database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-06 19:59:18 +03:00
Code

Ignore tablespace ACLs when ignoring schema ACLs.

Browse Source 
The ALTER TABLE ALTER TYPE implementation can issue DROP INDEX and
CREATE INDEX to refit existing indexes for the new column type.  Since
this CREATE INDEX is an implementation detail of an index alteration,
the ensuing DefineIndex() should skip ACL checks specific to index
creation.  It already skips the namespace ACL check.  Make it skip the
tablespace ACL check, too.  Back-patch to 9.2 (all supported versions).

Reviewed by Tom Lane.
This commit is contained in:
Noah Misch 2017-02-12 16:03:41 -05:00
parent 2ea5b06c7a
commit f30f34e589
3 changed files with 20 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/backend/commands/indexcmds.c
View File

@ -293,8 +293,8 @@ CheckIndexCompatible(Oid oldId,
* 'indexRelationId': normally InvalidOid, but during bootstrap can be * 'indexRelationId': normally InvalidOid, but during bootstrap can be
* nonzero to specify a preselected OID for the index. * nonzero to specify a preselected OID for the index.
* 'is_alter_table': this is due to an ALTER rather than a CREATE operation. * 'is_alter_table': this is due to an ALTER rather than a CREATE operation.
* 'check_rights': check for CREATE rights in the namespace. (This should * 'check_rights': check for CREATE rights in namespace and tablespace. (This
* be true except when ALTER is deleting/recreating an index.) * should be true except when ALTER is deleting/recreating an index.)
* 'skip_build': make the catalog entries but leave the index file empty; * 'skip_build': make the catalog entries but leave the index file empty;
* it will be filled later. * it will be filled later.
* 'quiet': suppress the NOTICE chatter ordinarily provided for constraints. * 'quiet': suppress the NOTICE chatter ordinarily provided for constraints.
@ -435,8 +435,9 @@ DefineIndex(Oid relationId,
/* note InvalidOid is OK in this case */ /* note InvalidOid is OK in this case */
} }
/* Check permissions except when using database's default */ /* Check tablespace permissions */
if (OidIsValid(tablespaceId) && tablespaceId != MyDatabaseTableSpace) if (check_rights &&
OidIsValid(tablespaceId) && tablespaceId != MyDatabaseTableSpace)
{ {
AclResult aclresult; AclResult aclresult;

7
src/test/regress/input/tablespace.source
View File

@ -109,11 +109,18 @@ DROP TABLESPACE regress_tblspace;
CREATE ROLE regress_tablespace_user1 login; CREATE ROLE regress_tablespace_user1 login;
CREATE ROLE regress_tablespace_user2 login; CREATE ROLE regress_tablespace_user2 login;
GRANT USAGE ON SCHEMA testschema TO regress_tablespace_user2;
ALTER TABLESPACE regress_tblspace OWNER TO regress_tablespace_user1; ALTER TABLESPACE regress_tblspace OWNER TO regress_tablespace_user1;
CREATE TABLE testschema.tablespace_acl (c int);
-- new owner lacks permission to create this index from scratch
CREATE INDEX k ON testschema.tablespace_acl (c) TABLESPACE regress_tblspace;
ALTER TABLE testschema.tablespace_acl OWNER TO regress_tablespace_user2;
SET SESSION ROLE regress_tablespace_user2; SET SESSION ROLE regress_tablespace_user2;
CREATE TABLE tablespace_table (i int) TABLESPACE regress_tblspace; -- fail CREATE TABLE tablespace_table (i int) TABLESPACE regress_tblspace; -- fail
ALTER TABLE testschema.tablespace_acl ALTER c TYPE bigint;
RESET ROLE; RESET ROLE;
ALTER TABLESPACE regress_tblspace RENAME TO regress_tblspace_renamed; ALTER TABLESPACE regress_tblspace RENAME TO regress_tblspace_renamed;

9
src/test/regress/output/tablespace.source
View File

@ -221,10 +221,16 @@ DROP TABLESPACE regress_tblspace;
ERROR: tablespace "regress_tblspace" is not empty ERROR: tablespace "regress_tblspace" is not empty
CREATE ROLE regress_tablespace_user1 login; CREATE ROLE regress_tablespace_user1 login;
CREATE ROLE regress_tablespace_user2 login; CREATE ROLE regress_tablespace_user2 login;
GRANT USAGE ON SCHEMA testschema TO regress_tablespace_user2;
ALTER TABLESPACE regress_tblspace OWNER TO regress_tablespace_user1; ALTER TABLESPACE regress_tblspace OWNER TO regress_tablespace_user1;
CREATE TABLE testschema.tablespace_acl (c int);
-- new owner lacks permission to create this index from scratch
CREATE INDEX k ON testschema.tablespace_acl (c) TABLESPACE regress_tblspace;
ALTER TABLE testschema.tablespace_acl OWNER TO regress_tablespace_user2;
SET SESSION ROLE regress_tablespace_user2; SET SESSION ROLE regress_tablespace_user2;
CREATE TABLE tablespace_table (i int) TABLESPACE regress_tblspace; -- fail CREATE TABLE tablespace_table (i int) TABLESPACE regress_tblspace; -- fail
ERROR: permission denied for tablespace regress_tblspace ERROR: permission denied for tablespace regress_tblspace
ALTER TABLE testschema.tablespace_acl ALTER c TYPE bigint;
RESET ROLE; RESET ROLE;
ALTER TABLESPACE regress_tblspace RENAME TO regress_tblspace_renamed; ALTER TABLESPACE regress_tblspace RENAME TO regress_tblspace_renamed;
ALTER TABLE ALL IN TABLESPACE regress_tblspace_renamed SET TABLESPACE pg_default; ALTER TABLE ALL IN TABLESPACE regress_tblspace_renamed SET TABLESPACE pg_default;
@ -235,10 +241,11 @@ NOTICE: no matching relations in tablespace "regress_tblspace_renamed" found
-- Should succeed -- Should succeed
DROP TABLESPACE regress_tblspace_renamed; DROP TABLESPACE regress_tblspace_renamed;
DROP SCHEMA testschema CASCADE; DROP SCHEMA testschema CASCADE;
NOTICE: drop cascades to 4 other objects NOTICE: drop cascades to 5 other objects
DETAIL: drop cascades to table testschema.foo DETAIL: drop cascades to table testschema.foo
drop cascades to table testschema.asselect drop cascades to table testschema.asselect
drop cascades to table testschema.asexecute drop cascades to table testschema.asexecute
drop cascades to table testschema.atable drop cascades to table testschema.atable
drop cascades to table testschema.tablespace_acl
DROP ROLE regress_tablespace_user1; DROP ROLE regress_tablespace_user1;
DROP ROLE regress_tablespace_user2; DROP ROLE regress_tablespace_user2;