Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

sql: prevent arbitrary writes to system.comments #6879

Closed
jseldess opened this issue Mar 19, 2020 · 1 comment
Closed

sql: prevent arbitrary writes to system.comments #6879

jseldess opened this issue Mar 19, 2020 · 1 comment
Assignees
Milestone

Comments

@jseldess
Copy link
Contributor

PR: cockroachdb/cockroach#45712

From release notes:

All users can now view any comments on any object (bypassing other privileges), but modifying comments require write privilege on the target object. Previously, any user could modify any database/table/view/index comment via direct SQL updates to system.comments. This was unintended and a form of privilege escalation, and is now prevented. The privileges required for the COMMENT statement, pg_description, col_description(), obj_description(), and shobj_description() are operating as in PostgreSQL and are unaffected by this change.[#45712][#45712] {% comment %}doc{% endcomment %}

@ericharmeling
Copy link
Contributor

We currently don't document system.comments, or really any system tables. We actually don't document privileges on any internal tables. I think we can close this issue, in favor of #6272.

Also related: #1291 and #2957

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants