Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf30f34e

Browse files
committed
Ignore tablespace ACLs when ignoring schema ACLs.
The ALTER TABLE ALTER TYPE implementation can issue DROP INDEX andCREATE INDEX to refit existing indexes for the new column type. Sincethis CREATE INDEX is an implementation detail of an index alteration,the ensuing DefineIndex() should skip ACL checks specific to indexcreation. It already skips the namespace ACL check. Make it skip thetablespace ACL check, too. Back-patch to 9.2 (all supported versions).Reviewed by Tom Lane.
1 parent2ea5b06 commitf30f34e

File tree

3 files changed

+20
-5
lines changed

3 files changed

+20
-5
lines changed

‎src/backend/commands/indexcmds.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -293,8 +293,8 @@ CheckIndexCompatible(Oid oldId,
293293
* 'indexRelationId': normally InvalidOid, but during bootstrap can be
294294
*nonzero to specify a preselected OID for the index.
295295
* 'is_alter_table': this is due to an ALTER rather than a CREATE operation.
296-
* 'check_rights': check for CREATE rights inthenamespace. (This should
297-
*be true except when ALTER is deleting/recreating an index.)
296+
* 'check_rights': check for CREATE rights in namespace and tablespace. (This
297+
*shouldbe true except when ALTER is deleting/recreating an index.)
298298
* 'skip_build': make the catalog entries but leave the index file empty;
299299
*it will be filled later.
300300
* 'quiet': suppress the NOTICE chatter ordinarily provided for constraints.
@@ -435,8 +435,9 @@ DefineIndex(Oid relationId,
435435
/* note InvalidOid is OK in this case */
436436
}
437437

438-
/* Check permissions except when using database's default */
439-
if (OidIsValid(tablespaceId)&&tablespaceId!=MyDatabaseTableSpace)
438+
/* Check tablespace permissions */
439+
if (check_rights&&
440+
OidIsValid(tablespaceId)&&tablespaceId!=MyDatabaseTableSpace)
440441
{
441442
AclResultaclresult;
442443

‎src/test/regress/input/tablespace.source

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,11 +109,18 @@ DROP TABLESPACE regress_tblspace;
109109

110110
CREATE ROLE regress_tablespace_user1 login;
111111
CREATE ROLE regress_tablespace_user2 login;
112+
GRANT USAGE ON SCHEMA testschema TO regress_tablespace_user2;
112113

113114
ALTER TABLESPACE regress_tblspace OWNER TO regress_tablespace_user1;
114115

116+
CREATE TABLE testschema.tablespace_acl (c int);
117+
-- new owner lacks permission to create this index from scratch
118+
CREATE INDEX k ON testschema.tablespace_acl (c) TABLESPACE regress_tblspace;
119+
ALTER TABLE testschema.tablespace_acl OWNER TO regress_tablespace_user2;
120+
115121
SET SESSION ROLE regress_tablespace_user2;
116122
CREATE TABLE tablespace_table (i int) TABLESPACE regress_tblspace; -- fail
123+
ALTER TABLE testschema.tablespace_acl ALTER c TYPE bigint;
117124
RESET ROLE;
118125

119126
ALTER TABLESPACE regress_tblspace RENAME TO regress_tblspace_renamed;

‎src/test/regress/output/tablespace.source

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -221,10 +221,16 @@ DROP TABLESPACE regress_tblspace;
221221
ERROR: tablespace "regress_tblspace" is not empty
222222
CREATE ROLE regress_tablespace_user1 login;
223223
CREATE ROLE regress_tablespace_user2 login;
224+
GRANT USAGE ON SCHEMA testschema TO regress_tablespace_user2;
224225
ALTER TABLESPACE regress_tblspace OWNER TO regress_tablespace_user1;
226+
CREATE TABLE testschema.tablespace_acl (c int);
227+
-- new owner lacks permission to create this index from scratch
228+
CREATE INDEX k ON testschema.tablespace_acl (c) TABLESPACE regress_tblspace;
229+
ALTER TABLE testschema.tablespace_acl OWNER TO regress_tablespace_user2;
225230
SET SESSION ROLE regress_tablespace_user2;
226231
CREATE TABLE tablespace_table (i int) TABLESPACE regress_tblspace; -- fail
227232
ERROR: permission denied for tablespace regress_tblspace
233+
ALTER TABLE testschema.tablespace_acl ALTER c TYPE bigint;
228234
RESET ROLE;
229235
ALTER TABLESPACE regress_tblspace RENAME TO regress_tblspace_renamed;
230236
ALTER TABLE ALL IN TABLESPACE regress_tblspace_renamed SET TABLESPACE pg_default;
@@ -235,10 +241,11 @@ NOTICE: no matching relations in tablespace "regress_tblspace_renamed" found
235241
-- Should succeed
236242
DROP TABLESPACE regress_tblspace_renamed;
237243
DROP SCHEMA testschema CASCADE;
238-
NOTICE: drop cascades to4 other objects
244+
NOTICE: drop cascades to5 other objects
239245
DETAIL: drop cascades to table testschema.foo
240246
drop cascades to table testschema.asselect
241247
drop cascades to table testschema.asexecute
242248
drop cascades to table testschema.atable
249+
drop cascades to table testschema.tablespace_acl
243250
DROP ROLE regress_tablespace_user1;
244251
DROP ROLE regress_tablespace_user2;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp