database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-05 07:21:24 +03:00
Code Activity

Create a pg_shdepend entry for each role in TO clause of policies.

Browse Source 
CreatePolicy() and AlterPolicy() omit to create a pg_shdepend entry for
each role in the TO clause. Fix this by creating a new shared dependency
type called SHARED_DEPENDENCY_POLICY and assigning it to each role.

Reported by Noah Misch. Patch by me, reviewed by Alvaro Herrera.
Back-patch to 9.5 where RLS was introduced.
This commit is contained in:
Joe Conway
2015-07-28 16:01:53 -07:00
parent 8c72a7fab4
commit f781a0f1d8
6 changed files with 177 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
src/test/regress/expected/rowsecurity.out
View File

@ -2942,6 +2942,61 @@ SELECT * FROM coll_t;
ROLLBACK;
--
-- Shared Object Dependencies
--
RESET SESSION AUTHORIZATION;
BEGIN;
CREATE ROLE alice;
CREATE ROLE bob;
CREATE TABLE tbl1 (c) AS VALUES ('bar'::text);
GRANT SELECT ON TABLE tbl1 TO alice;
CREATE POLICY P ON tbl1 TO alice, bob USING (true);
SELECT refclassid::regclass, deptype
FROM pg_depend
WHERE classid = 'pg_policy'::regclass
AND refobjid = 'tbl1'::regclass;
refclassid | deptype
------------+---------
pg_class | a
(1 row)
SELECT refclassid::regclass, deptype
FROM pg_shdepend
WHERE classid = 'pg_policy'::regclass
AND refobjid IN ('alice'::regrole, 'bob'::regrole);
refclassid | deptype
------------+---------
pg_authid | r
pg_authid | r
(2 rows)
SAVEPOINT q;
DROP ROLE alice; --fails due to dependency on POLICY p
ERROR: role "alice" cannot be dropped because some objects depend on it
DETAIL: target of policy p on table tbl1
privileges for table tbl1
ROLLBACK TO q;
ALTER POLICY p ON tbl1 TO bob USING (true);
SAVEPOINT q;
DROP ROLE alice; --fails due to dependency on GRANT SELECT
ERROR: role "alice" cannot be dropped because some objects depend on it
DETAIL: privileges for table tbl1
ROLLBACK TO q;
REVOKE ALL ON TABLE tbl1 FROM alice;
SAVEPOINT q;
DROP ROLE alice; --succeeds
ROLLBACK TO q;
SAVEPOINT q;
DROP ROLE bob; --fails due to dependency on POLICY p
ERROR: role "bob" cannot be dropped because some objects depend on it
DETAIL: target of policy p on table tbl1
ROLLBACK TO q;
DROP POLICY p ON tbl1;
SAVEPOINT q;
DROP ROLE bob; -- succeeds
ROLLBACK TO q;
ROLLBACK; -- cleanup
--
-- Clean up objects
--
RESET SESSION AUTHORIZATION;

44
src/test/regress/sql/rowsecurity.sql
View File

@ -1216,6 +1216,50 @@ SELECT (string_to_array(polqual, ':'))[7] AS inputcollid FROM pg_policy WHERE po
SELECT * FROM coll_t;
ROLLBACK;
--
-- Shared Object Dependencies
--
RESET SESSION AUTHORIZATION;
BEGIN;
CREATE ROLE alice;
CREATE ROLE bob;
CREATE TABLE tbl1 (c) AS VALUES ('bar'::text);
GRANT SELECT ON TABLE tbl1 TO alice;
CREATE POLICY P ON tbl1 TO alice, bob USING (true);
SELECT refclassid::regclass, deptype
FROM pg_depend
WHERE classid = 'pg_policy'::regclass
AND refobjid = 'tbl1'::regclass;
SELECT refclassid::regclass, deptype
FROM pg_shdepend
WHERE classid = 'pg_policy'::regclass
AND refobjid IN ('alice'::regrole, 'bob'::regrole);
SAVEPOINT q;
DROP ROLE alice; --fails due to dependency on POLICY p
ROLLBACK TO q;
ALTER POLICY p ON tbl1 TO bob USING (true);
SAVEPOINT q;
DROP ROLE alice; --fails due to dependency on GRANT SELECT
ROLLBACK TO q;
REVOKE ALL ON TABLE tbl1 FROM alice;
SAVEPOINT q;
DROP ROLE alice; --succeeds
ROLLBACK TO q;
SAVEPOINT q;
DROP ROLE bob; --fails due to dependency on POLICY p
ROLLBACK TO q;
DROP POLICY p ON tbl1;
SAVEPOINT q;
DROP ROLE bob; -- succeeds
ROLLBACK TO q;
ROLLBACK; -- cleanup
--
-- Clean up objects
--