http://www.dalibo.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk0a9dEACgkQXu9L1HbaT6LWOwCgkAjbfbegTXhTz7OjYOSqVqQd
tcgAoPE+ObFKbHaEnWePDNPiQuEpJ9PX
=QGkN
-----END PGP SIGNATURE-----
More information about the Check_postgres
mailing list