Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit2822788

Browse files
committed
Accept SET SESSION AUTHORIZATION DEFAULT and RESET SESSION AUTHORIZATION
to reset session userid to the originally-authenticated name. Also,relax SET SESSION AUTHORIZATION to allow specifying one's own usernameeven if one is not superuser, so as to avoid unnecessary error messageswhen loading a pg_dump file that uses this command. Per discussion fromseveral months ago.
1 parent15162ae commit2822788

File tree

4 files changed

+88
-27
lines changed

4 files changed

+88
-27
lines changed

‎doc/src/sgml/ref/set_session_auth.sgml

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/ref/set_session_auth.sgml,v 1.4 2002/01/20 22:19:57 petere Exp $ -->
1+
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/ref/set_session_auth.sgml,v 1.5 2002/05/0619:47:30 tgl Exp $ -->
22
<refentry id="SQL-SET-SESSION-AUTHORIZATION">
33
<docinfo>
44
<date>2001-04-21</date>
@@ -16,7 +16,9 @@
1616

1717
<refsynopsisdiv>
1818
<synopsis>
19-
SET SESSION AUTHORIZATION '<parameter>username</parameter>'
19+
SET SESSION AUTHORIZATION <parameter>username</parameter>
20+
SET SESSION AUTHORIZATION DEFAULT
21+
RESET SESSION AUTHORIZATION
2022
</synopsis>
2123
</refsynopsisdiv>
2224

@@ -26,7 +28,11 @@ SET SESSION AUTHORIZATION '<parameter>username</parameter>'
2628
<para>
2729
This command sets the session user identifier and the current user
2830
identifier of the current SQL-session context to be
29-
<parameter>username</parameter>.
31+
<parameter>username</parameter>. The user name may be written as
32+
either an identifier or a string literal.
33+
The session user identifier is valid for the duration of a
34+
connection; for example, it is possible to temporarily become an
35+
unprivileged user and later switch back to become a superuser.
3036
</para>
3137

3238
<para>
@@ -39,12 +45,18 @@ SET SESSION AUTHORIZATION '<parameter>username</parameter>'
3945
</para>
4046

4147
<para>
42-
Execution of this command is only permitted if the initial session
48+
The session user identifier may be changed only if the initial session
4349
user (the <firstterm>authenticated user</firstterm>) had the
44-
superuser privilege. This permission is kept for the duration of a
45-
connection; for example, it is possible to temporarily become an
46-
unprivileged user and later switch back to become a superuser.
50+
superuser privilege. Otherwise, the command is accepted only if it
51+
specifies the authenticated username.
4752
</para>
53+
54+
<para>
55+
The <literal>DEFAULT</> and <literal>RESET</> forms reset the session
56+
and current user identifiers to be the originally authenticated user
57+
name. These forms are always accepted.
58+
</para>
59+
4860
</refsect1>
4961

5062
<refsect1>

‎src/backend/commands/variable.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
*
1010
*
1111
* IDENTIFICATION
12-
* $Header: /cvsroot/pgsql/src/backend/commands/variable.c,v 1.65 2002/04/22 15:13:53 thomas Exp $
12+
* $Header: /cvsroot/pgsql/src/backend/commands/variable.c,v 1.66 2002/05/06 19:47:30 tgl Exp $
1313
*
1414
*-------------------------------------------------------------------------
1515
*/
@@ -815,6 +815,15 @@ reset_server_encoding(void)
815815
}
816816

817817

818+
staticbool
819+
show_session_authorization(void)
820+
{
821+
elog(INFO,"Current session authorization is '%s'",
822+
GetUserName(GetSessionUserId()));
823+
return TRUE;
824+
}
825+
826+
818827

819828
/* SetPGVariable()
820829
* Dispatcher for handling SET commands.
@@ -902,6 +911,8 @@ GetPGVariable(const char *name)
902911
show_server_encoding();
903912
elseif (strcasecmp(name,"seed")==0)
904913
show_random_seed();
914+
elseif (strcasecmp(name,"session_authorization")==0)
915+
show_session_authorization();
905916
elseif (strcasecmp(name,"all")==0)
906917
{
907918
ShowAllGUCConfig();
@@ -935,13 +946,16 @@ ResetPGVariable(const char *name)
935946
reset_server_encoding();
936947
elseif (strcasecmp(name,"seed")==0)
937948
reset_random_seed();
949+
elseif (strcasecmp(name,"session_authorization")==0)
950+
SetSessionAuthorization(NULL);
938951
elseif (strcasecmp(name,"all")==0)
939952
{
940953
reset_random_seed();
941954
/* reset_server_encoding(); */
942955
reset_client_encoding();
943956
reset_datestyle();
944957
reset_timezone();
958+
/* should we reset session authorization here? */
945959

946960
ResetAllOptions(false);
947961
}

‎src/backend/parser/gram.y

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $Header: /cvsroot/pgsql/src/backend/parser/gram.y,v 2.312 2002/05/03 00:32:16 tgl Exp $
14+
* $Header: /cvsroot/pgsql/src/backend/parser/gram.y,v 2.313 2002/05/06 19:47:30 tgl Exp $
1515
*
1616
* HISTORY
1717
* AUTHORDATEMAJOR EVENT
@@ -281,7 +281,7 @@ static void doNegateFloat(Value *v);
281281
%type<ival>Iconst
282282
%type<str>Sconst,comment_text
283283
%type<str>UserId,opt_boolean,ColId_or_Sconst
284-
%type<list>var_list
284+
%type<list>var_list,var_list_or_default
285285
%type<str>ColId,ColLabel,type_name
286286
%type<node>var_value,zone_value
287287

@@ -833,14 +833,14 @@ schema_stmt: CreateStmt
833833
*
834834
*****************************************************************************/
835835

836-
VariableSetStmt:SETColIdTOvar_list
836+
VariableSetStmt:SETColIdTOvar_list_or_default
837837
{
838838
VariableSetStmt *n = makeNode(VariableSetStmt);
839839
n->name =$2;
840840
n->args =$4;
841841
$$ = (Node *) n;
842842
}
843-
|SETColId'='var_list
843+
|SETColId'='var_list_or_default
844844
{
845845
VariableSetStmt *n = makeNode(VariableSetStmt);
846846
n->name =$2;
@@ -884,14 +884,25 @@ VariableSetStmt: SET ColId TO var_list
884884
n->args = makeList1(makeStringConst($4,NULL));
885885
$$ = (Node *) n;
886886
}
887+
|SETSESSIONAUTHORIZATIONDEFAULT
888+
{
889+
VariableSetStmt *n = makeNode(VariableSetStmt);
890+
n->name ="session_authorization";
891+
n->args = NIL;
892+
$$ = (Node *) n;
893+
}
894+
;
895+
896+
var_list_or_default:var_list
897+
{$$ =$1; }
898+
|DEFAULT
899+
{$$ = NIL; }
887900
;
888901

889902
var_list:var_value
890903
{$$ = makeList1($1); }
891904
|var_list','var_value
892905
{$$ = lappend($1,$3); }
893-
|DEFAULT
894-
{$$ = NIL; }
895906
;
896907

897908
var_value:opt_boolean
@@ -1017,6 +1028,12 @@ VariableResetStmt:RESET ColId
10171028
n->name ="XactIsoLevel";
10181029
$$ = (Node *) n;
10191030
}
1031+
|RESETSESSIONAUTHORIZATION
1032+
{
1033+
VariableResetStmt *n = makeNode(VariableResetStmt);
1034+
n->name ="session_authorization";
1035+
$$ = (Node *) n;
1036+
}
10201037
|RESETALL
10211038
{
10221039
VariableResetStmt *n = makeNode(VariableResetStmt);

