database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Ignore tablespace ACLs when ignoring schema ACLs.

Browse Source 
The ALTER TABLE ALTER TYPE implementation can issue DROP INDEX and
CREATE INDEX to refit existing indexes for the new column type.  Since
this CREATE INDEX is an implementation detail of an index alteration,
the ensuing DefineIndex() should skip ACL checks specific to index
creation.  It already skips the namespace ACL check.  Make it skip the
tablespace ACL check, too.  Back-patch to 9.2 (all supported versions).

Reviewed by Tom Lane.
This commit is contained in:
Noah Misch
2017-02-12 16:03:41 -05:00
parent 86ef376bbe
commit 804aad8ff4
3 changed files with 20 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/backend/commands/indexcmds.c
View File

@ -285,8 +285,8 @@ CheckIndexCompatible(Oid oldId,
* 'indexRelationId': normally InvalidOid, but during bootstrap can be
* nonzero to specify a preselected OID for the index.
* 'is_alter_table': this is due to an ALTER rather than a CREATE operation.
* 'check_rights': check for CREATE rights in the namespace. (This should
* be true except when ALTER is deleting/recreating an index.)
* 'check_rights': check for CREATE rights in namespace and tablespace. (This
* should be true except when ALTER is deleting/recreating an index.)
* 'skip_build': make the catalog entries but leave the index file empty;
* it will be filled later.
* 'quiet': suppress the NOTICE chatter ordinarily provided for constraints.
@ -420,8 +420,9 @@ DefineIndex(Oid relationId,
/* note InvalidOid is OK in this case */
}
/* Check permissions except when using database's default */
if (OidIsValid(tablespaceId) && tablespaceId != MyDatabaseTableSpace)
/* Check tablespace permissions */
if (check_rights &&
OidIsValid(tablespaceId) && tablespaceId != MyDatabaseTableSpace)
{
AclResult aclresult;

7
src/test/regress/input/tablespace.source
View File

@ -97,11 +97,18 @@ DROP TABLESPACE testspace;
CREATE ROLE tablespace_testuser1 login;
CREATE ROLE tablespace_testuser2 login;
GRANT USAGE ON SCHEMA testschema TO tablespace_testuser2;
ALTER TABLESPACE testspace OWNER TO tablespace_testuser1;
CREATE TABLE testschema.tablespace_acl (c int);
-- new owner lacks permission to create this index from scratch
CREATE INDEX k ON testschema.tablespace_acl (c) TABLESPACE testspace;
ALTER TABLE testschema.tablespace_acl OWNER TO tablespace_testuser2;
SET SESSION ROLE tablespace_testuser2;
CREATE TABLE tablespace_table (i int) TABLESPACE testspace; -- fail
ALTER TABLE testschema.tablespace_acl ALTER c TYPE bigint;
RESET ROLE;
ALTER TABLESPACE testspace RENAME TO testspace_renamed;

9
src/test/regress/output/tablespace.source
View File

@ -192,10 +192,16 @@ DROP TABLESPACE testspace;
ERROR: tablespace "testspace" is not empty
CREATE ROLE tablespace_testuser1 login;
CREATE ROLE tablespace_testuser2 login;
GRANT USAGE ON SCHEMA testschema TO tablespace_testuser2;
ALTER TABLESPACE testspace OWNER TO tablespace_testuser1;
CREATE TABLE testschema.tablespace_acl (c int);
-- new owner lacks permission to create this index from scratch
CREATE INDEX k ON testschema.tablespace_acl (c) TABLESPACE testspace;
ALTER TABLE testschema.tablespace_acl OWNER TO tablespace_testuser2;
SET SESSION ROLE tablespace_testuser2;
CREATE TABLE tablespace_table (i int) TABLESPACE testspace; -- fail
ERROR: permission denied for tablespace testspace
ALTER TABLE testschema.tablespace_acl ALTER c TYPE bigint;
RESET ROLE;
ALTER TABLESPACE testspace RENAME TO testspace_renamed;
ALTER TABLE ALL IN TABLESPACE testspace_renamed SET TABLESPACE pg_default;
@ -206,10 +212,11 @@ NOTICE: no matching relations in tablespace "testspace_renamed" found
-- Should succeed
DROP TABLESPACE testspace_renamed;
DROP SCHEMA testschema CASCADE;
NOTICE: drop cascades to 4 other objects
NOTICE: drop cascades to 5 other objects
DETAIL: drop cascades to table testschema.foo
drop cascades to table testschema.asselect
drop cascades to table testschema.asexecute
drop cascades to table testschema.atable
drop cascades to table testschema.tablespace_acl
DROP ROLE tablespace_testuser1;
DROP ROLE tablespace_testuser2;