database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-03 22:24:49 +03:00
Code

Ensure locks are acquired on RLS-added relations

Browse Source 
During fireRIRrules(), get_row_security_policies can add to
securityQuals and withCheckOptions.  Make sure to lock any relations
added at that point and before firing RIR rules on those expressions.

Back-patch to 9.5 where RLS was added.
This commit is contained in:
Stephen Frost 2015-08-28 11:39:43 -04:00
parent aed688eb73
commit d03f3314b3
1 changed files with 19 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
src/backend/rewrite/rewriteHandler.c
View File

@ -1787,6 +1787,8 @@ fireRIRrules(Query *parsetree, List *activeRIRs, bool forUpdatePushedDown)
{ {
if (hasSubLinks) if (hasSubLinks)
{ {
acquireLocksOnSubLinks_context context;
/* /*
* Recursively process the new quals, checking for infinite * Recursively process the new quals, checking for infinite
* recursion. * recursion.
@ -1799,6 +1801,23 @@ fireRIRrules(Query *parsetree, List *activeRIRs, bool forUpdatePushedDown)
activeRIRs = lcons_oid(RelationGetRelid(rel), activeRIRs); activeRIRs = lcons_oid(RelationGetRelid(rel), activeRIRs);
/*
* get_row_security_policies just passed back securityQuals
* and/or withCheckOptions, and there were SubLinks, make sure
* we lock any relations which are referenced.
*
* These locks would normally be acquired by the parser, but
* securityQuals and withCheckOptions are added post-parsing.
*/
context.for_execute = true;
(void) acquireLocksOnSubLinks((Node *) securityQuals, &context);
(void) acquireLocksOnSubLinks((Node *) withCheckOptions,
&context);
/*
* Now that we have the locks on anything added by
* get_row_security_policies, fire any RIR rules for them.
*/
expression_tree_walker((Node *) securityQuals, expression_tree_walker((Node *) securityQuals,
fireRIRonSubLink, (void *) activeRIRs); fireRIRonSubLink, (void *) activeRIRs);