Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit23f34fa

Browse files
committed
In pg_dump, include pg_catalog and extension ACLs, if changed
Now that all of the infrastructure exists, add in the ability todump out the ACLs of the objects inside of pg_catalog or the ACLsfor objects which are members of extensions, but only if they havebeen changed from their original values.The original values are tracked in pg_init_privs. When pg_dump'ing9.6-and-above databases, we will dump out the ACLs for all objectsin pg_catalog and the ACLs for all extension members, where the ACLhas been changed from the original value which was set during eitherinitdb or CREATE EXTENSION.This should not change dumps against pre-9.6 databases.Reviews by Alexander Korotkov, Jose Luis Tallon
1 parentd217b2c commit23f34fa

File tree

15 files changed

+1268
-209
lines changed

15 files changed

+1268
-209
lines changed

‎doc/src/sgml/extend.sgml

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,27 @@
338338
data; see below.)
339339
</para>
340340

341+
<para>
342+
The extension script may set privileges on objects which are part of the
343+
extension via <command>GRANT</command> and <command>REVOKE</command>
344+
statements. The final set of privileges for each object (if any are set)
345+
will be stored in the
346+
<link linkend="catalog-pg-init-privs"><structname>pg_init_privs</structname></link>
347+
system catalog. When <application>pg_dump</> is used, the
348+
<command>CREATE EXTENSION</> command will be included in the dump, followed
349+
by the set of <command>GRANT</command> and <command>REVOKE</command>
350+
statements necessary to set the privileges on the objects to what they were
351+
at the time the dump was taken.
352+
</para>
353+
354+
<para>
355+
<productname>PostgreSQL</> does not currently support extension scripts
356+
issuing <command>CREATE POLICY</command> or <command>SECURITY LABEL</command>
357+
statements. These are expected to be set after the extension has been
358+
created. All RLS policies and security labels on extension objects will be
359+
included in dumps created by <application>pg_dump</>.
360+
</para>
361+
341362
<para>
342363
The extension mechanism also has provisions for packaging modification
343364
scripts that adjust the definitions of the SQL objects contained in an

‎src/backend/catalog/aclchk.c

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include"access/htup_details.h"
2323
#include"access/sysattr.h"
2424
#include"access/xact.h"
25+
#include"catalog/binary_upgrade.h"
2526
#include"catalog/catalog.h"
2627
#include"catalog/dependency.h"
2728
#include"catalog/indexing.h"
@@ -85,6 +86,12 @@ typedef struct
8586
DropBehaviorbehavior;
8687
}InternalDefaultACL;
8788

89+
/*
90+
* When performing a binary-upgrade, pg_dump will call a function to set
91+
* this variable to let us know that we need to populate the pg_init_privs
92+
* table for the GRANT/REVOKE commands while this variable is set to true.
93+
*/
94+
boolbinary_upgrade_record_init_privs= false;
8895

8996
staticvoidExecGrantStmt_oids(InternalGrant*istmt);
9097
staticvoidExecGrant_Relation(InternalGrant*grantStmt);
@@ -5237,7 +5244,15 @@ recordExtensionInitPriv(Oid objoid, Oid classoid, int objsubid, Acl *new_acl)
52375244
HeapTupletuple;
52385245
HeapTupleoldtuple;
52395246

5240-
if (!creating_extension)
5247+
/*
5248+
* Generally, we only record the initial privileges when an extension is
5249+
* being created, but because we don't actually use CREATE EXTENSION
5250+
* during binary upgrades with pg_upgrade, there is a variable to let us
5251+
* know that the GRANT and REVOKE statements being issued, while this
5252+
* variable is true, are for the initial privileges of the extension
5253+
* object and therefore we need to record them.
5254+
*/
5255+
if (!creating_extension&& !binary_upgrade_record_init_privs)
52415256
return;
52425257

52435258
relation=heap_open(InitPrivsRelationId,RowExclusiveLock);

‎src/backend/utils/adt/pg_upgrade_support.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ Datumbinary_upgrade_set_next_toast_pg_class_oid(PG_FUNCTION_ARGS);
2929
Datumbinary_upgrade_set_next_pg_enum_oid(PG_FUNCTION_ARGS);
3030
Datumbinary_upgrade_set_next_pg_authid_oid(PG_FUNCTION_ARGS);
3131
Datumbinary_upgrade_create_empty_extension(PG_FUNCTION_ARGS);
32+
Datumbinary_upgrade_set_record_init_privs(PG_FUNCTION_ARGS);
3233

3334

3435
#defineCHECK_IS_BINARY_UPGRADE\
@@ -193,3 +194,14 @@ binary_upgrade_create_empty_extension(PG_FUNCTION_ARGS)
193194

194195
PG_RETURN_VOID();
195196
}
197+
198+
Datum
199+
binary_upgrade_set_record_init_privs(PG_FUNCTION_ARGS)
200+
{
201+
boolrecord_init_privs=PG_GETARG_BOOL(0);
202+
203+
CHECK_IS_BINARY_UPGRADE;
204+
binary_upgrade_record_init_privs=record_init_privs;
205+
206+
PG_RETURN_VOID();
207+
}

‎src/bin/initdb/initdb.c

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2002,7 +2002,11 @@ setup_privileges(FILE *cmdfd)
20022002
char**priv_lines;
20032003
staticchar*privileges_setup[]= {
20042004
"UPDATE pg_class "
2005-
" SET relacl = E'{\"=r/\\\\\"$POSTGRES_SUPERUSERNAME\\\\\"\"}' "
2005+
" SET relacl = (SELECT array_agg(a.acl) FROM "
2006+
" (SELECT E'=r/\"$POSTGRES_SUPERUSERNAME\"' as acl "
2007+
" UNION SELECT unnest(pg_catalog.acldefault("
2008+
" CASE WHEN relkind = 'S' THEN 's' ELSE 'r' END::\"char\",10::oid))"
2009+
" ) as a) "
20062010
" WHERE relkind IN ('r', 'v', 'm', 'S') AND relacl IS NULL;\n\n",
20072011
"GRANT USAGE ON SCHEMA pg_catalog TO PUBLIC;\n\n",
20082012
"GRANT CREATE, USAGE ON SCHEMA public TO PUBLIC;\n\n",

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp