database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-09-02 04:21:28 +03:00
Code Activity

Extend pg_get_acl() to handle sub-object IDs

Browse Source 
This patch modifies the pg_get_acl() function to accept a third argument
called "objsubid", bringing it on par with similar functions in this
area like pg_describe_object().  This enables the retrieval of ACLs for
relation attributes when scanning dependencies.

Bump catalog version.

Author: Joel Jacobson
Discussion: https://postgr.es/m/f2539bff-64be-47f0-9f0b-df85d3cc0432@app.fastmail.com
This commit is contained in:
Michael Paquier
2024-07-10 10:14:37 +09:00
parent f7bd0a381d
commit d898665bf7
6 changed files with 75 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
doc/src/sgml/func.sgml
View File

@@ -26661,12 +26661,12 @@ SELECT currval(pg_get_serial_sequence('sometable', 'id'));
<indexterm> <indexterm>
<primary>pg_get_acl</primary> <primary>pg_get_acl</primary>
</indexterm> </indexterm>
<function>pg_get_acl</function> ( <parameter>classid</parameter> <type>oid</type>, <parameter>objid</parameter> <type>oid</type> ) <function>pg_get_acl</function> ( <parameter>classid</parameter> <type>oid</type>, <parameter>objid</parameter> <type>oid</type>, <parameter>objsubid</parameter> <type>integer</type> )
<returnvalue>aclitem[]</returnvalue> <returnvalue>aclitem[]</returnvalue>
</para> </para>
<para> <para>
Returns the <acronym>ACL</acronym> for a database object, specified Returns the <acronym>ACL</acronym> for a database object, specified
by catalog OID and object OID. This function returns by catalog OID, object OID and sub-object ID. This function returns
<literal>NULL</literal> values for undefined objects. <literal>NULL</literal> values for undefined objects.
</para></entry> </para></entry>
</row> </row>
@@ -26792,7 +26792,7 @@ SELECT currval(pg_get_serial_sequence('sometable', 'id'));
<programlisting> <programlisting>
postgres=# SELECT postgres=# SELECT
(pg_identify_object(s.classid,s.objid,s.objsubid)).*, (pg_identify_object(s.classid,s.objid,s.objsubid)).*,
pg_catalog.pg_get_acl(s.classid,s.objid) AS acl pg_catalog.pg_get_acl(s.classid,s.objid,s.objsubid) AS acl
FROM pg_catalog.pg_shdepend AS s FROM pg_catalog.pg_shdepend AS s
JOIN pg_catalog.pg_database AS d JOIN pg_catalog.pg_database AS d
ON d.datname = current_database() AND ON d.datname = current_database() AND

