Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 89a256f

Browse files
AndriciucAndriciuc
authored
Merge branch 'TDE_REL_17_STABLE' into docs-add-thales
2 parents 40ce6d8 + 591d604 commit 89a256f

File tree

7 files changed

+1
-197
lines changed

7 files changed

+1
-197
lines changed

‎contrib/pg_tde/documentation/docs/functions.md

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,26 +11,6 @@ However, database owners can run the “view keys” and “set principal key”
1111
* `GRANT EXECUTE`
1212
* `REVOKE EXECUTE`
1313

14-
The following functions are also provided for easier management of functionality groups:
15-
16-
### Database local key management
17-
18-
Use these functions to grant or revoke permissions to manage the key of the current database. They enable or disable all functions related to the key of the current database:
19-
20-
* `pg_tde_grant_database_key_management_to_role(role)`
21-
* `pg_tde_revoke_database_key_management_from_role(role)`
22-
23-
### Global scope key management
24-
25-
Managment of the global scope is restricted to superusers only.
26-
27-
### Inspections
28-
29-
Use these functions to grant or revoke the use of query functions, which do not modify the encryption settings:
30-
31-
* `pg_tde_grant_key_viewer_to_role(role)`
32-
* `pg_tde_revoke_key_viewer_from_role(role)`
33-
3414
## Key provider management
3515

3616
A key provider is a system or service responsible for managing encryption keys. `pg_tde` supports the following key providers:

‎contrib/pg_tde/expected/access_control.out

Lines changed: 0 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -27,56 +27,7 @@ ERROR: permission denied for function pg_tde_verify_server_key
2727
SELECT pg_tde_verify_default_key();
2828
ERROR: permission denied for function pg_tde_verify_default_key
2929
RESET ROLE;
30-
SELECT pg_tde_grant_database_key_management_to_role('regress_pg_tde_access_control');
31-
pg_tde_grant_database_key_management_to_role
32-
----------------------------------------------
33-
34-
(1 row)
35-
36-
SELECT pg_tde_grant_key_viewer_to_role('regress_pg_tde_access_control');
37-
pg_tde_grant_key_viewer_to_role
38-
---------------------------------
39-
40-
(1 row)
41-
42-
SET ROLE regress_pg_tde_access_control;
43-
-- should now be allowed
44-
SELECT pg_tde_set_key_using_database_key_provider('test-db-key', 'local-file-provider');
45-
pg_tde_set_key_using_database_key_provider
46-
--------------------------------------------
47-
48-
(1 row)
49-
50-
SELECT * FROM pg_tde_list_all_database_key_providers();
51-
id | provider_name | provider_type | options
52-
----+---------------------+---------------+-------------------------------------------
53-
1 | local-file-provider | file | {"path" : "/tmp/pg_tde_test_keyring.per"}
54-
(1 row)
55-
56-
SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_key_info();
57-
key_name | key_provider_name | key_provider_id
58-
-------------+---------------------+-----------------
59-
test-db-key | local-file-provider | 1
60-
(1 row)
61-
62-
SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_server_key_info();
63-
ERROR: Principal key does not exists for the database
64-
HINT: Use set_key interface to set the principal key
65-
SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_default_key_info();
66-
ERROR: Principal key does not exists for the database
67-
HINT: Use set_key interface to set the principal key
68-
SELECT pg_tde_verify_key();
69-
pg_tde_verify_key
70-
-------------------
71-
72-
(1 row)
73-
74-
SELECT pg_tde_verify_server_key();
75-
ERROR: principal key not configured for current database
76-
SELECT pg_tde_verify_default_key();
77-
ERROR: principal key not configured for current database
7830
-- Only superusers can execute key management functions, regardless of role grants
79-
RESET ROLE;
8031
GRANT EXECUTE ON FUNCTION pg_tde_add_database_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
8132
GRANT EXECUTE ON FUNCTION pg_tde_add_global_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
8233
GRANT EXECUTE ON FUNCTION pg_tde_change_database_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
@@ -106,29 +57,4 @@ ERROR: must be superuser to access global key providers
10657
SELECT pg_tde_set_server_key_using_global_key_provider('key1', 'global-file-provider');
10758
ERROR: must be superuser to access global key providers
10859
RESET ROLE;
109-
SELECT pg_tde_revoke_key_viewer_from_role('regress_pg_tde_access_control');
110-
pg_tde_revoke_key_viewer_from_role
111-
------------------------------------
112-
113-
(1 row)
114-
115-
SET ROLE regress_pg_tde_access_control;
116-
-- verify the view access is revoked
117-
SELECT pg_tde_list_all_database_key_providers();
118-
ERROR: permission denied for function pg_tde_list_all_database_key_providers
119-
SELECT pg_tde_list_all_global_key_providers();
120-
ERROR: permission denied for function pg_tde_list_all_global_key_providers
121-
SELECT pg_tde_key_info();
122-
ERROR: permission denied for function pg_tde_key_info
123-
SELECT pg_tde_server_key_info();
124-
ERROR: permission denied for function pg_tde_server_key_info
125-
SELECT pg_tde_default_key_info();
126-
ERROR: permission denied for function pg_tde_default_key_info
127-
SELECT pg_tde_verify_key();
128-
ERROR: permission denied for function pg_tde_verify_key
129-
SELECT pg_tde_verify_server_key();
130-
ERROR: permission denied for function pg_tde_verify_server_key
131-
SELECT pg_tde_verify_default_key();
132-
ERROR: permission denied for function pg_tde_verify_default_key
133-
RESET ROLE;
13460
DROP EXTENSION pg_tde CASCADE;

