Commit94cd0f1

committed

Do not treat a superuser as a member of every role for HBA purposes.

This makes it possible to use reject lines with group roles.Andrew Dunstan, reviewd by Robert Haas.

1 parent3b06105 commit94cd0f1Copy full SHA for 94cd0f1

File tree

+11

-3

lines changed

+11

-3

lines changed

Lines changed: 4 additions & 1 deletion

Original file line number	Diff line number	Diff line change
`@@ -210,7 +210,10 @@ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>`
`210`	`210`	`in <productname>PostgreSQL</>; a <literal>+</> mark really means`
`211`	`211`	`<quote>match any of the roles that are directly or indirectly members`
`212`	`212`	`of this role</>, while a name without a <literal>+</> mark matches`
`213`		`- only that specific role.)`
	`213`	`+ only that specific role.) For this purpose, a superuser is only`
	`214`	`+ considered to be a member of a role if they are explicitly a member`
	`215`	`+ of the role, directly or indirectly, and not just by virtue of`
	`216`	`+ being a superuser.`
`214`	`217`	`Multiple user names can be supplied by separating them with commas.`
`215`	`218`	`A separate file containing user names can be specified by preceding the`
`216`	`219`	`file name with <literal>@</>.`

Lines changed: 7 additions & 2 deletions

Original file line number	Diff line number	Diff line change
`@@ -442,8 +442,13 @@ is_member(Oid userid, const char *role)`
`442`	`442`	`if (!OidIsValid(roleid))`
`443`	`443`	`return false;/* if target role not exist, say "no" */`
`444`	`444`
`445`		`-/* See if user is directly or indirectly a member of role */`
`446`		`-returnis_member_of_role(userid,roleid);`
	`445`	`+/*`
	`446`	`+ * See if user is directly or indirectly a member of role.`
	`447`	`+ * For this purpose, a superuser is not considered to be automatically`
	`448`	`+ * a member of the role, so group auth only applies to explicit`
	`449`	`+ * membership.`
	`450`	`+ */`
	`451`	`+returnis_member_of_role_nosuper(userid,roleid);`
`447`	`452`	`}`
`448`	`453`
`449`	`454`	`/*`

Comments

(0)