database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2026-10-23 13:29:09 +03:00
Code Activity

Prohibit GRANT ... ON TABLE on a property graph

Browse Source 
We allowed GRANT ... ON TABLE on sequences for backward compatibility.
We don't need to consider backward compatibility in case of property
graphs since we will be prohibiting its usage on property graph from
the very release which introduced property graphs.

Change regression tests that used GRANT ... ON [TABLE] on property
graphs to use GRANT ... ON PROPERTY GRAPH instead.

While here, add the missing RELKIND_PROPGRAPH cases in
pg_class_aclmask_ext() and in the object-type switch in
ExecGrant_Relation() so that the default ACL and the objtype passed to
restrict_and_check_grant() are correct.

Author: Ashutosh Bapat <ashutosh.bapat.oss@gmail.com>
Reviewed-by: Noah Misch <noah@leadboat.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://www.postgresql.org/message-id/20260630023308.c7.noahmisch@microsoft.com
This commit is contained in:
Peter Eisentraut
2026-08-04 09:55:03 +02:00
parent 8380013cd2
commit 4054ec5b4f
7 changed files with 33 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/backend/catalog/aclchk.c
View File

@@ -1784,7 +1784,7 @@ ExecGrant_Attribute(InternalGrant *istmt, Oid relOid, const char *relname,
}
/*
* This processes both sequences and non-sequences.
* This processes all pg_class entries including sequences and property graphs.
*/
static void
ExecGrant_Relation(InternalGrant *istmt)
@@ -1891,6 +1891,18 @@ ExecGrant_Relation(InternalGrant *istmt)
this_privileges &= (AclMode) ACL_ALL_RIGHTS_SEQUENCE;
}
}
else if (pg_class_tuple->relkind == RELKIND_PROPGRAPH)
{
/*
* Do not allow GRANT ... TABLE on property graph. We allowed
* it on sequences for backward compatibility but there is no
* reason to continue that further.
*/
ereport(ERROR,
errcode(ERRCODE_WRONG_OBJECT_TYPE),
errmsg("\"%s\" is a property graph", NameStr(pg_class_tuple->relname)),
errhint("Use GRANT ... ON PROPERTY GRAPH instead."));
}
else
{
if (this_privileges & ~((AclMode) ACL_ALL_RIGHTS_RELATION))
@@ -1996,6 +2008,9 @@ ExecGrant_Relation(InternalGrant *istmt)
case RELKIND_SEQUENCE:
objtype = OBJECT_SEQUENCE;
break;
case RELKIND_PROPGRAPH:
objtype = OBJECT_PROPGRAPH;
break;
default:
objtype = OBJECT_TABLE;
break;
@@ -3375,6 +3390,9 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask,
case RELKIND_SEQUENCE:
acl = acldefault(OBJECT_SEQUENCE, ownerId);
break;
case RELKIND_PROPGRAPH:
acl = acldefault(OBJECT_PROPGRAPH, ownerId);
break;
default:
acl = acldefault(OBJECT_TABLE, ownerId);
break;

3
src/test/regress/expected/create_property_graph.out
View File

@@ -236,6 +236,9 @@ SET ROLE regress_graph_user1;
GRANT SELECT ON PROPERTY GRAPH g1 TO regress_graph_user2;
GRANT UPDATE ON PROPERTY GRAPH g1 TO regress_graph_user2; -- fail
ERROR: invalid privilege type UPDATE for property graph
GRANT UPDATE ON TABLE g1 TO regress_graph_user2; -- fail
ERROR: "g1" is a property graph
HINT: Use GRANT ... ON PROPERTY GRAPH instead.
RESET ROLE;
-- collation
CREATE TABLE tc1 (a int, b text);

6
src/test/regress/expected/graph_table_rls.out
View File

@@ -74,7 +74,7 @@ CREATE PROPERTY GRAPH cabinet
EDGE TABLES (accessed KEY (aid)
SOURCE KEY (uid) REFERENCES users (uid)
DESTINATION KEY (did) REFERENCES document (did));
GRANT SELECT ON cabinet TO public;
GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
--
-- Basic RLS tests
--
@@ -261,7 +261,7 @@ CREATE PROPERTY GRAPH cabinet
EDGE TABLES (accessed KEY (aid)
SOURCE KEY (uid) REFERENCES users (uid)
DESTINATION KEY (did) REFERENCES document (did));
GRANT SELECT ON cabinet TO public;
GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
SET row_security TO ON;
-- viewpoint from regress_graph_rls_bob
SET SESSION AUTHORIZATION regress_graph_rls_bob;
@@ -456,7 +456,7 @@ CREATE PROPERTY GRAPH cabinet
EDGE TABLES (accessed KEY (aid)
SOURCE KEY (uid) REFERENCES users (uid)
DESTINATION KEY (did) REFERENCES document (did));
GRANT SELECT ON cabinet TO public;
GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
SET row_security TO ON;
-- viewpoint from regress_graph_rls_bob
SET SESSION AUTHORIZATION regress_graph_rls_bob;

4
src/test/regress/expected/privileges.out
View File

@@ -3206,7 +3206,7 @@ select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0;
-------
(0 rows)
grant select on ptg1 to regress_priv_user2;
grant select on property graph ptg1 to regress_priv_user2;
set session role regress_priv_user2;
select * from graph_table (ptg1 match (is atest1) COLUMNS (1 as value)) limit 0; -- ok
value
@@ -3232,7 +3232,7 @@ select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; --
-------
(0 rows)
grant select on ptg1 to regress_priv_user4;
grant select on property graph ptg1 to regress_priv_user4;
set session role regress_priv_user4;
select * from graph_table (ptg1 match (a is atest5) COLUMNS (a.four)) limit 0; -- ok
four

1
src/test/regress/sql/create_property_graph.sql
View File

@@ -184,6 +184,7 @@ ALTER PROPERTY GRAPH g1 OWNER TO regress_graph_user1;
SET ROLE regress_graph_user1;
GRANT SELECT ON PROPERTY GRAPH g1 TO regress_graph_user2;
GRANT UPDATE ON PROPERTY GRAPH g1 TO regress_graph_user2; -- fail
GRANT UPDATE ON TABLE g1 TO regress_graph_user2; -- fail
RESET ROLE;
-- collation

6
src/test/regress/sql/graph_table_rls.sql
View File

@@ -87,7 +87,7 @@ CREATE PROPERTY GRAPH cabinet
EDGE TABLES (accessed KEY (aid)
SOURCE KEY (uid) REFERENCES users (uid)
DESTINATION KEY (did) REFERENCES document (did));
GRANT SELECT ON cabinet TO public;
GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
--
-- Basic RLS tests
@@ -198,7 +198,7 @@ CREATE PROPERTY GRAPH cabinet
EDGE TABLES (accessed KEY (aid)
SOURCE KEY (uid) REFERENCES users (uid)
DESTINATION KEY (did) REFERENCES document (did));
GRANT SELECT ON cabinet TO public;
GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
SET row_security TO ON;
@@ -267,7 +267,7 @@ CREATE PROPERTY GRAPH cabinet
EDGE TABLES (accessed KEY (aid)
SOURCE KEY (uid) REFERENCES users (uid)
DESTINATION KEY (did) REFERENCES document (did));
GRANT SELECT ON cabinet TO public;
GRANT SELECT ON PROPERTY GRAPH cabinet TO public;
SET row_security TO ON;
-- viewpoint from regress_graph_rls_bob

4
src/test/regress/sql/privileges.sql
View File

@@ -1890,7 +1890,7 @@ create property graph ptg1
label ltv properties (col1 as ltvk));
-- select privileges on property graph as well as table
select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0; -- ok
grant select on ptg1 to regress_priv_user2;
grant select on property graph ptg1 to regress_priv_user2;
set session role regress_priv_user2;
select * from graph_table (ptg1 match (is atest1) COLUMNS (1 as value)) limit 0; -- ok
-- select privileges on property graph but not table
@@ -1904,7 +1904,7 @@ select * from graph_table (ptg1 match (is atest5) COLUMNS (1 as value)) limit 0;
-- column privileges
set session role regress_priv_user1;
select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; -- ok
grant select on ptg1 to regress_priv_user4;
grant select on property graph ptg1 to regress_priv_user4;
set session role regress_priv_user4;
select * from graph_table (ptg1 match (a is atest5) COLUMNS (a.four)) limit 0; -- ok
select * from graph_table (ptg1 match (v is lttc) COLUMNS (v.lttck)) limit 0; -- fail