47
src/backend/catalog/objectaddress.c
View File

@@ -4364,19 +4364,19 @@ pg_identify_object_as_address(PG_FUNCTION_ARGS)
/* /*
* SQL-level callable function to obtain the ACL of a specified object, given * SQL-level callable function to obtain the ACL of a specified object, given
* its catalog OID and object OID. * its catalog OID, object OID and sub-object ID.
*/ */
Datum Datum
pg_get_acl(PG_FUNCTION_ARGS) pg_get_acl(PG_FUNCTION_ARGS)
{ {
Oid classId = PG_GETARG_OID(0); Oid classId = PG_GETARG_OID(0);
Oid objectId = PG_GETARG_OID(1); Oid objectId = PG_GETARG_OID(1);
int32 objsubid = PG_GETARG_INT32(2);
Oid catalogId; Oid catalogId;
AttrNumber Anum_acl; AttrNumber Anum_acl;
Relation rel;
HeapTuple tup;
Datum datum; Datum datum;
bool isnull; bool isnull;
HeapTuple tup;
/* for "pinned" items in pg_depend, return null */ /* for "pinned" items in pg_depend, return null */
if (!OidIsValid(classId) && !OidIsValid(objectId)) if (!OidIsValid(classId) && !OidIsValid(objectId))
@@ -4391,18 +4391,39 @@ pg_get_acl(PG_FUNCTION_ARGS)
if (Anum_acl == InvalidAttrNumber) if (Anum_acl == InvalidAttrNumber)
PG_RETURN_NULL(); PG_RETURN_NULL();
rel = table_open(catalogId, AccessShareLock); /*
* If dealing with a relation's attribute (objsubid is set), the ACL is
tup = get_catalog_object_by_oid(rel, get_object_attnum_oid(catalogId), * retrieved from pg_attribute.
objectId); */
if (!HeapTupleIsValid(tup)) if (classId == RelationRelationId && objsubid != 0)
{ {
table_close(rel, AccessShareLock); AttrNumber attnum = (AttrNumber) objsubid;
PG_RETURN_NULL();
}
datum = heap_getattr(tup, Anum_acl, RelationGetDescr(rel), &isnull); tup = SearchSysCacheCopyAttNum(objectId, attnum);
table_close(rel, AccessShareLock);
if (!HeapTupleIsValid(tup))
PG_RETURN_NULL();
datum = SysCacheGetAttr(ATTNUM, tup, Anum_pg_attribute_attacl,
&isnull);
}
else
{
Relation rel;
rel = table_open(catalogId, AccessShareLock);
tup = get_catalog_object_by_oid(rel, get_object_attnum_oid(catalogId),
objectId);
if (!HeapTupleIsValid(tup))
{
table_close(rel, AccessShareLock);
PG_RETURN_NULL();
}
datum = heap_getattr(tup, Anum_acl, RelationGetDescr(rel), &isnull);
table_close(rel, AccessShareLock);
}
if (isnull) if (isnull)
PG_RETURN_NULL(); PG_RETURN_NULL();

2
src/include/catalog/catversion.h
View File

@@ -57,6 +57,6 @@
*/ */
/* yyyymmddN */ /* yyyymmddN */
#define CATALOG_VERSION_NO 202407091 #define CATALOG_VERSION_NO 202407101
#endif #endif

2
src/include/catalog/pg_proc.dat
View File

@@ -6364,7 +6364,7 @@
{ oid => '8730', descr => 'get ACL for SQL object', { oid => '8730', descr => 'get ACL for SQL object',
proname => 'pg_get_acl', provolatile => 's', prorettype => '_aclitem', proname => 'pg_get_acl', provolatile => 's', prorettype => '_aclitem',
proargtypes => 'oid oid', proargnames => '{classid,objid}', proargtypes => 'oid oid int4', proargnames => '{classid,objid,objsubid}',
prosrc => 'pg_get_acl' }, prosrc => 'pg_get_acl' },
{ oid => '3839', { oid => '3839',

32
src/test/regress/expected/privileges.out
View File

@@ -213,7 +213,7 @@ SELECT * FROM atest1;
(0 rows) (0 rows)
CREATE TABLE atest2 (col1 varchar(10), col2 boolean); CREATE TABLE atest2 (col1 varchar(10), col2 boolean);
SELECT pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid); SELECT pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid, 0);
pg_get_acl pg_get_acl
------------ ------------
@@ -223,7 +223,7 @@ GRANT SELECT ON atest2 TO regress_priv_user2;
GRANT UPDATE ON atest2 TO regress_priv_user3; GRANT UPDATE ON atest2 TO regress_priv_user3;
GRANT INSERT ON atest2 TO regress_priv_user4 GRANTED BY CURRENT_USER; GRANT INSERT ON atest2 TO regress_priv_user4 GRANTED BY CURRENT_USER;
GRANT TRUNCATE ON atest2 TO regress_priv_user5 GRANTED BY CURRENT_ROLE; GRANT TRUNCATE ON atest2 TO regress_priv_user5 GRANTED BY CURRENT_ROLE;
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid)); SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid, 0));
unnest unnest
------------------------------------------------ ------------------------------------------------
regress_priv_user1=arwdDxtm/regress_priv_user1 regress_priv_user1=arwdDxtm/regress_priv_user1
@@ -234,13 +234,13 @@ SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid));
(5 rows) (5 rows)
-- Invalid inputs -- Invalid inputs
SELECT pg_get_acl('pg_class'::regclass, 0); -- null SELECT pg_get_acl('pg_class'::regclass, 0, 0); -- null
pg_get_acl pg_get_acl
------------ ------------
(1 row) (1 row)
SELECT pg_get_acl(0, 0); -- null SELECT pg_get_acl(0, 0, 0); -- null
pg_get_acl pg_get_acl
------------ ------------
@@ -653,6 +653,30 @@ CREATE TABLE atest5 (one int, two int unique, three int, four int unique);
CREATE TABLE atest6 (one int, two int, blue int); CREATE TABLE atest6 (one int, two int, blue int);
GRANT SELECT (one), INSERT (two), UPDATE (three) ON atest5 TO regress_priv_user4; GRANT SELECT (one), INSERT (two), UPDATE (three) ON atest5 TO regress_priv_user4;
GRANT ALL (one) ON atest5 TO regress_priv_user3; GRANT ALL (one) ON atest5 TO regress_priv_user3;
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 1));
unnest
--------------------------------------------
regress_priv_user4=r/regress_priv_user1
regress_priv_user3=arwx/regress_priv_user1
(2 rows)
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 2));
unnest
-----------------------------------------
regress_priv_user4=a/regress_priv_user1
(1 row)
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 3));
unnest
-----------------------------------------
regress_priv_user4=w/regress_priv_user1
(1 row)
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 4));
unnest
--------
(0 rows)
INSERT INTO atest5 VALUES (1,2,3); INSERT INTO atest5 VALUES (1,2,3);
SET SESSION AUTHORIZATION regress_priv_user4; SET SESSION AUTHORIZATION regress_priv_user4;
SELECT * FROM atest5; -- fail SELECT * FROM atest5; -- fail

12
src/test/regress/sql/privileges.sql
View File

@@ -183,16 +183,16 @@ GRANT SELECT ON atest1 TO regress_priv_user3, regress_priv_user4;
SELECT * FROM atest1; SELECT * FROM atest1;
CREATE TABLE atest2 (col1 varchar(10), col2 boolean); CREATE TABLE atest2 (col1 varchar(10), col2 boolean);
SELECT pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid); SELECT pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid, 0);
GRANT SELECT ON atest2 TO regress_priv_user2; GRANT SELECT ON atest2 TO regress_priv_user2;
GRANT UPDATE ON atest2 TO regress_priv_user3; GRANT UPDATE ON atest2 TO regress_priv_user3;
GRANT INSERT ON atest2 TO regress_priv_user4 GRANTED BY CURRENT_USER; GRANT INSERT ON atest2 TO regress_priv_user4 GRANTED BY CURRENT_USER;
GRANT TRUNCATE ON atest2 TO regress_priv_user5 GRANTED BY CURRENT_ROLE; GRANT TRUNCATE ON atest2 TO regress_priv_user5 GRANTED BY CURRENT_ROLE;
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid)); SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid, 0));
-- Invalid inputs -- Invalid inputs
SELECT pg_get_acl('pg_class'::regclass, 0); -- null SELECT pg_get_acl('pg_class'::regclass, 0, 0); -- null
SELECT pg_get_acl(0, 0); -- null SELECT pg_get_acl(0, 0, 0); -- null
GRANT TRUNCATE ON atest2 TO regress_priv_user4 GRANTED BY regress_priv_user5; -- error GRANT TRUNCATE ON atest2 TO regress_priv_user4 GRANTED BY regress_priv_user5; -- error
@@ -439,6 +439,10 @@ CREATE TABLE atest5 (one int, two int unique, three int, four int unique);
CREATE TABLE atest6 (one int, two int, blue int); CREATE TABLE atest6 (one int, two int, blue int);
GRANT SELECT (one), INSERT (two), UPDATE (three) ON atest5 TO regress_priv_user4; GRANT SELECT (one), INSERT (two), UPDATE (three) ON atest5 TO regress_priv_user4;
GRANT ALL (one) ON atest5 TO regress_priv_user3; GRANT ALL (one) ON atest5 TO regress_priv_user3;
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 1));
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 2));
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 3));
SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 4));
INSERT INTO atest5 VALUES (1,2,3); INSERT INTO atest5 VALUES (1,2,3);