From 57f59ca1d954f2de7ac3ef8971046778c955613a Mon Sep 17 00:00:00 2001 From: Nathan Bossart Date: Mon, 10 Aug 2026 06:38:12 -0700 Subject: [PATCH] Check for USAGE privilege on the composite type in ALTER TABLE OF. This omission allowed roles without USAGE on a type to create tables that depend on it, which could prevent the owner from changing the type later. Reported-by: Nathan Bossart Author: Nathan Bossart Reviewed-by: Robert Haas Security: CVE-2026-6470 Backpatch-through: 14 --- src/backend/commands/tablecmds.c | 5 +++++ src/test/regress/expected/privileges.out | 6 ++++++ src/test/regress/sql/privileges.sql | 5 +++++ 3 files changed, 16 insertions(+) diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c index 499f8f18945..ca6e5edabef 100644 --- a/src/backend/commands/tablecmds.c +++ b/src/backend/commands/tablecmds.c @@ -18272,6 +18272,7 @@ ATExecAddOf(Relation rel, const TypeName *ofTypename, LOCKMODE lockmode) ObjectAddress tableobj, typeobj; HeapTuple classtuple; + AclResult aclresult; /* Validate the type. */ typetuple = typenameType(NULL, ofTypename, NULL); @@ -18279,6 +18280,10 @@ ATExecAddOf(Relation rel, const TypeName *ofTypename, LOCKMODE lockmode) typeform = (Form_pg_type) GETSTRUCT(typetuple); typeid = typeform->oid; + aclresult = object_aclcheck(TypeRelationId, typeid, GetUserId(), ACL_USAGE); + if (aclresult != ACLCHECK_OK) + aclcheck_error_type(aclresult, typeid); + /* Fail if the table has any inheritance parents. */ inheritsRelation = table_open(InheritsRelationId, AccessShareLock); ScanKeyInit(&key, diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index b925f4aa086..b85cb2acdd6 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -1388,6 +1388,9 @@ CREATE TABLE test5a (a int, b priv_testdomain1); ERROR: permission denied for type priv_testdomain1 CREATE TABLE test6a OF priv_testtype1; ERROR: permission denied for type priv_testtype1 +CREATE TABLE test6a2 (a int, b text); +ALTER TABLE test6a2 OF priv_testtype1; +ERROR: permission denied for type priv_testtype1 CREATE TABLE test10a (a int[], b priv_testtype1[]); ERROR: permission denied for type priv_testtype1 CREATE TABLE test9a (a int, b int); @@ -1435,6 +1438,8 @@ CREATE FUNCTION priv_testfunc7b(a int DEFAULT ('(0,1)'::priv_testtype1).a) RETUR CREATE OPERATOR !! (PROCEDURE = priv_testfunc5b, RIGHTARG = priv_testdomain1); CREATE TABLE test5b (a int, b priv_testdomain1); CREATE TABLE test6b OF priv_testtype1; +CREATE TABLE test6b2 (a int, b text); +ALTER TABLE test6b2 OF priv_testtype1; CREATE TABLE test10b (a int[], b priv_testtype1[]); CREATE TABLE test9b (a int, b int); ALTER TABLE test9b ADD COLUMN c priv_testdomain1; @@ -1476,6 +1481,7 @@ DROP FUNCTION priv_testfunc6b(b int); DROP FUNCTION priv_testfunc7b(a int); DROP TABLE test5b; DROP TABLE test6b; +DROP TABLE test6b2; DROP TABLE test9b; DROP TABLE test10b; DROP TYPE test7b; diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql index db6e2115d9f..88f9efbb750 100644 --- a/src/test/regress/sql/privileges.sql +++ b/src/test/regress/sql/privileges.sql @@ -951,6 +951,8 @@ CREATE OPERATOR !+! (PROCEDURE = int4pl, LEFTARG = priv_testdomain1, RIGHTARG = CREATE TABLE test5a (a int, b priv_testdomain1); CREATE TABLE test6a OF priv_testtype1; +CREATE TABLE test6a2 (a int, b text); +ALTER TABLE test6a2 OF priv_testtype1; CREATE TABLE test10a (a int[], b priv_testtype1[]); CREATE TABLE test9a (a int, b int); @@ -999,6 +1001,8 @@ CREATE OPERATOR !! (PROCEDURE = priv_testfunc5b, RIGHTARG = priv_testdomain1); CREATE TABLE test5b (a int, b priv_testdomain1); CREATE TABLE test6b OF priv_testtype1; +CREATE TABLE test6b2 (a int, b text); +ALTER TABLE test6b2 OF priv_testtype1; CREATE TABLE test10b (a int[], b priv_testtype1[]); CREATE TABLE test9b (a int, b int); @@ -1046,6 +1050,7 @@ DROP FUNCTION priv_testfunc6b(b int); DROP FUNCTION priv_testfunc7b(a int); DROP TABLE test5b; DROP TABLE test6b; +DROP TABLE test6b2; DROP TABLE test9b; DROP TABLE test10b; DROP TYPE test7b;