8000 Use has_privs_for_roles for predefined role checks · postgrespro/postgres@6198420 · GitHub
[go: up one dir, main page]
Skip to content

Commit 6198420

Browse files
jconwayjconway
committed
Use has_privs_for_roles for predefined role checks
Generally if a role is granted membership to another role with NOINHERIT they must use SET ROLE to access the privileges of that role, however with predefined roles the membership and privilege is conflated. Fix that by replacing is_member_of_role with has_privs_for_role for predefined roles. Patch does not remove is_member_of_role from acl.h, but it does add a warning not to use that function for privilege checking. Not backpatched based on hackers list discussion. Author: Joshua Brindle Reviewed-by: Stephen Frost, Nathan Bossart, Joe Conway Discussion: https://postgr.es/m/flat/CAGB+Vh4Zv_TvKt2tv3QNS6tUM_F_9icmuj0zjywwcgVi4PAhFA@mail.gmail.com
1 parent 79de984 commit 6198420

File tree

23 files changed

+68
-64
lines changed

23 files changed

+68
-64
lines changed

‎contrib/adminpack/adminpack.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ convert_and_check_filename(text *arg)
7979
* files on the server as the PG user, so no need to do any further checks
8080
* here.
8181
*/
82-
if (is_member_of_role(GetUserId(), ROLE_PG_WRITE_SERVER_FILES))
82+
if (has_privs_of_role(GetUserId(), ROLE_PG_WRITE_SERVER_FILES))
8383
return filename;
8484

8585
/*

‎contrib/file_fdw/expected/file_fdw.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -459,7 +459,7 @@ ALTER FOREIGN TABLE agg_text OWNER TO regress_file_fdw_user;
459459
ALTER FOREIGN TABLE agg_text OPTIONS (SET format 'text');
460460
SET ROLE regress_file_fdw_user;
461461
ALTER FOREIGN TABLE agg_text OPTIONS (SET format 'text');
462-
ERROR: only superuser or a member of the pg_read_server_files role may specify the filename option of a file_fdw foreign table
462+
ERROR: only superuser or a role with privileges of the pg_read_server_files role may specify the filename option of a file_fdw foreign table
463463
SET ROLE regress_file_fdw_superuser;
464464
-- cleanup
465465
RESET ROLE;

‎contrib/file_fdw/file_fdw.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -269,16 +269,16 @@ file_fdw_validator(PG_FUNCTION_ARGS)
269269
* otherwise there'd still be a security hole.
270270
*/
271271
if (strcmp(def->defname, "filename") == 0 &&
272-
!is_member_of_role(GetUserId(), ROLE_PG_READ_SERVER_FILES))
272+
!has_privs_of_role(GetUserId(), ROLE_PG_READ_SERVER_FILES))
273273
ereport(ERROR,
274274
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
275-
errmsg("only superuser or a member of the pg_read_server_files role may specify the filename option of a file_fdw foreign table")));
275+
errmsg("only superuser or a role with privileges of the pg_read_server_files role may specify the filename option of a file_fdw foreign table")));
276276

277277
if (strcmp(def->defname, "program") == 0 &&
278-
!is_member_of_role(GetUserId(), ROLE_PG_EXECUTE_SERVER_PROGRAM))
278+
!has_privs_of_role(GetUserId(), ROLE_PG_EXECUTE_SERVER_PROGRAM))
279279
ereport(ERROR,
280280
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
281-
errmsg("only superuser or a member of the pg_execute_server_program role may specify the program option of a file_fdw foreign table")));
281+
errmsg("only superuser or a role with privileges of the pg_execute_server_program role may specify the program option of a file_fdw foreign table")));
282282

283283
filename = defGetString(def);
284284
}

‎contrib/pg_stat_statements/pg_stat_statements.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1503,8 +1503,8 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
15031503
HASH_SEQ_STATUS hash_seq;
15041504
pgssEntry *entry;
15051505

1506-
/* Superusers or members of pg_read_all_stats members are allowed */
1507-
is_allowed_role = is_member_of_role(userid, ROLE_PG_READ_ALL_STATS);
1506+
/* Superusers or roles with the privileges of pg_read_all_stats members are allowed */
1507+
is_allowed_role = has_privs_of_role(userid, ROLE_PG_READ_ALL_STATS);
15081508

15091509
/* hash table must exist already */
15101510
if (!pgss || !pgss_hash)

‎contrib/pgrowlocks/pgrowlocks.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ pgrowlocks(PG_FUNCTION_ARGS)
104104
aclresult = pg_class_aclcheck(RelationGetRelid(rel), GetUserId(),
105105
ACL_SELECT);
106106
if (aclresult != ACLCHECK_OK)
107-
aclresult = is_member_of_role(GetUserId(), ROLE_PG_STAT_SCAN_TABLES) ? ACLCHECK_OK : ACLCHECK_NO_PRIV;
107+
aclresult = has_privs_of_role(GetUserId(), ROLE_PG_STAT_SCAN_TABLES) ? ACLCHECK_OK : ACLCHECK_NO_PRIV;
108108

109109
if (aclresult != ACLCHECK_OK)
110110
aclcheck_error(aclresult, get_relkind_objtype(rel->rd_rel->relkind),

‎doc/src/sgml/adminpack.sgml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,9 @@
2222
functions in <xref linkend="functions-admin-genfile-table"/>, which
2323
provide read-only access.)
2424
Only files within the database cluster directory can be accessed, unless the
25-
user is a superuser or given one of the pg_read_server_files, or pg_write_server_files
26-
roles, as appropriate for the function, but either a relative or absolute path is
27-
allowable.
25+
user is a superuser or given privileges of one of the pg_read_server_files,
26+
or pg_write_server_files roles, as appropriate for the function, but either a
27+
relative or absolute path is allowable.
2828
</para>
2929

3030
<table id="functions-adminpack-table">

‎doc/src/sgml/catalogs.sgml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -10044,8 +10044,8 @@ SCRAM-SHA-256$<replaceable>&lt;iteration count&gt;</replaceable>:<replaceable>&l
1004410044

1004510045
<para>
1004610046
By default, the <structname>pg_backend_memory_contexts</structname> view can be
10047-
read only by superusers or members of the <literal>pg_read_all_stats</literal>
10048-
role.
10047+
read only by superusers or roles with the privileges of the
10048+
<literal>pg_read_all_stats</literal> role.
1004910049
</para>
1005010050
</sect1>
1005110051

@@ -12552,7 +12552,7 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
1255212552
<para>
1255312553
Configuration file the current value was set in (null for
1255412554
values set from sources other than configuration files, or when
12555-
examined by a user who is neither a superuser or a member of
12555+
examined by a user who neither is a superuser nor has privileges of
1255612556
<literal>pg_read_all_settings</literal>); helpful when using
1255712557
<literal>include</literal> directives in configuration files
1255812558
</para></entry>
@@ -12565,7 +12565,7 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
1256512565
<para>
1256612566
Line number within the configuration file the current value was
1256712567
set at (null for values set from sources other than configuration files,
12568-
or when examined by a user who is neither a superuser or a member of
12568+
or when examined by a user who neither is a superuser nor has privileges of
1256912569
<literal>pg_read_all_settings</literal>).
1257012570
</para></entry>
1257112571
</row>
@@ -12941,8 +12941,8 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
1294112941

1294212942
<para>
1294312943
By default, the <structname>pg_shmem_allocations</structname> view can be
12944-
read only by superusers or members of the <literal>pg_read_all_stats</literal>
12945-
role.
12944+
read only by superusers or roles with privileges of the
12945+
<literal>pg_read_all_stats</literal> role.
1294612946
</para>
1294712947
</sect1>
1294812948

D958

‎doc/src/sgml/func.sgml

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -25435,7 +25435,7 @@ SELECT collation for ('foo' COLLATE "de_DE");
2543525435
Cancels the current query of the session whose backend process has the
2543625436
specified process ID. This is also allowed if the
2543725437
calling role is a member of the role whose backend is being canceled or
25438-
the calling role has been granted <literal>pg_signal_backend</literal>,
25438+
the calling role has privileges of <literal>pg_signal_backend</literal>,
2543925439
however only superusers can cancel superuser backends.
2544025440
</para></entry>
2544125441
</row>
@@ -25508,7 +25508,7 @@ SELECT collation for ('foo' COLLATE "de_DE");
2550825508
Terminates the session whose backend process has the
2550925509
specified process ID. This is also allowed if the calling role
2551025510
is a member of the role whose backend is being terminated or the
25511-
calling role has been granted <literal>pg_signal_backend</literal>,
25511+
calling role has privileges of <literal>pg_signal_backend</literal>,
2551225512
however only superusers can terminate superuser backends.
2551325513
</para>
2551425514
<para>
@@ -26783,7 +26783,7 @@ postgres=# SELECT * FROM pg_walfile_name_offset(pg_stop_backup());
2678326783
Computes the total disk space used by the database with the specified
2678426784
name or OID. To use this function, you must
2678526785
have <literal>CONNECT</literal> privilege on the specified database
26786-
(which is granted by default) or be a member of
26786+
(which is granted by default) or have privileges of
2678726787
the <literal>pg_read_all_stats</literal> role.
2678826788
</para></entry>
2678926789
</row>
@@ -26913,7 +26913,7 @@ postgres=# SELECT * FROM pg_walfile_name_offset(pg_stop_backup());
2691326913
Computes the total disk space used in the tablespace with the
2691426914
specified name or OID. To use this function, you must
2691526915
have <literal>CREATE</literal> privilege on the specified tablespace
26916-
or be a member of the <literal>pg_read_all_stats</literal> role,
26916+
or have privileges of the <literal>pg_read_all_stats</literal> role,
2691726917
unless it is the default tablespace for the current database.
2691826918
</para></entry>
2691926919
</row>
@@ -27392,7 +27392,7 @@ SELECT pg_size_pretty(sum(pg_relation_size(relid))) AS total_size
2739227392
a dot, directories, and other special files are excluded.
2739327393
</para>
2739427394
<para>
27395-
This function is restricted to superusers and members of
27395+
This function is restricted to superusers and roles with privileges of
2739627396
the <literal>pg_monitor</literal> role by default, but other users can
2739727397
be granted EXECUTE to run the function.
2739827398
</para></entry>
@@ -27416,7 +27416,7 @@ SELECT pg_size_pretty(sum(pg_relation_size(relid))) AS total_size
2741627416
are excluded.
2741727417
</para>
2741827418
<para>
27419-
This function is restricted to superusers and members of
27419+
This function is restricted to superusers and roles with privileges of
2742027420
the <literal>pg_monitor</literal> role by default, but other users can
2742127421
be granted EXECUTE to run the function.
2742227422
</para></entry>

‎doc/src/sgml/monitoring.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -280,7 +280,7 @@ postgres 27093 0.0 0.0 30096 2752 ? Ss 11:34 0:00 postgres: ser
280280
(sessions belonging to a role that they are a member of). In rows about
281281
other sessions, many columns will be null. Note, however, that the
282282
existence of a session and its general properties such as its sessions user
283-
and database are visible to all users. Superusers and members of the
283+
and database are visible to all users. Superusers and roles with privileges of
284284
built-in role <literal>pg_read_all_stats</literal> (see also <xref
285285
linkend="predefined-roles"/>) can see all the information about all sessions.
286286
</para>

‎doc/src/sgml/pgbuffercache.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
</para>
2525

2626
<para>
27-
By default, use is restricted to superusers and members of the
27+
By default, use is restricted to superusers and roles with privileges of the
2828
<literal>pg_monitor</literal> role. Access may be granted to others
2929
using <command>GRANT</command>.
3030
</para>

0 commit comments

Comments
 (0)
0