‎contrib/pg_tde/expected/relocate.out

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,12 +9,6 @@ SELECT other.pg_tde_add_database_key_provider_file('file-vault', '/tmp/pg_tde_te
99

1010
(1 row)
1111

12-
SELECT other.pg_tde_grant_key_viewer_to_role('public');
13-
pg_tde_grant_key_viewer_to_role
14-
---------------------------------
15-
16-
(1 row)
17-
1812
ALTER EXTENSION pg_tde SET SCHEMA public;
1913
ERROR: extension "pg_tde" does not support SET SCHEMA
2014
DROP EXTENSION pg_tde;

‎contrib/pg_tde/pg_tde--1.0-rc.sql

Lines changed: 0 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -548,65 +548,3 @@ LANGUAGE C
548548
AS 'MODULE_PATHNAME';
549549
SELECT pg_tde_extension_initialize();
550550
DROP FUNCTION pg_tde_extension_initialize();
551-
552-
CREATE FUNCTION pg_tde_grant_database_key_management_to_role(
553-
target_role TEXT)
554-
RETURNS VOID
555-
LANGUAGE plpgsql
556-
SET search_path = @extschema@
557-
AS $$
558-
BEGIN
559-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_set_key_using_database_key_provider(TEXT, TEXT, BOOLEAN) TO %I', target_role);
560-
END;
561-
$$;
562-
563-
CREATE FUNCTION pg_tde_grant_key_viewer_to_role(
564-
target_role TEXT)
565-
RETURNS VOID
566-
LANGUAGE plpgsql
567-
SET search_path = @extschema@
568-
AS $$
569-
BEGIN
570-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_list_all_database_key_providers() TO %I', target_role);
571-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_list_all_global_key_providers() TO %I', target_role);
572-
573-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_key_info() TO %I', target_role);
574-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_server_key_info() TO %I', target_role);
575-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_default_key_info() TO %I', target_role);
576-
577-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_verify_key() TO %I', target_role);
578-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_verify_server_key() TO %I', target_role);
579-
EXECUTE format('GRANT EXECUTE ON FUNCTION pg_tde_verify_default_key() TO %I', target_role);
580-
END;
581-
$$;
582-
583-
CREATE FUNCTION pg_tde_revoke_database_key_management_from_role(
584-
target_role TEXT)
585-
RETURNS VOID
586-
LANGUAGE plpgsql
587-
SET search_path = @extschema@
588-
AS $$
589-
BEGIN
590-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_set_key_using_database_key_provider(TEXT, TEXT, BOOLEAN) FROM %I', target_role);
591-
END;
592-
$$;
593-
594-
CREATE FUNCTION pg_tde_revoke_key_viewer_from_role(
595-
target_role TEXT)
596-
RETURNS VOID
597-
LANGUAGE plpgsql
598-
SET search_path = @extschema@
599-
AS $$
600-
BEGIN
601-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_list_all_database_key_providers() FROM %I', target_role);
602-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_list_all_global_key_providers() FROM %I', target_role);
603-
604-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_key_info() FROM %I', target_role);
605-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_server_key_info() FROM %I', target_role);
606-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_default_key_info() FROM %I', target_role);
607-
608-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_verify_key() FROM %I', target_role);
609-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_verify_server_key() FROM %I', target_role);
610-
EXECUTE format('REVOKE EXECUTE ON FUNCTION pg_tde_verify_default_key() FROM %I', target_role);
611-
END;
612-
$$;

‎contrib/pg_tde/sql/access_control.sql

Lines changed: 1 addition & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -19,23 +19,7 @@ SELECT pg_tde_verify_default_key();
1919

2020
RESET ROLE;
2121

22-
SELECT pg_tde_grant_database_key_management_to_role('regress_pg_tde_access_control');
23-
SELECT pg_tde_grant_key_viewer_to_role('regress_pg_tde_access_control');
24-
25-
SET ROLE regress_pg_tde_access_control;
26-
27-
-- should now be allowed
28-
SELECT pg_tde_set_key_using_database_key_provider('test-db-key', 'local-file-provider');
29-
SELECT * FROM pg_tde_list_all_database_key_providers();
30-
SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_key_info();
31-
SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_server_key_info();
32-
SELECT key_name, key_provider_name, key_provider_id FROM pg_tde_default_key_info();
33-
SELECT pg_tde_verify_key();
34-
SELECT pg_tde_verify_server_key();
35-
SELECT pg_tde_verify_default_key();
36-
3722
-- Only superusers can execute key management functions, regardless of role grants
38-
RESET ROLE;
3923
GRANT EXECUTE ON FUNCTION pg_tde_add_database_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
4024
GRANT EXECUTE ON FUNCTION pg_tde_add_global_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
4125
GRANT EXECUTE ON FUNCTION pg_tde_change_database_key_provider(TEXT, TEXT, JSON) TO regress_pg_tde_access_control;
@@ -47,6 +31,7 @@ GRANT EXECUTE ON FUNCTION pg_tde_set_key_using_global_key_provider(TEXT, TEXT, B
4731
GRANT EXECUTE ON FUNCTION pg_tde_set_server_key_using_global_key_provider(TEXT, TEXT, BOOLEAN) TO regress_pg_tde_access_control;
4832

4933
SET ROLE regress_pg_tde_access_control;
34+
5035
SELECT pg_tde_add_database_key_provider_file('local-file-provider', '/tmp/pg_tde_test_keyring.per');
5136
SELECT pg_tde_change_global_key_provider_file('local-file-provider', '/tmp/pg_tde_test_keyring.per');
5237
SELECT pg_tde_delete_database_key_provider('local-file-provider');
@@ -56,21 +41,6 @@ SELECT pg_tde_delete_global_key_provider('global-file-provider');
5641
SELECT pg_tde_set_key_using_global_key_provider('key1', 'global-file-provider');
5742
SELECT pg_tde_set_default_key_using_global_key_provider('key1', 'global-file-provider');
5843
SELECT pg_tde_set_server_key_using_global_key_provider('key1', 'global-file-provider');
59-
RESET ROLE;
60-
61-
SELECT pg_tde_revoke_key_viewer_from_role('regress_pg_tde_access_control');
62-
63-
SET ROLE regress_pg_tde_access_control;
64-
65-
-- verify the view access is revoked
66-
SELECT pg_tde_list_all_database_key_providers();
67-
SELECT pg_tde_list_all_global_key_providers();
68-
SELECT pg_tde_key_info();
69-
SELECT pg_tde_server_key_info();
70-
SELECT pg_tde_default_key_info();
71-
SELECT pg_tde_verify_key();
72-
SELECT pg_tde_verify_server_key();
73-
SELECT pg_tde_verify_default_key();
7444

7545
RESET ROLE;
7646

‎contrib/pg_tde/sql/relocate.sql

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@ CREATE EXTENSION pg_tde SCHEMA other;
88

99
SELECT other.pg_tde_add_database_key_provider_file('file-vault', '/tmp/pg_tde_test_keyring.per');
1010

11-
SELECT other.pg_tde_grant_key_viewer_to_role('public');
12-
1311
ALTER EXTENSION pg_tde SET SCHEMA public;
1412

1513
DROP EXTENSION pg_tde;

‎contrib/pg_tde/src/catalog/tde_principal_key.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -679,9 +679,7 @@ pg_tde_get_key_info(PG_FUNCTION_ARGS, Oid dbOid)
679679
/* Make the tuple into a datum */
680680
result = HeapTupleGetDatum(tuple);
681681

682-
#ifndef FRONTEND
683682
pfree(keyring);
684-
#endif
685683

686684
PG_RETURN_DATUM(result);
687685
}

0 commit comments

Comments
 (0)