Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitfa26424

Browse files
committed
Allow LOCK TABLE .. ROW EXCLUSIVE MODE with INSERT
INSERT acquires RowExclusiveLock during normal operation and thereforeit makes sense to allow LOCK TABLE .. ROW EXCLUSIVE MODE to be executedby users who have INSERT rights on a table (even if they don't haveUPDATE or DELETE).Not back-patching this as it's a behavior change which, strictlyspeaking, loosens security restrictions.Per discussion with Tom and Robert (circa 2013).
1 parent9d15292 commitfa26424

File tree

2 files changed

+13
-7
lines changed

2 files changed

+13
-7
lines changed

‎doc/src/sgml/ref/lock.sgml

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -161,9 +161,11 @@ LOCK [ TABLE ] [ ONLY ] <replaceable class="PARAMETER">name</replaceable> [ * ]
161161

162162
<para>
163163
<literal>LOCK TABLE ... IN ACCESS SHARE MODE</> requires <literal>SELECT</>
164-
privileges on the target table. All other forms of <command>LOCK</>
165-
require table-level <literal>UPDATE</>, <literal>DELETE</>, or
166-
<literal>TRUNCATE</> privileges.
164+
privileges on the target table. <literal>LOCK TABLE ... IN ROW EXCLUSIVE
165+
MODE</> requires <literal>INSERT</>, <literal>UPDATE</>, <literal>DELETE</>,
166+
or <literal>TRUNCATE</> privileges on the target table. All other forms of
167+
<command>LOCK</> require table-level <literal>UPDATE</>, <literal>DELETE</>,
168+
or <literal>TRUNCATE</> privileges.
167169
</para>
168170

169171
<para>

‎src/backend/commands/lockcmds.c

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -169,13 +169,17 @@ static AclResult
169169
LockTableAclCheck(Oidreloid,LOCKMODElockmode)
170170
{
171171
AclResultaclresult;
172+
AclModeaclmask;
172173

173174
/* Verify adequate privilege */
174175
if (lockmode==AccessShareLock)
175-
aclresult=pg_class_aclcheck(reloid,GetUserId(),
176-
ACL_SELECT);
176+
aclmask=ACL_SELECT;
177+
elseif (lockmode==RowExclusiveLock)
178+
aclmask=ACL_INSERT |ACL_UPDATE |ACL_DELETE |ACL_TRUNCATE;
177179
else
178-
aclresult=pg_class_aclcheck(reloid,GetUserId(),
179-
ACL_UPDATE |ACL_DELETE |ACL_TRUNCATE);
180+
aclmask=ACL_UPDATE |ACL_DELETE |ACL_TRUNCATE;
181+
182+
aclresult=pg_class_aclcheck(reloid,GetUserId(),aclmask);
183+
180184
returnaclresult;
181185
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp