Skip to content
Snippets Groups Projects
Commit 882c401b553c authored by Ian Baum's avatar Ian Baum
Browse files

Ensure pg_shadow_lookup is owned by the correct user

* Restoring a database via pg_dump could leave the owner set
  incorrectly, preventing pgbouncer from being able to authenticate
  users

Closes https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/8819

Changelog: fixed
parent 6dcde1dc2348
No related branches found
No related tags found
No related merge requests found
...@@ -202,6 +202,13 @@ ...@@ -202,6 +202,13 @@
list_functions(database).include?(function) list_functions(database).include?(function)
end end
def function_owner(database, function)
psql_query(
database,
"SELECT pg_catalog.pg_get_userbyid(proowner) FROM pg_proc WHERE proname='#{function}';"
)
end
def bootstrapped? def bootstrapped?
node_attribute_key = SettingsDSL::Utils.node_attribute_key(service_name) node_attribute_key = SettingsDSL::Utils.node_attribute_key(service_name)
......
...@@ -20,6 +20,8 @@ ...@@ -20,6 +20,8 @@
pgbouncer_auth_function = new_resource.helper.pg_shadow_lookup pgbouncer_auth_function = new_resource.helper.pg_shadow_lookup
auth_function_owner = %(ALTER FUNCTION pg_shadow_lookup OWNER TO "#{new_resource.account_helper.postgresql_user}")
execute 'Add pgbouncer auth function' do execute 'Add pgbouncer auth function' do
command %(/opt/gitlab/bin/#{new_resource.helper.service_cmd} -d #{new_resource.database} -c '#{pgbouncer_auth_function}') command %(/opt/gitlab/bin/#{new_resource.helper.service_cmd} -d #{new_resource.database} -c '#{pgbouncer_auth_function}')
user new_resource.account_helper.postgresql_user user new_resource.account_helper.postgresql_user
...@@ -27,4 +29,12 @@ ...@@ -27,4 +29,12 @@
not_if { new_resource.helper.is_offline_or_readonly? || new_resource.helper.has_function?(new_resource.database, "pg_shadow_lookup") } not_if { new_resource.helper.is_offline_or_readonly? || new_resource.helper.has_function?(new_resource.database, "pg_shadow_lookup") }
action :run action :run
end end
execute 'Ensure ownership of auth function' do
command %(/opt/gitlab/bin/#{new_resource.helper.service_cmd} -d #{new_resource.database} -c '#{auth_function_owner}')
user new_resource.account_helper.postgresql_user
only_if { new_resource.add_auth_function && new_resource.helper.is_running? && new_resource.helper.is_ready? }
not_if { new_resource.helper.is_offline_or_readonly? || new_resource.helper.function_owner(new_resource.database, "pg_shadow_lookup").eql?(new_resource.account_helper.postgresql_user) }
action :run
end
end end
...@@ -333,4 +333,23 @@ ...@@ -333,4 +333,23 @@
end end
end end
end end
context 'when handling database functions' do
let(:function_stdout) { double(stdout: 'function-owner') }
let(:empty_stdout) { double(stdout: '') }
describe '#function_owner' do
it 'returns the correct owner' do
allow(subject).to receive(:do_shell_out)
.with("/opt/gitlab/bin/gitlab-psql -d 'database' -c \"SELECT pg_catalog.pg_get_userbyid(proowner) FROM pg_proc WHERE proname='function';\" -tA")
.and_return(function_stdout)
expect(subject.function_owner('database', 'function')).to eq('function-owner')
end
it 'is empty if the function does not exist' do
allow(subject).to receive(:do_shell_out)
.with("/opt/gitlab/bin/gitlab-psql -d 'database' -c \"SELECT pg_catalog.pg_get_userbyid(proowner) FROM pg_proc WHERE proname='not_a_function';\" -tA")
.and_return(empty_stdout)
expect(subject.function_owner('database', 'not_a_function')).to be_empty
end
end
end
end end
require 'chef_helper'
RSpec.describe 'pgbouncer_user' do
let(:runner) { ChefSpec::SoloRunner.new(step_into: %w(pgbouncer_user)) }
context 'create' do
let(:chef_run) { runner.converge('test_pgbouncer::pgbouncer_user_create') }
it 'ensures the auth function is owned by the correct user' do
allow_any_instance_of(AccountHelper).to receive(:postgresql_user).and_return('superuser')
allow_any_instance_of(PgHelper).to receive(:is_running?).and_return(true)
allow_any_instance_of(PgHelper).to receive(:is_ready?).and_return(true)
expect(chef_run).to run_execute('Ensure ownership of auth function').with(
command: %(/opt/gitlab/bin/gitlab-psql -d database -c 'ALTER FUNCTION pg_shadow_lookup OWNER TO \"superuser\"'),
user: 'superuser'
)
end
end
end
name 'test_pgbouncer'
depends 'patroni'
depends 'pgbouncer'
depends 'gitlab'
pgbouncer_user 'example' do
database 'database'
user 'database_user'
password 'password123'
add_auth_function true
helper PgHelper.new(node)
end
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment