database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-12-19 17:02:53 +03:00
Code Activity

Extend ALTER DEFAULT PRIVILEGES to define default privileges for large objects.

Browse Source 
Previously, ALTER DEFAULT PRIVILEGES did not support large objects.
This meant that to grant privileges to users other than the owner,
permissions had to be manually assigned each time a large object
was created, which was inconvenient.

This commit extends ALTER DEFAULT PRIVILEGES to allow defining default
access privileges for large objects. With this change, specified privileges
will automatically apply to newly created large objects, making privilege
management more efficient.

As a side effect, this commit introduces the new keyword OBJECTS
since it's used in the syntax of ALTER DEFAULT PRIVILEGES.

Original patch by Haruka Takatsuka, with some fixes and tests by Yugo Nagata,
and rebased by Laurenz Albe.

Author: Takatsuka Haruka <harukat@sraoss.co.jp>
Co-authored-by: Yugo Nagata <nagata@sraoss.co.jp>
Co-authored-by: Laurenz Albe <laurenz.albe@cybertec.at>
Reviewed-by: Masao Fujii <masao.fujii@gmail.com>
Discussion: https://postgr.es/m/20240424115242.236b499b2bed5b7a27f7a418@sraoss.co.jp
This commit is contained in:
Fujii Masao
2025-04-04 19:02:17 +09:00
parent 6e9c81836e
commit 0d6c477664
14 changed files with 217 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

94
src/test/regress/expected/privileges.out
View File

@@ -2667,11 +2667,103 @@ SELECT has_schema_privilege('regress_priv_user2', 'testns4', 'CREATE'); -- yes
ALTER DEFAULT PRIVILEGES REVOKE ALL ON SCHEMAS FROM regress_priv_user2;
COMMIT;
--
-- Test for default privileges on large objects. This is done in a
-- separate, rollbacked, transaction to avoid any trouble with other
-- regression sessions.
--
BEGIN;
SELECT lo_create(1007);
lo_create
-----------
1007
(1 row)
SELECT has_largeobject_privilege('regress_priv_user2', 1007, 'SELECT'); -- no
has_largeobject_privilege
---------------------------
f
(1 row)
SELECT has_largeobject_privilege('regress_priv_user2', 1007, 'UPDATE'); -- no
has_largeobject_privilege
---------------------------
f
(1 row)
ALTER DEFAULT PRIVILEGES GRANT SELECT ON LARGE OBJECTS TO regress_priv_user2;
SELECT lo_create(1008);
lo_create
-----------
1008
(1 row)
SELECT has_largeobject_privilege('regress_priv_user2', 1008, 'SELECT'); -- yes
has_largeobject_privilege
---------------------------
t
(1 row)
SELECT has_largeobject_privilege('regress_priv_user6', 1008, 'SELECT'); -- no
has_largeobject_privilege
---------------------------
f
(1 row)
SELECT has_largeobject_privilege('regress_priv_user2', 1008, 'UPDATE'); -- no
has_largeobject_privilege
---------------------------
f
(1 row)
ALTER DEFAULT PRIVILEGES GRANT ALL ON LARGE OBJECTS TO regress_priv_user2;
SELECT lo_create(1009);
lo_create
-----------
1009
(1 row)
SELECT has_largeobject_privilege('regress_priv_user2', 1009, 'SELECT'); -- true
has_largeobject_privilege
---------------------------
t
(1 row)
SELECT has_largeobject_privilege('regress_priv_user2', 1009, 'UPDATE'); -- true
has_largeobject_privilege
---------------------------
t
(1 row)
ALTER DEFAULT PRIVILEGES REVOKE UPDATE ON LARGE OBJECTS FROM regress_priv_user2;
SELECT lo_create(1010);
lo_create
-----------
1010
(1 row)
SELECT has_largeobject_privilege('regress_priv_user2', 1010, 'SELECT'); -- true
has_largeobject_privilege
---------------------------
t
(1 row)
SELECT has_largeobject_privilege('regress_priv_user2', 1010, 'UPDATE'); -- false
has_largeobject_privilege
---------------------------
f
(1 row)
ROLLBACK;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON LARGE OBJECTS TO public; -- error
ERROR: cannot use IN SCHEMA clause when using GRANT/REVOKE ON LARGE OBJECTS
\c -
-- Test for DROP OWNED BY with shared dependencies. This is done in a
-- separate, rollbacked, transaction to avoid any trouble with other
-- regression sessions.
BEGIN;
ALTER DEFAULT PRIVILEGES GRANT ALL ON FUNCTIONS TO regress_priv_user2;
ALTER DEFAULT PRIVILEGES GRANT ALL ON LARGE OBJECTS TO regress_priv_user2;
ALTER DEFAULT PRIVILEGES GRANT ALL ON SCHEMAS TO regress_priv_user2;
ALTER DEFAULT PRIVILEGES GRANT ALL ON SEQUENCES TO regress_priv_user2;
ALTER DEFAULT PRIVILEGES GRANT ALL ON TABLES TO regress_priv_user2;
@@ -2682,7 +2774,7 @@ SELECT count(*) FROM pg_shdepend
classid = 'pg_default_acl'::regclass;
count
-------
5
6
(1 row)
DROP OWNED BY regress_priv_user2, regress_priv_user2;

