mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2024-12-15 08:20:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

Do not treat a superuser as a member of every role for HBA purposes.

Browse Source 
This makes it possible to use reject lines with group roles.

Andrew Dunstan, reviewd by Robert Haas.
This commit is contained in:
Andrew Dunstan 2011-11-03 12:45:02 -04:00
parent 3b06105c7d
commit 94cd0f1ad8
2 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
doc/src/sgml/client-auth.sgml
View File

@ -210,7 +210,10 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
in <productname>PostgreSQL</>; a <literal>+</> mark really means
<quote>match any of the roles that are directly or indirectly members
of this role</>, while a name without a <literal>+</> mark matches
only that specific role.)
only that specific role.) For this purpose, a superuser is only
considered to be a member of a role if they are explicitly a member
of the role, directly or indirectly, and not just by virtue of
being a superuser.
Multiple user names can be supplied by separating them with commas.
A separate file containing user names can be specified by preceding the
file name with <literal>@</>.

9
src/backend/libpq/hba.c
View File

@ -442,8 +442,13 @@ is_member(Oid userid, const char *role)
if (!OidIsValid(roleid))
return false; /* if target role not exist, say "no" */
/* See if user is directly or indirectly a member of role */
return is_member_of_role(userid, roleid);
/*
* See if user is directly or indirectly a member of role.
* For this purpose, a superuser is not considered to be automatically
* a member of the role, so group auth only applies to explicit
* membership.
*/
return is_member_of_role_nosuper(userid, roleid);
}
/*