‎src/backend/utils/init/miscinit.c

Lines changed: 31 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $Header: /cvsroot/pgsql/src/backend/utils/init/miscinit.c,v 1.89 2002/05/05 00:03:29 tgl Exp $
11+
* $Header: /cvsroot/pgsql/src/backend/utils/init/miscinit.c,v 1.90 2002/05/06 19:47:30 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -529,15 +529,17 @@ GetCharSetByHost(char *TableName, int host, const char *DataDir)
529529
/* ----------------------------------------------------------------
530530
*User ID things
531531
*
532-
* The session user is determined at connection start and never
533-
* changes. The current user may change when "setuid" functions
532+
* The authenticated user is determined at connection start and never
533+
* changes. The session user can be changed only by SET SESSION
534+
* AUTHORIZATION. The current user may change when "setuid" functions
534535
* are implemented. Conceptually there is a stack, whose bottom
535536
* is the session user. You are yourself responsible to save and
536537
* restore the current user id if you need to change it.
537538
* ----------------------------------------------------------------
538539
*/
539-
staticOidCurrentUserId=InvalidOid;
540+
staticOidAuthenticatedUserId=InvalidOid;
540541
staticOidSessionUserId=InvalidOid;
542+
staticOidCurrentUserId=InvalidOid;
541543

542544
staticboolAuthenticatedUserIsSuperuser= false;
543545

@@ -588,6 +590,7 @@ InitializeSessionUserId(const char *username)
588590
HeapTupleuserTup;
589591
Datumdatum;
590592
boolisnull;
593+
Oidusesysid;
591594

592595
/*
593596
* Don't do scans if we're bootstrapping, none of the system catalogs
@@ -596,18 +599,22 @@ InitializeSessionUserId(const char *username)
596599
AssertState(!IsBootstrapProcessingMode());
597600

598601
/* call only once */
599-
AssertState(!OidIsValid(SessionUserId));
602+
AssertState(!OidIsValid(AuthenticatedUserId));
600603

601604
userTup=SearchSysCache(SHADOWNAME,
602605
PointerGetDatum(username),
603606
0,0,0);
604607
if (!HeapTupleIsValid(userTup))
605608
elog(FATAL,"user \"%s\" does not exist",username);
606609

607-
SetSessionUserId(((Form_pg_shadow)GETSTRUCT(userTup))->usesysid);
610+
usesysid= ((Form_pg_shadow)GETSTRUCT(userTup))->usesysid;
608611

612+
AuthenticatedUserId=usesysid;
609613
AuthenticatedUserIsSuperuser= ((Form_pg_shadow)GETSTRUCT(userTup))->usesuper;
610614

615+
SetSessionUserId(usesysid);/* sets CurrentUserId too */
616+
617+
611618
/*
612619
* Set up user-specific configuration variables. This is a good
613620
* place to do it so we don't have to read pg_shadow twice during
@@ -633,25 +640,36 @@ InitializeSessionUserIdStandalone(void)
633640
AssertState(!IsUnderPostmaster);
634641

635642
/* call only once */
636-
AssertState(!OidIsValid(SessionUserId));
643+
AssertState(!OidIsValid(AuthenticatedUserId));
637644

638-
SetSessionUserId(BOOTSTRAP_USESYSID);
645+
AuthenticatedUserId=BOOTSTRAP_USESYSID;
639646
AuthenticatedUserIsSuperuser= true;
647+
648+
SetSessionUserId(BOOTSTRAP_USESYSID);
640649
}
641650

642651

643652
/*
644653
* Change session auth ID while running
654+
*
655+
* Only a superuser may set auth ID to something other than himself.
656+
*
657+
* username == NULL implies reset to default (AuthenticatedUserId).
645658
*/
646659
void
647660
SetSessionAuthorization(constchar*username)
648661
{
649-
int32userid;
650-
651-
if (!AuthenticatedUserIsSuperuser)
652-
elog(ERROR,"permission denied");
662+
Oiduserid;
653663

654-
userid=get_usesysid(username);
664+
if (username==NULL)
665+
userid=AuthenticatedUserId;
666+
else
667+
{
668+
userid=get_usesysid(username);
669+
if (userid!=AuthenticatedUserId&&
670+
!AuthenticatedUserIsSuperuser)
671+
elog(ERROR,"permission denied");
672+
}
655673

656674
SetSessionUserId(userid);
657675
SetUserId(userid);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp