Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitbb8582a

Browse files
committed
Remove rolcatupdate
This role attribute is an ancient PostgreSQL feature, but could only beset by directly updating the system catalogs, and it doesn't have anyclearly defined use.Author: Adam Brightwell <adam.brightwell@crunchydatasolutions.com>
1 parent6510c83 commitbb8582a

File tree

8 files changed

+17
-90
lines changed

8 files changed

+17
-90
lines changed

‎doc/src/sgml/catalogs.sgml

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1415,15 +1415,6 @@
14151415
<entry>Role can create databases</entry>
14161416
</row>
14171417

1418-
<row>
1419-
<entry><structfield>rolcatupdate</structfield></entry>
1420-
<entry><type>bool</type></entry>
1421-
<entry>
1422-
Role can update system catalogs directly. (Even a superuser cannot do
1423-
this unless this column is true)
1424-
</entry>
1425-
</row>
1426-
14271418
<row>
14281419
<entry><structfield>rolcanlogin</structfield></entry>
14291420
<entry><type>bool</type></entry>
@@ -8491,16 +8482,6 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
84918482
<entry>Role can create databases</entry>
84928483
</row>
84938484

8494-
<row>
8495-
<entry><structfield>rolcatupdate</structfield></entry>
8496-
<entry><type>bool</type></entry>
8497-
<entry></entry>
8498-
<entry>
8499-
Role can update system catalogs directly. (Even a superuser cannot do
8500-
this unless this column is true)
8501-
</entry>
8502-
</row>
8503-
85048485
<row>
85058486
<entry><structfield>rolcanlogin</structfield></entry>
85068487
<entry><type>bool</type></entry>
@@ -9019,16 +9000,6 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
90199000
<entry>User is a superuser</entry>
90209001
</row>
90219002

9022-
<row>
9023-
<entry><structfield>usecatupd</structfield></entry>
9024-
<entry><type>bool</type></entry>
9025-
<entry></entry>
9026-
<entry>
9027-
User can update system catalogs. (Even a superuser cannot do
9028-
this unless this column is true.)
9029-
</entry>
9030-
</row>
9031-
90329003
<row>
90339004
<entry><structfield>userepl</structfield></entry>
90349005
<entry><type>bool</type></entry>
@@ -9506,15 +9477,6 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
95069477
<entry>User is a superuser</entry>
95079478
</row>
95089479

9509-
<row>
9510-
<entry><structfield>usecatupd</structfield></entry>
9511-
<entry><type>bool</type></entry>
9512-
<entry>
9513-
User can update system catalogs. (Even a superuser cannot do
9514-
this unless this column is true.)
9515-
</entry>
9516-
</row>
9517-
95189480
<row>
95199481
<entry><structfield>userepl</structfield></entry>
95209482
<entry><type>bool</type></entry>

‎src/backend/catalog/aclchk.c

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -3423,26 +3423,6 @@ aclcheck_error_type(AclResult aclerr, Oid typeOid)
34233423
}
34243424

34253425

3426-
/* Check if given user has rolcatupdate privilege according to pg_authid */
3427-
staticbool
3428-
has_rolcatupdate(Oidroleid)
3429-
{
3430-
boolrolcatupdate;
3431-
HeapTupletuple;
3432-
3433-
tuple=SearchSysCache1(AUTHOID,ObjectIdGetDatum(roleid));
3434-
if (!HeapTupleIsValid(tuple))
3435-
ereport(ERROR,
3436-
(errcode(ERRCODE_UNDEFINED_OBJECT),
3437-
errmsg("role with OID %u does not exist",roleid)));
3438-
3439-
rolcatupdate= ((Form_pg_authid)GETSTRUCT(tuple))->rolcatupdate;
3440-
3441-
ReleaseSysCache(tuple);
3442-
3443-
returnrolcatupdate;
3444-
}
3445-
34463426
/*
34473427
* Relay for the various pg_*_mask routines depending on object kind
34483428
*/
@@ -3620,8 +3600,7 @@ pg_class_aclmask(Oid table_oid, Oid roleid,
36203600

36213601
/*
36223602
* Deny anyone permission to update a system catalog unless
3623-
* pg_authid.rolcatupdate is set. (This is to let superusers protect
3624-
* themselves from themselves.) Also allow it if allowSystemTableMods.
3603+
* pg_authid.rolsuper is set. Also allow it if allowSystemTableMods.
36253604
*
36263605
* As of 7.4 we have some updatable system views; those shouldn't be
36273606
* protected in this way. Assume the view rules can take care of
@@ -3630,7 +3609,7 @@ pg_class_aclmask(Oid table_oid, Oid roleid,
36303609
if ((mask& (ACL_INSERT |ACL_UPDATE |ACL_DELETE |ACL_TRUNCATE |ACL_USAGE))&&
36313610
IsSystemClass(table_oid,classForm)&&
36323611
classForm->relkind!=RELKIND_VIEW&&
3633-
!has_rolcatupdate(roleid)&&
3612+
!superuser_arg(roleid)&&
36343613
!allowSystemTableMods)
36353614
{
36363615
#ifdefACLDEBUG

‎src/backend/catalog/system_views.sql

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ CREATE VIEW pg_roles AS
1313
rolinherit,
1414
rolcreaterole,
1515
rolcreatedb,
16-
rolcatupdate,
1716
rolcanlogin,
1817
rolreplication,
1918
rolconnlimit,
@@ -31,7 +30,6 @@ CREATE VIEW pg_shadow AS
3130
pg_authid.oidAS usesysid,
3231
rolcreatedbAS usecreatedb,
3332
rolsuperAS usesuper,
34-
rolcatupdateAS usecatupd,
3533
rolreplicationAS userepl,
3634
rolbypassrlsAS usebypassrls,
3735
rolpasswordAS passwd,
@@ -57,7 +55,6 @@ CREATE VIEW pg_user AS
5755
usesysid,
5856
usecreatedb,
5957
usesuper,
60-
usecatupd,
6158
userepl,
6259
usebypassrls,
6360
'********'::textas passwd,

‎src/backend/commands/user.c

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -368,8 +368,6 @@ CreateRole(CreateRoleStmt *stmt)
368368
new_record[Anum_pg_authid_rolinherit-1]=BoolGetDatum(inherit);
369369
new_record[Anum_pg_authid_rolcreaterole-1]=BoolGetDatum(createrole);
370370
new_record[Anum_pg_authid_rolcreatedb-1]=BoolGetDatum(createdb);
371-
/* superuser gets catupdate right by default */
372-
new_record[Anum_pg_authid_rolcatupdate-1]=BoolGetDatum(issuper);
373371
new_record[Anum_pg_authid_rolcanlogin-1]=BoolGetDatum(canlogin);
374372
new_record[Anum_pg_authid_rolreplication-1]=BoolGetDatum(isreplication);
375373
new_record[Anum_pg_authid_rolconnlimit-1]=Int32GetDatum(connlimit);
@@ -734,20 +732,12 @@ AlterRole(AlterRoleStmt *stmt)
734732
MemSet(new_record_repl, false,sizeof(new_record_repl));
735733

736734
/*
737-
* issuper/createrole/catupdate/etc
738-
*
739-
* XXX It's rather unclear how to handle catupdate. It's probably best to
740-
* keep it equal to the superuser status, otherwise you could end up with
741-
* a situation where no existing superuser can alter the catalogs,
742-
* including pg_authid!
735+
* issuper/createrole/etc
743736
*/
744737
if (issuper >=0)
745738
{
746739
new_record[Anum_pg_authid_rolsuper-1]=BoolGetDatum(issuper>0);
747740
new_record_repl[Anum_pg_authid_rolsuper-1]= true;
748-
749-
new_record[Anum_pg_authid_rolcatupdate-1]=BoolGetDatum(issuper>0);
750-
new_record_repl[Anum_pg_authid_rolcatupdate-1]= true;
751741
}
752742

753743
if (inherit >=0)

‎src/include/catalog/catversion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/*yyyymmddN */
56-
#defineCATALOG_VERSION_NO201503031
56+
#defineCATALOG_VERSION_NO201503061
5757

5858
#endif

‎src/include/catalog/pg_authid.h

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@ CATALOG(pg_authid,1260) BKI_SHARED_RELATION BKI_ROWTYPE_OID(2842) BKI_SCHEMA_MAC
4949
boolrolinherit;/* inherit privileges from other roles? */
5050
boolrolcreaterole;/* allowed to create more roles? */
5151
boolrolcreatedb;/* allowed to create databases? */
52-
boolrolcatupdate;/* allowed to alter catalogs manually? */
5352
boolrolcanlogin;/* allowed to log in as session user? */
5453
boolrolreplication;/* role used for streaming replication */
5554
boolrolbypassrls;/* allowed to bypass row level security? */
@@ -76,19 +75,18 @@ typedef FormData_pg_authid *Form_pg_authid;
7675
*compiler constants for pg_authid
7776
* ----------------
7877
*/
79-
#defineNatts_pg_authid12
78+
#defineNatts_pg_authid11
8079
#defineAnum_pg_authid_rolname1
8180
#defineAnum_pg_authid_rolsuper2
8281
#defineAnum_pg_authid_rolinherit3
8382
#defineAnum_pg_authid_rolcreaterole4
8483
#defineAnum_pg_authid_rolcreatedb5
85-
#defineAnum_pg_authid_rolcatupdate6
86-
#defineAnum_pg_authid_rolcanlogin7
87-
#defineAnum_pg_authid_rolreplication8
88-
#defineAnum_pg_authid_rolbypassrls9
89-
#defineAnum_pg_authid_rolconnlimit10
90-
#defineAnum_pg_authid_rolpassword11
91-
#defineAnum_pg_authid_rolvaliduntil12
84+
#defineAnum_pg_authid_rolcanlogin6
85+
#defineAnum_pg_authid_rolreplication7
86+
#defineAnum_pg_authid_rolbypassrls8
87+
#defineAnum_pg_authid_rolconnlimit9
88+
#defineAnum_pg_authid_rolpassword10
89+
#defineAnum_pg_authid_rolvaliduntil11
9290

9391
/* ----------------
9492
*initial contents of pg_authid
@@ -97,7 +95,7 @@ typedef FormData_pg_authid *Form_pg_authid;
9795
* user choices.
9896
* ----------------
9997
*/
100-
DATA(insertOID=10 ("POSTGRES"tttttttt-1_null__null_));
98+
DATA(insertOID=10 ("POSTGRES"ttttttt-1_null__null_));
10199

102100
#defineBOOTSTRAP_SUPERUSERID 10
103101

‎src/test/regress/expected/privileges.out

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -676,7 +676,11 @@ ERROR: role "nosuchuser" does not exist
676676
select has_table_privilege('pg_authid','sel');
677677
ERROR: unrecognized privilege type: "sel"
678678
select has_table_privilege(-999999,'pg_authid','update');
679-
ERROR: role with OID 4293967297 does not exist
679+
has_table_privilege
680+
---------------------
681+
f
682+
(1 row)
683+
680684
select has_table_privilege(1,'select');
681685
has_table_privilege
682686
---------------------

‎src/test/regress/expected/rules.out

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1406,7 +1406,6 @@ pg_roles| SELECT pg_authid.rolname,
14061406
pg_authid.rolinherit,
14071407
pg_authid.rolcreaterole,
14081408
pg_authid.rolcreatedb,
1409-
pg_authid.rolcatupdate,
14101409
pg_authid.rolcanlogin,
14111410
pg_authid.rolreplication,
14121411
pg_authid.rolconnlimit,
@@ -1607,7 +1606,6 @@ pg_shadow| SELECT pg_authid.rolname AS usename,
16071606
pg_authid.oid AS usesysid,
16081607
pg_authid.rolcreatedb AS usecreatedb,
16091608
pg_authid.rolsuper AS usesuper,
1610-
pg_authid.rolcatupdate AS usecatupd,
16111609
pg_authid.rolreplication AS userepl,
16121610
pg_authid.rolbypassrls AS usebypassrls,
16131611
pg_authid.rolpassword AS passwd,
@@ -2062,7 +2060,6 @@ pg_user| SELECT pg_shadow.usename,
20622060
pg_shadow.usesysid,
20632061
pg_shadow.usecreatedb,
20642062
pg_shadow.usesuper,
2065-
pg_shadow.usecatupd,
20662063
pg_shadow.userepl,
20672064
pg_shadow.usebypassrls,
20682065
'********'::text AS passwd,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp