#499 Security hardening: Docker Compose and Homebrew connect the app to PostgreSQL as a superuser

[Anonymous]

Originally created by: athanclark

Docker Compose (and Homebrew): the web application connects to PostgreSQL as a superuser

• Severity: Low. This is defense in depth. It needs a separate application bug, such as SQL injection, but it turns that bug into full control of the database and command execution.
• Affected: Docker Compose (compose.yml); Homebrew (deploy/homebrew).
• Location:
• compose.yml:10-15, where PGUSER: openchronology is shared by migrate, app and mail-worker.
• compose.yml:24-26, where POSTGRES_USER: openchronology makes this the superuser in the official postgres image.
• server/schema.sql:30 (CREATE EXTENSION IF NOT EXISTS pgmp), which is why the migrating role must be superuser.
• deploy/homebrew/openchronology-setup:37, where DATABASE_URL=postgresql://$user@/openchronology?host=/tmp uses the Homebrew user, the cluster's superuser.
• Description: The Debian, RPM, Arch, FreeBSD, Windows and NixOS deployments split roles. The superuser (postgres) creates pgmp once, and the server runs as a non-superuser owner role (postinst:114-121, module.nix:253-256). Compose instead uses one role for everything, and that role is the container's bootstrap superuser. Homebrew does the same with the user's own superuser account. Homebrew's own initdb also uses trust authentication for local and 127.0.0.1 connections; that is Homebrew's default, not this project's. On a multi-user Mac, any local user can therefore connect as that superuser.
• Attack scenario:
• Precondition: any SQL-injection or query-construction bug in the server, or a stolen DATABASE_URL.
• Steps: COPY ... TO PROGRAM or pg_read_server_files, then a shell as postgres in the database container. From there, ALTER SYSTEM and reading or changing every database.
• Impact: database takeover and code execution in the db container. On Homebrew, code execution as the macOS user, and access to every other database in that user's cluster.
• Evidence: the lines above. The official postgres image documents that POSTGRES_USER is created with superuser power.
• What defends against it today: the database container publishes no ports (compose.yml:18-33). The app container runs as node.
• Suggested fix: In Compose, keep POSTGRES_USER as the bootstrap superuser, which migrate uses to CREATE EXTENSION pgmp. Add an init script in /docker-entrypoint-initdb.d that creates a separate non-superuser openchronology_app role owning the database, and give the app and mail-worker services that role's credentials. For Homebrew, create a dedicated non-superuser role in openchronology-setup and use it in DATABASE_URL.
• Confidence: confirmed for Compose. Homebrew is confirmed for the role; the trust-auth part depends on Homebrew's initdb defaults.

---

From the security review of 2026-11-06 (commit 6776c44), finding L-13: hardening or information, filed publicly because it describes no way in. The exploitable findings are private security advisories.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed