Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit1a6bb6d

Browse files
committed
Allow a non-superuser database owner to vacuum all tables in his
database, including system catalogs (but not the shared catalogs,since they don't really belong to his database). This is per recentmailing list discussion. Clean up some other code that also checksfor database ownerness by introducing a test function is_dbadmin().
1 parentf21e340 commit1a6bb6d

File tree

10 files changed

+94
-94
lines changed

10 files changed

+94
-94
lines changed

‎src/backend/commands/analyze.c

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $Header: /cvsroot/pgsql/src/backend/commands/analyze.c,v 1.19 2001/06/06 21:29:17 tgl Exp $
11+
* $Header: /cvsroot/pgsql/src/backend/commands/analyze.c,v 1.20 2001/06/13 21:44:40 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -193,16 +193,18 @@ analyze_rel(Oid relid, VacuumStmt *vacstmt)
193193
ReleaseSysCache(tuple);
194194

195195
/*
196-
* Open the class, getting only a read lock on it, and check permissions
196+
* Open the class, getting only a read lock on it, and check permissions.
197+
* Permissions check should match vacuum's check!
197198
*/
198199
onerel=heap_open(relid,AccessShareLock);
199200

200-
if (!pg_ownercheck(GetUserId(),RelationGetRelationName(onerel),
201-
RELNAME))
201+
if (! (pg_ownercheck(GetUserId(),RelationGetRelationName(onerel),
202+
RELNAME)||
203+
(is_dbadmin(MyDatabaseId)&& !onerel->rd_rel->relisshared)))
202204
{
203205
/* No need for a notice if we already complained during VACUUM */
204206
if (!vacstmt->vacuum)
205-
elog(NOTICE,"Skipping \"%s\" --- only table owner can ANALYZE it",
207+
elog(NOTICE,"Skipping \"%s\" --- only tableor databaseowner can ANALYZE it",
206208
RelationGetRelationName(onerel));
207209
heap_close(onerel,NoLock);
208210
CommitTransactionCommand();

‎src/backend/commands/comment.c

Lines changed: 6 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -4,10 +4,10 @@
44
*
55
* PostgreSQL object comments utility code.
66
*
7-
* Copyright (c) 1999, PostgreSQL Global Development Group
7+
* Copyright (c) 1999-2001, PostgreSQL Global Development Group
88
*
99
* IDENTIFICATION
10-
* $Header: /cvsroot/pgsql/src/backend/commands/comment.c,v 1.29 2001/06/05 19:34:56 tgl Exp $
10+
* $Header: /cvsroot/pgsql/src/backend/commands/comment.c,v 1.30 2001/06/13 21:44:40 tgl Exp $
1111
*
1212
*-------------------------------------------------------------------------
1313
*/
@@ -21,7 +21,6 @@
2121
#include"catalog/pg_database.h"
2222
#include"catalog/pg_description.h"
2323
#include"catalog/pg_operator.h"
24-
#include"catalog/pg_shadow.h"
2524
#include"catalog/pg_trigger.h"
2625
#include"catalog/pg_type.h"
2726
#include"catalog/pg_class.h"
@@ -389,16 +388,11 @@ CommentAttribute(char *relname, char *attrname, char *comment)
389388
staticvoid
390389
CommentDatabase(char*database,char*comment)
391390
{
392-
393391
Relationpg_database;
394-
HeapTupledbtuple,
395-
usertuple;
396392
ScanKeyDataentry;
397393
HeapScanDescscan;
394+
HeapTupledbtuple;
398395
Oidoid;
399-
boolsuperuser;
400-
int32dba;
401-
Oiduserid;
402396

403397
/*** First find the tuple in pg_database for the database ***/
404398

@@ -408,33 +402,17 @@ CommentDatabase(char *database, char *comment)
408402
scan=heap_beginscan(pg_database,0,SnapshotNow,1,&entry);
409403
dbtuple=heap_getnext(scan,0);
410404

411-
/*** Validate database exists, and fetch thedba id and oid ***/
405+
/*** Validate database exists, and fetch thedb oid ***/
412406

413407
if (!HeapTupleIsValid(dbtuple))
414408
elog(ERROR,"database '%s' does not exist",database);
415-
dba= ((Form_pg_database)GETSTRUCT(dbtuple))->datdba;
416409
oid=dbtuple->t_data->t_oid;
417410

418-
/*** Now, fetch user information ***/
419-
420-
userid=GetUserId();
421-
usertuple=SearchSysCache(SHADOWSYSID,
422-
ObjectIdGetDatum(userid),
423-
0,0,0);
424-
if (!HeapTupleIsValid(usertuple))
425-
elog(ERROR,"invalid user id %u", (unsigned)userid);
426-
superuser= ((Form_pg_shadow)GETSTRUCT(usertuple))->usesuper;
427-
ReleaseSysCache(usertuple);
411+
/*** Allow if the user matches the database dba or is a superuser ***/
428412

