mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2024-12-15 08:20:16 +08:00
Code Issues Packages Projects Releases Wiki Activity

Allow LOCK TABLE .. ROW EXCLUSIVE MODE with INSERT

Browse Source 
INSERT acquires RowExclusiveLock during normal operation and therefore
it makes sense to allow LOCK TABLE .. ROW EXCLUSIVE MODE to be executed
by users who have INSERT rights on a table (even if they don't have
UPDATE or DELETE).

Not back-patching this as it's a behavior change which, strictly
speaking, loosens security restrictions.

Per discussion with Tom and Robert (circa 2013).
This commit is contained in:
Stephen Frost 2015-05-11 15:44:12 -04:00
parent 9d15292cfc
commit fa2642438f
2 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
doc/src/sgml/ref/lock.sgml
View File

@ -161,9 +161,11 @@ LOCK [ TABLE ] [ ONLY ] <replaceable class="PARAMETER">name</replaceable> [ * ]
<para>
<literal>LOCK TABLE ... IN ACCESS SHARE MODE</> requires <literal>SELECT</>
privileges on the target table. All other forms of <command>LOCK</>
require table-level <literal>UPDATE</>, <literal>DELETE</>, or
<literal>TRUNCATE</> privileges.
privileges on the target table. <literal>LOCK TABLE ... IN ROW EXCLUSIVE
MODE</> requires <literal>INSERT</>, <literal>UPDATE</>, <literal>DELETE</>,
or <literal>TRUNCATE</> privileges on the target table. All other forms of
<command>LOCK</> require table-level <literal>UPDATE</>, <literal>DELETE</>,
or <literal>TRUNCATE</> privileges.
</para>
<para>

12
src/backend/commands/lockcmds.c
View File

@ -169,13 +169,17 @@ static AclResult
LockTableAclCheck(Oid reloid, LOCKMODE lockmode)
{
AclResult aclresult;
AclMode aclmask;
/* Verify adequate privilege */
if (lockmode == AccessShareLock)
aclresult = pg_class_aclcheck(reloid, GetUserId(),
ACL_SELECT);
aclmask = ACL_SELECT;
else if (lockmode == RowExclusiveLock)
aclmask = ACL_INSERT | ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE;
else
aclresult = pg_class_aclcheck(reloid, GetUserId(),
ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE);
aclmask = ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE;
aclresult = pg_class_aclcheck(reloid, GetUserId(), aclmask);
return aclresult;
}