36
src/test/regress/sql/privileges.sql
View File

@@ -1586,11 +1586,47 @@ ALTER DEFAULT PRIVILEGES REVOKE ALL ON SCHEMAS FROM regress_priv_user2;
COMMIT;
--
-- Test for default privileges on large objects. This is done in a
-- separate, rollbacked, transaction to avoid any trouble with other
-- regression sessions.
--
BEGIN;
SELECT lo_create(1007);
SELECT has_largeobject_privilege('regress_priv_user2', 1007, 'SELECT'); -- no
SELECT has_largeobject_privilege('regress_priv_user2', 1007, 'UPDATE'); -- no
ALTER DEFAULT PRIVILEGES GRANT SELECT ON LARGE OBJECTS TO regress_priv_user2;
SELECT lo_create(1008);
SELECT has_largeobject_privilege('regress_priv_user2', 1008, 'SELECT'); -- yes
SELECT has_largeobject_privilege('regress_priv_user6', 1008, 'SELECT'); -- no
SELECT has_largeobject_privilege('regress_priv_user2', 1008, 'UPDATE'); -- no
ALTER DEFAULT PRIVILEGES GRANT ALL ON LARGE OBJECTS TO regress_priv_user2;
SELECT lo_create(1009);
SELECT has_largeobject_privilege('regress_priv_user2', 1009, 'SELECT'); -- true
SELECT has_largeobject_privilege('regress_priv_user2', 1009, 'UPDATE'); -- true
ALTER DEFAULT PRIVILEGES REVOKE UPDATE ON LARGE OBJECTS FROM regress_priv_user2;
SELECT lo_create(1010);
SELECT has_largeobject_privilege('regress_priv_user2', 1010, 'SELECT'); -- true
SELECT has_largeobject_privilege('regress_priv_user2', 1010, 'UPDATE'); -- false
ROLLBACK;
ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON LARGE OBJECTS TO public; -- error
\c -
-- Test for DROP OWNED BY with shared dependencies. This is done in a
-- separate, rollbacked, transaction to avoid any trouble with other
-- regression sessions.
BEGIN;
ALTER DEFAULT PRIVILEGES GRANT ALL ON FUNCTIONS TO regress_priv_user2;
ALTER DEFAULT PRIVILEGES GRANT ALL ON LARGE OBJECTS TO regress_priv_user2;
ALTER DEFAULT PRIVILEGES GRANT ALL ON SCHEMAS TO regress_priv_user2;
ALTER DEFAULT PRIVILEGES GRANT ALL ON SEQUENCES TO regress_priv_user2;
ALTER DEFAULT PRIVILEGES GRANT ALL ON TABLES TO regress_priv_user2;