429-
/*** Allow if the userid matches the database dba or is a superuser ***/
430-
431-
#ifndefNO_SECURITY
432-
if (!(superuser|| (userid==dba)))
433-
{
413+
if (!(superuser()||is_dbadmin(oid)))
434414
elog(ERROR,"you are not permitted to comment on database '%s'",
435415
database);
436-
}
437-
#endif
438416

439417
/*** Create the comments with the pg_database oid ***/
440418

@@ -444,7 +422,6 @@ CommentDatabase(char *database, char *comment)
444422

445423
heap_endscan(scan);
446424
heap_close(pg_database,AccessShareLock);
447-
448425
}
449426

450427
/*------------------------------------------------------------------

‎src/backend/commands/define.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
*
1111
*
1212
* IDENTIFICATION
13-
* $Header: /cvsroot/pgsql/src/backend/commands/define.c,v 1.55 2001/05/18 21:24:18 momjian Exp $
13+
* $Header: /cvsroot/pgsql/src/backend/commands/define.c,v 1.56 2001/06/13 21:44:40 tgl Exp $
1414
*
1515
* DESCRIPTION
1616
* The "DefineFoo" routines take the parse tree and pick out the
@@ -33,21 +33,21 @@
3333
*
3434
*-------------------------------------------------------------------------
3535
*/
36+
#include"postgres.h"
37+
3638
#include<ctype.h>
3739
#include<math.h>
3840

39-
#include"postgres.h"
40-
4141
#include"access/heapam.h"
4242
#include"catalog/catname.h"
4343
#include"catalog/pg_aggregate.h"
4444
#include"catalog/pg_language.h"
4545
#include"catalog/pg_operator.h"
4646
#include"catalog/pg_proc.h"
47-
#include"catalog/pg_shadow.h"
4847
#include"catalog/pg_type.h"
4948
#include"commands/defrem.h"
5049
#include"fmgr.h"
50+
#include"miscadmin.h"
5151
#include"optimizer/cost.h"
5252
#include"parser/parse_expr.h"
5353
#include"tcop/dest.h"

‎src/backend/commands/indexcmds.c

Lines changed: 6 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $Header: /cvsroot/pgsql/src/backend/commands/indexcmds.c,v 1.49 2001/05/31 18:16:55 tgl Exp $
11+
* $Header: /cvsroot/pgsql/src/backend/commands/indexcmds.c,v 1.50 2001/06/13 21:44:40 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -28,7 +28,6 @@
2828
#include"catalog/pg_opclass.h"
2929
#include"catalog/pg_operator.h"
3030
#include"catalog/pg_proc.h"
31-
#include"catalog/pg_shadow.h"
3231
#include"commands/defrem.h"
3332
#include"miscadmin.h"
3433
#include"optimizer/clauses.h"
@@ -712,14 +711,9 @@ ReindexTable(const char *name, bool force)
712711
void
713712
ReindexDatabase(constchar*dbname,boolforce,boolall)
714713
{
715-
Relationrelation,
716-
relationRelation;
717-
HeapTupledbtuple,
718-
tuple;
714+
RelationrelationRelation;
719715
HeapScanDescscan;
720-
int4db_owner;
721-
Oiddb_id;
722-
ScanKeyDatascankey;
716+
HeapTupletuple;
723717
MemoryContextprivate_context;
724718
MemoryContextold;
725719
intrelcnt,
@@ -730,24 +724,12 @@ ReindexDatabase(const char *dbname, bool force, bool all)
730724

731725
AssertArg(dbname);
732726

733-
relation=heap_openr(DatabaseRelationName,AccessShareLock);
734-
ScanKeyEntryInitialize(&scankey,0,Anum_pg_database_datname,
735-
F_NAMEEQ,NameGetDatum(dbname));
736-
scan=heap_beginscan(relation,0,SnapshotNow,1,&scankey);
737-
dbtuple=heap_getnext(scan,0);
738-
if (!HeapTupleIsValid(dbtuple))
739-
elog(ERROR,"Database \"%s\" does not exist",dbname);
740-
db_id=dbtuple->t_data->t_oid;
741-
db_owner= ((Form_pg_database)GETSTRUCT(dbtuple))->datdba;
742-
heap_endscan(scan);
743-
heap_close(relation,NoLock);
727+
if (strcmp(dbname,DatabaseName)!=0)
728+
elog(ERROR,"REINDEX DATABASE: Can be executed only on the currently open database.");
744729

745-
if (GetUserId()!=db_owner&& !superuser())
730+
if (! (superuser()||is_dbadmin(MyDatabaseId)))
746731
elog(ERROR,"REINDEX DATABASE: Permission denied.");
747732

748-
if (db_id!=MyDatabaseId)
749-
elog(ERROR,"REINDEX DATABASE: Can be executed only on the currently open database.");
750-
751733
/*
752734
* We cannot run inside a user transaction block; if we were inside a
753735
* transaction, then our commit- and start-transaction-command calls

‎src/backend/commands/proclang.c

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,20 +3,26 @@
33
* proclang.c
44
* PostgreSQL PROCEDURAL LANGUAGE support code.
55
*
6+
* Portions Copyright (c) 1996-2001, PostgreSQL Global Development Group
7+
* Portions Copyright (c) 1994, Regents of the University of California
8+
*
9+
* IDENTIFICATION
10+
* $Header: /cvsroot/pgsql/src/backend/commands/proclang.c,v 1.28 2001/06/13 21:44:40 tgl Exp $
11+
*
612
*-------------------------------------------------------------------------
713
*/
8-
#include<ctype.h>
9-
1014
#include"postgres.h"
1115

16+
#include<ctype.h>
17+
1218
#include"access/heapam.h"
1319
#include"catalog/catname.h"
1420
#include"catalog/indexing.h"
1521
#include"catalog/pg_language.h"
1622
#include"catalog/pg_proc.h"
17-
#include"catalog/pg_shadow.h"
1823
#include"commands/proclang.h"
1924
#include"fmgr.h"
25+
#include"miscadmin.h"
2026
#include"utils/builtins.h"
2127
#include"utils/syscache.h"
2228

@@ -63,10 +69,8 @@ CreateProceduralLanguage(CreatePLangStmt *stmt)
6369
* Check permission
6470
*/
6571
if (!superuser())
66-
{
6772
elog(ERROR,"Only users with Postgres superuser privilege are "
6873
"permitted to create procedural languages");
69-
}
7074

7175
/*
7276
* Translate the language name and check that this language doesn't
@@ -150,10 +154,8 @@ DropProceduralLanguage(DropPLangStmt *stmt)
150154
* Check permission
151155
*/
152156
if (!superuser())
153-
{
154157
elog(ERROR,"Only users with Postgres superuser privilege are "
155158
"permitted to drop procedural languages");
156-
}
157159

158160
/*
159161
* Translate the language name, check that this language exist and is

‎src/backend/commands/vacuum.c

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $Header: /cvsroot/pgsql/src/backend/commands/vacuum.c,v 1.195 2001/05/25 15:45:32 momjian Exp $
11+
* $Header: /cvsroot/pgsql/src/backend/commands/vacuum.c,v 1.196 2001/06/13 21:44:40 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -437,15 +437,20 @@ vacuum_rel(Oid relid)
437437
/*
438438
* Open the class, get an exclusive lock on it, and check permissions.
439439
*
440+
* We allow the user to vacuum a table if he is superuser, the table
441+
* owner, or the database owner (but in the latter case, only if it's
442+
* not a shared relation). pg_ownercheck includes the superuser case.
443+
*
440444
* Note we choose to treat permissions failure as a NOTICE and keep
441445
* trying to vacuum the rest of the DB --- is this appropriate?
442446
*/
443447
onerel=heap_open(relid,AccessExclusiveLock);
444448

445-
if (!pg_ownercheck(GetUserId(),RelationGetRelationName(onerel),
446-
RELNAME))
449+
if (! (pg_ownercheck(GetUserId(),RelationGetRelationName(onerel),
450+
RELNAME)||
451+
(is_dbadmin(MyDatabaseId)&& !onerel->rd_rel->relisshared)))
447452
{
448-
elog(NOTICE,"Skipping \"%s\" --- only table owner can VACUUM it",
453+
elog(NOTICE,"Skipping \"%s\" --- only tableor databaseowner can VACUUM it",
449454
RelationGetRelationName(onerel));
450455
heap_close(onerel,AccessExclusiveLock);
451456
CommitTransactionCommand();

‎src/backend/libpq/be-fsstubs.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $Header: /cvsroot/pgsql/src/backend/libpq/be-fsstubs.c,v 1.58 2001/03/22 03:59:30 momjian Exp $
11+
* $Header: /cvsroot/pgsql/src/backend/libpq/be-fsstubs.c,v 1.59 2001/06/13 21:44:41 tgl Exp $
1212
*
1313
* NOTES
1414
* This should be moved to a more appropriate place. It is here
@@ -39,9 +39,9 @@
3939
#include<sys/stat.h>
4040
#include<unistd.h>
4141

42-
#include"catalog/pg_shadow.h"
4342
#include"libpq/be-fsstubs.h"
4443
#include"libpq/libpq-fs.h"
44+
#include"miscadmin.h"
4545
#include"storage/large_object.h"
4646
#include"utils/memutils.h"
4747

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp