Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitaf019fb

Browse files
committed
Add a role property 'rolinherit' which, when false, denotes that the role
doesn't automatically inherit the privileges of roles it is a member of;for such a role, membership in another role can be exploited only by doingexplicit SET ROLE. The default inherit setting is TRUE, so by defaultthe behavior doesn't change, but creating a user with NOINHERIT gives closeradherence to our current reading of SQL99. Documentation still lacking,and I think the information schema needs another look.
1 parentf9fd176 commitaf019fb

File tree

15 files changed

+325
-78
lines changed

15 files changed

+325
-78
lines changed

‎doc/src/sgml/catalogs.sgml‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<!--
22
Documentation of the system catalogs, directed toward PostgreSQL developers
3-
$PostgreSQL: pgsql/doc/src/sgml/catalogs.sgml,v 2.108 2005/07/14 05:13:38 tgl Exp $
3+
$PostgreSQL: pgsql/doc/src/sgml/catalogs.sgml,v 2.109 2005/07/26 16:38:25 tgl Exp $
44
-->
55

66
<chapter id="catalogs">
@@ -976,6 +976,14 @@
976976
<entry>Role has superuser privileges</entry>
977977
</row>
978978

979+
<row>
980+
<entry><structfield>rolinherit</structfield></entry>
981+
<entry><type>bool</type></entry>
982+
<entry></entry>
983+
<entry>Role automatically inherits privileges of roles it is a
984+
member of</entry>
985+
</row>
986+
979987
<row>
980988
<entry><structfield>rolcreaterole</structfield></entry>
981989
<entry><type>bool</type></entry>
@@ -4728,6 +4736,11 @@
47284736
that blanks out the password field.
47294737
</para>
47304738

4739+
<para>
4740+
This view explicitly exposes the OID column of the underlying table,
4741+
since that is needed to do joins to other catalogs.
4742+
</para>
4743+
47314744
<table>
47324745
<title><structname>pg_roles</> Columns</title>
47334746

@@ -4756,6 +4769,14 @@
47564769
<entry>Role has superuser privileges</entry>
47574770
</row>
47584771

4772+
<row>
4773+
<entry><structfield>rolinherit</structfield></entry>
4774+
<entry><type>bool</type></entry>
4775+
<entry></entry>
4776+
<entry>Role automatically inherits privileges of roles it is a
4777+
member of</entry>
4778+
</row>
4779+
47594780
<row>
47604781
<entry><structfield>rolcreaterole</structfield></entry>
47614782
<entry><type>bool</type></entry>
@@ -4811,6 +4832,13 @@
48114832
<entry></entry>
48124833
<entry>Session defaults for run-time configuration variables</entry>
48134834
</row>
4835+
4836+
<row>
4837+
<entry><structfield>oid</structfield></entry>
4838+
<entry><type>oid</type></entry>
4839+
<entry><literal><link linkend="catalog-pg-authid"><structname>pg_authid</structname></link>.oid</literal></entry>
4840+
<entry>ID of role</entry>
4841+
</row>
48144842
</tbody>
48154843
</tgroup>
48164844
</table>

‎doc/src/sgml/func.sgml‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/func.sgml,v 1.271 2005/07/2600:04:17 tgl Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/func.sgml,v 1.272 2005/07/2616:38:25 tgl Exp $
33
PostgreSQL documentation
44
-->
55

@@ -8559,7 +8559,12 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute');
85598559
can access a role in a particular way. The possibilities for its
85608560
arguments are analogous to <function>has_table_privilege</function>.
85618561
The desired access privilege type must evaluate to
8562-
<literal>MEMBER</literal>.
8562+
<literal>MEMBER</literal> or
8563+
<literal>USAGE</literal>.
8564+
<literal>MEMBER</literal> denotes direct or indirect membership in
8565+
the role (that is, the right to do <literal>SET ROLE</>), while
8566+
<literal>USAGE</literal> denotes whether the privileges of the role
8567+
are immediately available without doing <literal>SET ROLE</>.
85638568
</para>
85648569

85658570
<para>

‎src/backend/catalog/aclchk.c‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/backend/catalog/aclchk.c,v 1.115 2005/07/07 20:39:57 tgl Exp $
11+
* $PostgreSQL: pgsql/src/backend/catalog/aclchk.c,v 1.116 2005/07/26 16:38:26 tgl Exp $
1212
*
1313
* NOTES
1414
* See acl.h.
@@ -1984,7 +1984,7 @@ pg_class_ownercheck(Oid class_oid, Oid roleid)
19841984

