mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2025-01-30 19:00:29 +08:00
Code Issues Packages Projects Releases Wiki Activity

Remove various special checks around default roles

Browse Source 
Default roles really should be like regular roles, for the most part.
This removes a number of checks that were trying to make default roles
extra special by not allowing them to be used as regular roles.

We still prevent users from creating roles in the "pg_" namespace or
from altering roles which exist in that namespace via ALTER ROLE, as
we can't preserve such changes, but otherwise the roles are very much
like regular roles.

Based on discussion with Robert and Tom.
This commit is contained in:
Stephen Frost 2016-05-06 14:06:50 -04:00
parent 6bd356c33a
commit a89505fd21
11 changed files with 10 additions and 74 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
src/backend/catalog/aclchk.c
View File

@ -423,9 +423,6 @@ ExecuteGrantStmt(GrantStmt *stmt)
grantee_uid = ACL_ID_PUBLIC;
break;
default:
if (!IsBootstrapProcessingMode())
check_rolespec_name((Node *) grantee,
"Cannot GRANT or REVOKE privileges to or from a reserved role.");
grantee_uid = get_rolespec_oid((Node *) grantee, false);
break;
}
@ -921,8 +918,6 @@ ExecAlterDefaultPrivilegesStmt(AlterDefaultPrivilegesStmt *stmt)
grantee_uid = ACL_ID_PUBLIC;
break;
default:
check_rolespec_name((Node *) grantee,
"Cannot GRANT or REVOKE default privileges to or from a reserved role.");
grantee_uid = get_rolespec_oid((Node *) grantee, false);
break;
}
@ -1013,8 +1008,6 @@ ExecAlterDefaultPrivilegesStmt(AlterDefaultPrivilegesStmt *stmt)
{
RoleSpec *rolespec = lfirst(rolecell);
check_rolespec_name((Node *) rolespec,
"Cannot alter default privileges for reserved role.");
iacls.roleid = get_rolespec_oid((Node *) rolespec, false);
/*

3
src/backend/commands/alter.c
View File

@ -747,9 +747,6 @@ ExecAlterOwnerStmt(AlterOwnerStmt *stmt)
{
Oid newowner = get_rolespec_oid(stmt->newowner, false);
check_rolespec_name(stmt->newowner,
"Cannot make reserved roles owners of objects.");
switch (stmt->objectType)
{
case OBJECT_DATABASE:

13
src/backend/commands/foreigncmds.c
View File

@ -1148,10 +1148,6 @@ CreateUserMapping(CreateUserMappingStmt *stmt)
else
useId = get_rolespec_oid(stmt->user, false);
/* Additional check to protect reserved role names */
check_rolespec_name(stmt->user,
"Cannot specify reserved role as mapping user.");
/* Check that the server exists. */
srv = GetForeignServerByName(stmt->servername, false);
@ -1252,10 +1248,6 @@ AlterUserMapping(AlterUserMappingStmt *stmt)
else
useId = get_rolespec_oid(stmt->user, false);
/* Additional check to protect reserved role names */
check_rolespec_name(stmt->user,
"Cannot alter reserved role mapping user.");
srv = GetForeignServerByName(stmt->servername, false);
umId = GetSysCacheOid2(USERMAPPINGUSERSERVER,
@ -1345,11 +1337,6 @@ RemoveUserMapping(DropUserMappingStmt *stmt)
else
{
useId = get_rolespec_oid(stmt->user, stmt->missing_ok);
/* Additional check to protect reserved role names */
check_rolespec_name(stmt->user,
"Cannot remove reserved role mapping user.");
if (!OidIsValid(useId))
{
/*

5
src/backend/commands/policy.c
View File

@ -176,13 +176,8 @@ policy_role_list_to_array(List *roles, int *num_roles)
return role_oids;
}
else
{
/* Additional check to protect reserved role names */
check_rolespec_name((Node *) spec,
"Cannot specify reserved role as policy target");
role_oids[i++] =
ObjectIdGetDatum(get_rolespec_oid((Node *) spec, false));
}
}
return role_oids;

4
src/backend/commands/schemacmds.c
View File

@ -65,10 +65,6 @@ CreateSchemaCommand(CreateSchemaStmt *stmt, const char *queryString)
else
owner_uid = saved_uid;
/* Additional check to protect reserved role names */
check_rolespec_name(stmt->authrole,
"Cannot specify reserved role as owner.");
/* fill schema name with the user name if not specified */
if (!schemaName)
{

2
src/backend/commands/tablecmds.c
View File

@ -3566,8 +3566,6 @@ ATExecCmd(List **wqueue, AlteredTableInfo *tab, Relation rel,
(List *) cmd->def, lockmode);
break;
case AT_ChangeOwner: /* ALTER OWNER */
check_rolespec_name(cmd->newowner,
"Cannot specify reserved role as owner.");
ATExecChangeOwner(RelationGetRelid(rel),
get_rolespec_oid(cmd->newowner, false),
false, lockmode);

4
src/backend/commands/tablespace.c
View File

@ -256,10 +256,6 @@ CreateTableSpace(CreateTableSpaceStmt *stmt)
else
ownerId = GetUserId();
/* Additional check to protect reserved role names */
check_rolespec_name(stmt->owner,
"Cannot specify reserved role as owner.");
/* Unix-ify the offered path, and strip any trailing slashes */
location = pstrdup(stmt->location);
canonicalize_path(location);

11
src/backend/commands/user.c
View File

@ -1262,18 +1262,10 @@ GrantRole(GrantRoleStmt *stmt)
ListCell *item;
if (stmt->grantor)
{
check_rolespec_name(stmt->grantor,
"Cannot specify reserved role as grantor.");
grantor = get_rolespec_oid(stmt->grantor, false);
}
else
grantor = GetUserId();
foreach(item, stmt->grantee_roles)
check_rolespec_name(lfirst(item),
"Cannot GRANT roles to a reserved role.");
grantee_ids = roleSpecsToIds(stmt->grantee_roles);
/* AccessShareLock is enough since we aren't modifying pg_authid */
@ -1364,9 +1356,6 @@ ReassignOwnedObjects(ReassignOwnedStmt *stmt)
errmsg("permission denied to reassign objects")));
}
check_rolespec_name(stmt->newrole,
"Cannot specify reserved role as owner.");
/* Must have privileges on the receiving side too */
newrole = get_rolespec_oid(stmt->newrole, false);

7
src/backend/commands/variable.c
View File

@ -794,10 +794,6 @@ check_session_authorization(char **newval, void **extra, GucSource source)
return false;
}
/* Do not allow setting role to a reserved role. */
if (strncmp(*newval, "pg_", 3) == 0)
return false;
/* Look up the username */
roleTup = SearchSysCache1(AUTHNAME, PointerGetDatum(*newval));
if (!HeapTupleIsValid(roleTup))
@ -858,9 +854,6 @@ check_role(char **newval, void **extra, GucSource source)
roleid = InvalidOid;
is_superuser = false;
}
/* Do not allow setting role to a reserved role. */
else if (strncmp(*newval, "pg_", 3) == 0)
return false;
else
{
if (!IsTransactionState())

18
src/test/regress/expected/rolenames.out
View File

@ -816,19 +816,11 @@ LINE 1: DROP USER MAPPING IF EXISTS FOR CURRENT_ROLE SERVER sv9;
DROP USER MAPPING IF EXISTS FOR nonexistent SERVER sv9; -- error
NOTICE: role "nonexistent" does not exist, skipping
-- GRANT/REVOKE
GRANT testrol0 TO pg_abc; -- error
ERROR: role "pg_abc" is reserved
DETAIL: Cannot GRANT roles to a reserved role.
GRANT pg_abc TO pg_abcdef; -- error
ERROR: role "pg_abcdef" is reserved
DETAIL: Cannot GRANT roles to a reserved role.
SET ROLE pg_testrole; -- error
ERROR: invalid value for parameter "role": "pg_testrole"
SET ROLE pg_signal_backend; --error
ERROR: invalid value for parameter "role": "pg_signal_backend"
CREATE SCHEMA test_schema AUTHORIZATION pg_signal_backend; --error
ERROR: role "pg_signal_backend" is reserved
DETAIL: Cannot specify reserved role as owner.
GRANT testrol0 TO pg_signal_backend; -- success
SET ROLE pg_signal_backend; --success
RESET ROLE;
CREATE SCHEMA test_schema AUTHORIZATION pg_signal_backend; --success
SET ROLE testrol2;
UPDATE pg_proc SET proacl = null WHERE proname LIKE 'testagg_';
SELECT proname, proacl FROM pg_proc WHERE proname LIKE 'testagg_';
proname | proacl

10
src/test/regress/sql/rolenames.sql
View File

@ -381,12 +381,12 @@ DROP USER MAPPING IF EXISTS FOR CURRENT_ROLE SERVER sv9; --error
DROP USER MAPPING IF EXISTS FOR nonexistent SERVER sv9; -- error
-- GRANT/REVOKE
GRANT testrol0 TO pg_abc; -- error
GRANT pg_abc TO pg_abcdef; -- error
GRANT testrol0 TO pg_signal_backend; -- success
SET ROLE pg_testrole; -- error
SET ROLE pg_signal_backend; --error
CREATE SCHEMA test_schema AUTHORIZATION pg_signal_backend; --error
SET ROLE pg_signal_backend; --success
RESET ROLE;
CREATE SCHEMA test_schema AUTHORIZATION pg_signal_backend; --success
SET ROLE testrol2;
UPDATE pg_proc SET proacl = null WHERE proname LIKE 'testagg_';
SELECT proname, proacl FROM pg_proc WHERE proname LIKE 'testagg_';