19851985
ReleaseSysCache(tuple);
19861986

1987-
returnis_member_of_role(roleid,ownerId);
1987+
returnhas_privs_of_role(roleid,ownerId);
19881988
}
19891989

19901990
/*
@@ -2012,7 +2012,7 @@ pg_type_ownercheck(Oid type_oid, Oid roleid)
20122012

20132013
ReleaseSysCache(tuple);
20142014

2015-
returnis_member_of_role(roleid,ownerId);
2015+
returnhas_privs_of_role(roleid,ownerId);
20162016
}
20172017

20182018
/*
@@ -2040,7 +2040,7 @@ pg_oper_ownercheck(Oid oper_oid, Oid roleid)
20402040

20412041
ReleaseSysCache(tuple);
20422042

2043-
returnis_member_of_role(roleid,ownerId);
2043+
returnhas_privs_of_role(roleid,ownerId);
20442044
}
20452045

20462046
/*
@@ -2068,7 +2068,7 @@ pg_proc_ownercheck(Oid proc_oid, Oid roleid)
20682068

20692069
ReleaseSysCache(tuple);
20702070

2071-
returnis_member_of_role(roleid,ownerId);
2071+
returnhas_privs_of_role(roleid,ownerId);
20722072
}
20732073

20742074
/*
@@ -2096,7 +2096,7 @@ pg_namespace_ownercheck(Oid nsp_oid, Oid roleid)
20962096

20972097
ReleaseSysCache(tuple);
20982098

2099-
returnis_member_of_role(roleid,ownerId);
2099+
returnhas_privs_of_role(roleid,ownerId);
21002100
}
21012101

21022102
/*
@@ -2135,7 +2135,7 @@ pg_tablespace_ownercheck(Oid spc_oid, Oid roleid)
21352135
heap_endscan(scan);
21362136
heap_close(pg_tablespace,AccessShareLock);
21372137

2138-
returnis_member_of_role(roleid,spcowner);
2138+
returnhas_privs_of_role(roleid,spcowner);
21392139
}
21402140

21412141
/*
@@ -2164,7 +2164,7 @@ pg_opclass_ownercheck(Oid opc_oid, Oid roleid)
21642164

21652165
ReleaseSysCache(tuple);
21662166

2167-
returnis_member_of_role(roleid,ownerId);
2167+
returnhas_privs_of_role(roleid,ownerId);
21682168
}
21692169

21702170
/*
@@ -2203,7 +2203,7 @@ pg_database_ownercheck(Oid db_oid, Oid roleid)
22032203
heap_endscan(scan);
22042204
heap_close(pg_database,AccessShareLock);
22052205

2206-
returnis_member_of_role(roleid,dba);
2206+
returnhas_privs_of_role(roleid,dba);
22072207
}
22082208

22092209
/*
@@ -2231,5 +2231,5 @@ pg_conversion_ownercheck(Oid conv_oid, Oid roleid)
22312231

22322232
ReleaseSysCache(tuple);
22332233

2234-
returnis_member_of_role(roleid,ownerId);
2234+
returnhas_privs_of_role(roleid,ownerId);
22352235
}

‎src/backend/catalog/system_views.sql‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,22 @@
33
*
44
* Copyright (c) 1996-2005, PostgreSQL Global Development Group
55
*
6-
* $PostgreSQL: pgsql/src/backend/catalog/system_views.sql,v 1.16 2005/06/28 05:08:52 tgl Exp $
6+
* $PostgreSQL: pgsql/src/backend/catalog/system_views.sql,v 1.17 2005/07/26 16:38:26 tgl Exp $
77
*/
88

99
CREATEVIEWpg_rolesAS
1010
SELECT
1111
rolname,
1212
rolsuper,
13+
rolinherit,
1314
rolcreaterole,
1415
rolcreatedb,
1516
rolcatupdate,
1617
rolcanlogin,
1718
'********'::textas rolpassword,
1819
rolvaliduntil,
19-
rolconfig
20+
rolconfig,
21+
oid
2022
FROM pg_authid;
2123

2224
CREATEVIEWpg_shadowAS

‎src/backend/commands/user.c‎

Lines changed: 49 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
* Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group
77
* Portions Copyright (c) 1994, Regents of the University of California
88
*
9-
* $PostgreSQL: pgsql/src/backend/commands/user.c,v 1.157 2005/07/25 22:12:31 tgl Exp $
9+
* $PostgreSQL: pgsql/src/backend/commands/user.c,v 1.158 2005/07/26 16:38:26 tgl Exp $
1010
*
1111
*-------------------------------------------------------------------------
1212
*/
@@ -82,6 +82,7 @@ CreateRole(CreateRoleStmt *stmt)
8282
boolencrypt_password=Password_encryption;/* encrypt password? */
8383
charencrypted_password[MD5_PASSWD_LEN+1];
8484
boolissuper= false;/* Make the user a superuser? */
85+
boolinherit= true;/* Auto inherit privileges? */
8586
boolcreaterole= false;/* Can this user create roles? */
8687
boolcreatedb= false;/* Can the user create databases? */
8788
boolcanlogin= false;/* Can this user login? */
@@ -91,6 +92,7 @@ CreateRole(CreateRoleStmt *stmt)
9192
char*validUntil=NULL;/* time the login is valid until */
9293
DefElem*dpassword=NULL;
9394
DefElem*dissuper=NULL;
95+
DefElem*dinherit=NULL;
9496
DefElem*dcreaterole=NULL;
9597
DefElem*dcreatedb=NULL;
9698
DefElem*dcanlogin=NULL;
@@ -99,6 +101,19 @@ CreateRole(CreateRoleStmt *stmt)
99101
DefElem*dadminmembers=NULL;
100102
DefElem*dvalidUntil=NULL;
101103

104+
/* The defaults can vary depending on the original statement type */
105+
switch (stmt->stmt_type)
106+
{
107+
caseROLESTMT_ROLE:
108+
break;
109+
caseROLESTMT_USER:
110+
canlogin= true;
111+
/* may eventually want inherit to default to false here */
112+
break;
113+
caseROLESTMT_GROUP:
114+
break;
115+
}
116+
102117
/* Extract options from the statement node tree */
103118
foreach(option,stmt->options)
104119
{
@@ -120,7 +135,7 @@ CreateRole(CreateRoleStmt *stmt)
120135
}
121136
elseif (strcmp(defel->defname,"sysid")==0)
122137
{
123-
ereport(WARNING,
138+
ereport(NOTICE,
124139
(errmsg("SYSID can no longer be specified")));
125140
}
126141
elseif (strcmp(defel->defname,"superuser")==0)
@@ -131,6 +146,14 @@ CreateRole(CreateRoleStmt *stmt)
131146
errmsg("conflicting or redundant options")));
132147
dissuper=defel;
133148
}
149+
elseif (strcmp(defel->defname,"inherit")==0)
150+
{
151+
if (dinherit)
152+
ereport(ERROR,
153+
(errcode(ERRCODE_SYNTAX_ERROR),
154+
errmsg("conflicting or redundant options")));
155+
dinherit=defel;
156+
}
134157
elseif (strcmp(defel->defname,"createrole")==0)
135158
{
136159
if (dcreaterole)
@@ -196,6 +219,8 @@ CreateRole(CreateRoleStmt *stmt)
196219
password=strVal(dpassword->arg);
197220
if (dissuper)
198221
issuper=intVal(dissuper->arg)!=0;
222+
if (dinherit)
223+
inherit=intVal(dinherit->arg)!=0;
199224
if (dcreaterole)
200225
createrole=intVal(dcreaterole->arg)!=0;
201226
if (dcreatedb)
@@ -261,6 +286,7 @@ CreateRole(CreateRoleStmt *stmt)
261286
DirectFunctionCall1(namein,CStringGetDatum(stmt->role));
262287

263288
new_record[Anum_pg_authid_rolsuper-1]=BoolGetDatum(issuper);
289+
new_record[Anum_pg_authid_rolinherit-1]=BoolGetDatum(inherit);
264290
new_record[Anum_pg_authid_rolcreaterole-1]=BoolGetDatum(createrole);
265291
new_record[Anum_pg_authid_rolcreatedb-1]=BoolGetDatum(createdb);
266292
/* superuser gets catupdate right by default */
@@ -367,13 +393,15 @@ AlterRole(AlterRoleStmt *stmt)
367393
boolencrypt_password=Password_encryption;/* encrypt password? */
368394
charencrypted_password[MD5_PASSWD_LEN+1];
369395
intissuper=-1;/* Make the user a superuser? */
396+
intinherit=-1;/* Auto inherit privileges? */
370397
intcreaterole=-1;/* Can this user create roles? */
371398
intcreatedb=-1;/* Can the user create databases? */
372399
intcanlogin=-1;/* Can this user login? */
373400
List*rolemembers=NIL;/* roles to be added/removed */
374401
char*validUntil=NULL;/* time the login is valid until */
375402
DefElem*dpassword=NULL;
376403
DefElem*dissuper=NULL;
404+
DefElem*dinherit=NULL;
377405
DefElem*dcreaterole=NULL;
378406
DefElem*dcreatedb=NULL;
379407
DefElem*dcanlogin=NULL;
@@ -408,6 +436,14 @@ AlterRole(AlterRoleStmt *stmt)
408436
errmsg("conflicting or redundant options")));
409437
dissuper=defel;
410438
}
439+
elseif (strcmp(defel->defname,"inherit")==0)
440+
{
441+
if (dinherit)
442+
ereport(ERROR,
443+
(errcode(ERRCODE_SYNTAX_ERROR),
444+
errmsg("conflicting or redundant options")));
445+
dinherit=defel;
446+
}
411447
elseif (strcmp(defel->defname,"createrole")==0)
412448
{
413449
if (dcreaterole)
@@ -458,6 +494,8 @@ AlterRole(AlterRoleStmt *stmt)
458494
password=strVal(dpassword->arg);
459495
if (dissuper)
460496
issuper=intVal(dissuper->arg);
497+
if (dinherit)
498+
inherit=intVal(dinherit->arg);
461499
if (dcreaterole)
462500
createrole=intVal(dcreaterole->arg);
463501
if (dcreatedb)
@@ -497,10 +535,10 @@ AlterRole(AlterRoleStmt *stmt)
497535
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
498536
errmsg("must be superuser to alter superusers")));
499537
}
500-
else
538+
elseif (!have_createrole_privilege())
501539
{
502-
if (!have_createrole_privilege()&&
503-
!(createrole<0&&
540+
if (!(inherit<0&&
541+
createrole<0&&
504542
createdb<0&&
505543
canlogin<0&&
506544
!rolemembers&&
@@ -536,6 +574,12 @@ AlterRole(AlterRoleStmt *stmt)
536574
new_record_repl[Anum_pg_authid_rolcatupdate-1]='r';
537575
}
538576

577+
if (inherit >=0)
578+
{
579+
new_record[Anum_pg_authid_rolinherit-1]=BoolGetDatum(inherit>0);
580+
new_record_repl[Anum_pg_authid_rolinherit-1]='r';
581+
}
582+
539583
if (createrole >=0)
540584
{
541585
new_record[Anum_pg_authid_rolcreaterole-1]=BoolGetDatum(createrole>0);

‎src/backend/nodes/copyfuncs.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@
1515
* Portions Copyright (c) 1994, Regents of the University of California
1616
*
1717
* IDENTIFICATION
18-
* $PostgreSQL: pgsql/src/backend/nodes/copyfuncs.c,v 1.311 2005/07/02 23:00:39 tgl Exp $
18+
* $PostgreSQL: pgsql/src/backend/nodes/copyfuncs.c,v 1.312 2005/07/26 16:38:27 tgl Exp $
1919
*
2020
*-------------------------------------------------------------------------
2121
*/
@@ -2392,6 +2392,7 @@ _copyCreateRoleStmt(CreateRoleStmt *from)
23922392
{
23932393
CreateRoleStmt*newnode=makeNode(CreateRoleStmt);
23942394

2395+
COPY_SCALAR_FIELD(stmt_type);
23952396
COPY_STRING_FIELD(role);
23962397
COPY_NODE_FIELD(options);
23972398

‎src/backend/nodes/equalfuncs.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
* Portions Copyright (c) 1994, Regents of the University of California
1919
*
2020
* IDENTIFICATION
21-
* $PostgreSQL: pgsql/src/backend/nodes/equalfuncs.c,v 1.248 2005/07/02 23:00:39 tgl Exp $
21+
* $PostgreSQL: pgsql/src/backend/nodes/equalfuncs.c,v 1.249 2005/07/26 16:38:27 tgl Exp $
2222
*
2323
*-------------------------------------------------------------------------
2424
*/
@@ -1308,6 +1308,7 @@ _equalDropPLangStmt(DropPLangStmt *a, DropPLangStmt *b)
13081308
staticbool
13091309
_equalCreateRoleStmt(CreateRoleStmt*a,CreateRoleStmt*b)
13101310
{
1311+
COMPARE_SCALAR_FIELD(stmt_type);
13111312
COMPARE_STRING_FIELD(role);
13121313
COMPARE_NODE_FIELD(options);
13131314

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp