Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit b376ec6

Browse files
peterepetere
committed
Show default privileges in information schema
Hitherto, the information schema only showed explicitly granted privileges that were visible in the *acl catalog columns. If no privileges had been granted, the implicit privileges were not shown. To fix that, add an SQL-accessible version of the acldefault() function, and use that inside the aclexplode() calls to substitute the catalog-specific default privilege set for null values. reviewed by Abhijit Menon-Sen
1 parent bf90562 commit b376ec6

File tree

7 files changed

+79
-18
lines changed

7 files changed

+79
-18
lines changed

‎src/backend/catalog/information_schema.sql

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -554,7 +554,7 @@ CREATE VIEW column_privileges AS
554554
pr_c.prtype,
555555
pr_c.grantable,
556556
pr_c.relowner
557-
FROM (SELECT oid, relname, relnamespace, relowner, (aclexplode(relacl)).*
557+
FROM (SELECT oid, relname, relnamespace, relowner, (aclexplode(coalesce(relacl, acldefault('r', relowner)))).*
558558
FROM pg_class
559559
WHERE relkind IN ('r', 'v', 'f')
560560
) pr_c (oid, relname, relnamespace, relowner, grantor, grantee, prtype, grantable),
@@ -571,8 +571,8 @@ CREATE VIEW column_privileges AS
571571
pr_a.prtype,
572572
pr_a.grantable,
573573
c.relowner
574-
FROM (SELECT attrelid, attname, (aclexplode(attacl)).*
575-
FROM pg_attribute
574+
FROM (SELECT attrelid, attname, (aclexplode(coalesce(attacl, acldefault('c', relowner)))).*
575+
FROM pg_attribute a JOIN pg_class cc ON (a.attrelid = cc.oid)
576576
WHERE attnum > 0
577577
AND NOT attisdropped
578578
) pr_a (attrelid, attname, grantor, grantee, prtype, grantable),
@@ -1276,7 +1276,7 @@ CREATE VIEW routine_privileges AS
12761276
THEN 'YES' ELSE 'NO' END AS yes_or_no) AS is_grantable
12771277

12781278
FROM (
1279-
SELECT oid, proname, proowner, pronamespace, (aclexplode(proacl)).* FROM pg_proc
1279+
SELECT oid, proname, proowner, pronamespace, (aclexplode(coalesce(proacl, acldefault('f', proowner)))).* FROM pg_proc
12801280
) p (oid, proname, proowner, pronamespace, grantor, grantee, prtype, grantable),
12811281
pg_namespace n,
12821282
pg_authid u_grantor,
@@ -1797,7 +1797,7 @@ CREATE VIEW table_privileges AS
17971797
CAST(CASE WHEN c.prtype = 'SELECT' THEN 'YES' ELSE 'NO' END AS yes_or_no) AS with_hierarchy
17981798

17991799
FROM (
1800-
SELECT oid, relname, relnamespace, relkind, relowner, (aclexplode(relacl)).* FROM pg_class
1800+
SELECT oid, relname, relnamespace, relkind, relowner, (aclexplode(coalesce(relacl, acldefault('r', relowner)))).* FROM pg_class
18011801
) AS c (oid, relname, relnamespace, relkind, relowner, grantor, grantee, prtype, grantable),
18021802
pg_namespace nc,
18031803
pg_authid u_grantor,
@@ -2043,7 +2043,7 @@ CREATE VIEW udt_privileges AS
20432043
THEN 'YES' ELSE 'NO' END AS yes_or_no) AS is_grantable
20442044

20452045
FROM (
2046-
SELECT oid, typname, typnamespace, typtype, typowner, (aclexplode(typacl)).* FROM pg_type
2046+
SELECT oid, typname, typnamespace, typtype, typowner, (aclexplode(coalesce(typacl, acldefault('T', typowner)))).* FROM pg_type
20472047
) AS t (oid, typname, typnamespace, typtype, typowner, grantor, grantee, prtype, grantable),
20482048
pg_namespace n,
20492049
pg_authid u_grantor,
@@ -2129,7 +2129,7 @@ CREATE VIEW usage_privileges AS
21292129
THEN 'YES' ELSE 'NO' END AS yes_or_no) AS is_grantable
21302130

21312131
FROM (
2132-
SELECT oid, typname, typnamespace, typtype, typowner, (aclexplode(typacl)).* FROM pg_type
2132+
SELECT oid, typname, typnamespace, typtype, typowner, (aclexplode(coalesce(typacl, acldefault('T', typowner)))).* FROM pg_type
21332133
) AS t (oid, typname, typnamespace, typtype, typowner, grantor, grantee, prtype, grantable),
21342134
pg_namespace n,
21352135
pg_authid u_grantor,
@@ -2166,7 +2166,7 @@ CREATE VIEW usage_privileges AS
21662166
THEN 'YES' ELSE 'NO' END AS yes_or_no) AS is_grantable
21672167

21682168
FROM (
2169-
SELECT fdwname, fdwowner, (aclexplode(fdwacl)).* FROM pg_foreign_data_wrapper
2169+
SELECT fdwname, fdwowner, (aclexplode(coalesce(fdwacl, acldefault('F', fdwowner)))).* FROM pg_foreign_data_wrapper
21702170
) AS fdw (fdwname, fdwowner, grantor, grantee, prtype, grantable),
21712171
pg_authid u_grantor,
21722172
(
@@ -2200,7 +2200,7 @@ CREATE VIEW usage_privileges AS
22002200
THEN 'YES' ELSE 'NO' END AS yes_or_no) AS is_grantable
22012201

22022202
FROM (
2203-
SELECT srvname, srvowner, (aclexplode(srvacl)).* FROM pg_foreign_server
2203+
SELECT srvname, srvowner, (aclexplode(coalesce(srvacl, acldefault('S', srvowner)))).* FROM pg_foreign_server
22042204
) AS srv (srvname, srvowner, grantor, grantee, prtype, grantable),
22052205
pg_authid u_grantor,
22062206
(

‎src/backend/utils/adt/acl.c

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -834,6 +834,64 @@ acldefault(GrantObjectType objtype, Oid ownerId)
834834
}
835835

836836

837+
/*
838+
* SQL-accessible version of acldefault(). Hackish mapping from "char" type to
839+
* ACL_OBJECT_* values, but it's only used in the information schema, not
840+
* documented for general use.
841+
*/
842+
Datum
843+
acldefault_sql(PG_FUNCTION_ARGS)
844+
{
845+
char objtypec = PG_GETARG_CHAR(0);
846+
Oid owner = PG_GETARG_OID(1);
847+
GrantObjectType objtype = 0;
848+
849+
switch (objtypec)
850+
{
851+
case 'c':
852+
objtype = ACL_OBJECT_COLUMN;
853+
break;
854+
case 'r':
855+
objtype = ACL_OBJECT_RELATION;
856+
break;
857+
case 's':
858+
objtype = ACL_OBJECT_SEQUENCE;
859+
break;
860+
case 'd':
861+
objtype = ACL_OBJECT_DATABASE;
862+
break;
863+
case 'f':
864+
objtype = ACL_OBJECT_FUNCTION;
865+
break;
866+
case 'l':
867+
objtype = ACL_OBJECT_LANGUAGE;
868+
break;
869+
case 'L':
870+
objtype = ACL_OBJECT_LARGEOBJECT;
871+
break;
872+
case 'n':
873+
objtype = ACL_OBJECT_NAMESPACE;
874+
break;
875+
case 't':
876+
objtype = ACL_OBJECT_TABLESPACE;
877+
break;
878+
case 'F':
879+
objtype = ACL_OBJECT_FDW;
880+
break;
881+
case 'S':
882+
objtype = ACL_OBJECT_FOREIGN_SERVER;
883+
break;
884+
case 'T':
885+
objtype = ACL_OBJECT_TYPE;
886+
break;
887+
default:
888+
elog(ERROR, "unrecognized objtype abbreviation: %c", objtypec);
889+
}
890+
891+
PG_RETURN_ACL_P(acldefault(objtype, owner));
892+
}
893+
894+
837895
/*
838896
* Update an ACL array to add or remove specified privileges.
839897
*

‎src/include/catalog/catversion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/* yyyymmddN */
56-
#define CATALOG_VERSION_NO 201201262
56+
#define CATALOG_VERSION_NO 201201271
5757

5858
#endif

‎src/include/catalog/pg_proc.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1094,6 +1094,8 @@ DESCR("contains");
10941094
DATA(insert OID = 1062 ( aclitemeq PGNSP PGUID 12 1 0 0 0 f f f t f i 2 0 16 "1033 1033" _null_ _null_ _null_ _null_ aclitem_eq _null_ _null_ _null_ ));
10951095
DATA(insert OID = 1365 ( makeaclitem PGNSP PGUID 12 1 0 0 0 f f f t f i 4 0 1033 "26 26 25 16" _null_ _null_ _null_ _null_ makeaclitem _null_ _null_ _null_ ));
10961096
DESCR("make ACL item");
1097+
DATA(insert OID = 3943 ( acldefault PGNSP PGUID 12 1 0 0 0 f f f t f i 2 0 1034 "18 26" _null_ _null_ _null_ _null_ acldefault_sql _null_ _null_ _null_ ));
1098+
DESCR("TODO");
10971099
DATA(insert OID = 1689 ( aclexplode PGNSP PGUID 12 1 10 0 0 f f f t t s 1 0 2249 "1034" "{1034,26,26,25,16}" "{i,o,o,o,o}" "{acl,grantor,grantee,privilege_type,is_grantable}" _null_ aclexplode _null_ _null_ _null_ ));
10981100
DESCR("convert ACL item array to table, for use by information schema");
10991101
DATA(insert OID = 1044 ( bpcharin PGNSP PGUID 12 1 0 0 0 f f f t f i 3 0 1042 "2275 26 23" _null_ _null_ _null_ _null_ bpcharin _null_ _null_ _null_ ));

‎src/include/utils/acl.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,7 @@ extern Datum aclcontains(PG_FUNCTION_ARGS);
245245
extern Datum makeaclitem(PG_FUNCTION_ARGS);
246246
extern Datum aclitem_eq(PG_FUNCTION_ARGS);
247247
extern Datum hash_aclitem(PG_FUNCTION_ARGS);
248+
extern Datum acldefault_sql(PG_FUNCTION_ARGS);
248249
extern Datum aclexplode(PG_FUNCTION_ARGS);
249250

250251
/*

‎src/test/regress/expected/foreign_data.out

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -896,7 +896,7 @@ SELECT * FROM information_schema.user_mapping_options ORDER BY lower(authorizati
896896
regress_test_role | regression | t1 | username | bob
897897
(7 rows)
898898

899-
SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIGN%' ORDER BY 1, 2, 3, 4, 5;
899+
SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIGN%' AND object_name IN ('s6', 'foo') ORDER BY 1, 2, 3, 4, 5;
900900
grantor | grantee | object_catalog | object_schema | object_name | object_type | privilege_type | is_grantable
901901
-------------------+-----------------------+----------------+---------------+-------------+----------------------+----------------+--------------
902902
foreign_data_user | foreign_data_user | regression | | foo | FOREIGN DATA WRAPPER | USAGE | YES
@@ -905,7 +905,7 @@ SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIG
905905
foreign_data_user | regress_test_role2 | regression | | s6 | FOREIGN SERVER | USAGE | YES
906906
(4 rows)
907907

908-
SELECT * FROM information_schema.role_usage_grants WHERE object_type LIKE 'FOREIGN%' ORDER BY 1, 2, 3, 4, 5;
908+
SELECT * FROM information_schema.role_usage_grants WHERE object_type LIKE 'FOREIGN%' AND object_name IN ('s6', 'foo') ORDER BY 1, 2, 3, 4, 5;
909909
grantor | grantee | object_catalog | object_schema | object_name | object_type | privilege_type | is_grantable
910910
-------------------+-----------------------+----------------+---------------+-------------+----------------------+----------------+--------------
911911
foreign_data_user | foreign_data_user | regression | | foo | FOREIGN DATA WRAPPER | USAGE | YES
@@ -939,14 +939,14 @@ SELECT * FROM information_schema.user_mapping_options ORDER BY 1, 2, 3, 4;
939939
regress_test_role | regression | t1 | username | bob
940940
(5 rows)
941941

942-
SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIGN%' ORDER BY 1, 2, 3, 4, 5;
942+
SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIGN%' AND object_name IN ('s6', 'foo') ORDER BY 1, 2, 3, 4, 5;
943943
grantor | grantee | object_catalog | object_schema | object_name | object_type | privilege_type | is_grantable
944944
-------------------+-----------------------+----------------+---------------+-------------+----------------------+----------------+--------------
945945
foreign_data_user | regress_test_indirect | regression | | foo | FOREIGN DATA WRAPPER | USAGE | NO
946946
foreign_data_user | regress_test_role2 | regression | | s6 | FOREIGN SERVER | USAGE | YES
947947
(2 rows)
948948

949-
SELECT * FROM information_schema.role_usage_grants WHERE object_type LIKE 'FOREIGN%' ORDER BY 1, 2, 3, 4, 5;
949+
SELECT * FROM information_schema.role_usage_grants WHERE object_type LIKE 'FOREIGN%' AND object_name IN ('s6', 'foo') ORDER BY 1, 2, 3, 4, 5;
950950
grantor | grantee | object_catalog | object_schema | object_name | object_type | privilege_type | is_grantable
951951
-------------------+-----------------------+----------------+---------------+-------------+----------------------+----------------+--------------
952952
foreign_data_user | regress_test_indirect | regression | | foo | FOREIGN DATA WRAPPER | USAGE | NO

‎src/test/regress/sql/foreign_data.sql

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -362,14 +362,14 @@ SELECT * FROM information_schema.foreign_servers ORDER BY 1, 2;
362362
SELECT * FROM information_schema.foreign_server_options ORDER BY 1, 2, 3;
363363
SELECT * FROM information_schema.user_mappings ORDER BY lower(authorization_identifier), 2, 3;
364364
SELECT * FROM information_schema.user_mapping_options ORDER BY lower(authorization_identifier), 2, 3, 4;
365-
SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIGN%' ORDER BY 1, 2, 3, 4, 5;
366-
SELECT * FROM information_schema.role_usage_grants WHERE object_type LIKE 'FOREIGN%' ORDER BY 1, 2, 3, 4, 5;
365+
SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIGN%' AND object_name IN ('s6', 'foo') ORDER BY 1, 2, 3, 4, 5;
366+
SELECT * FROM information_schema.role_usage_grants WHERE object_type LIKE 'FOREIGN%' AND object_name IN ('s6', 'foo') ORDER BY 1, 2, 3, 4, 5;
367367
SELECT * FROM information_schema.foreign_tables ORDER BY 1, 2, 3;
368368
SELECT * FROM information_schema.foreign_table_options ORDER BY 1, 2, 3, 4;
369369
SET ROLE regress_test_role;
370370
SELECT * FROM information_schema.user_mapping_options ORDER BY 1, 2, 3, 4;
371-
SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIGN%' ORDER BY 1, 2, 3, 4, 5;
372-
SELECT * FROM information_schema.role_usage_grants WHERE object_type LIKE 'FOREIGN%' ORDER BY 1, 2, 3, 4, 5;
371+
SELECT * FROM information_schema.usage_privileges WHERE object_type LIKE 'FOREIGN%' AND object_name IN ('s6', 'foo') ORDER BY 1, 2, 3, 4, 5;
372+
SELECT * FROM information_schema.role_usage_grants WHERE object_type LIKE 'FOREIGN%' AND object_name IN ('s6', 'foo') ORDER BY 1, 2, 3, 4, 5;
373373
DROP USER MAPPING FOR current_user SERVER t1;
374374
SET ROLE regress_test_role2;
375375
SELECT * FROM information_schema.user_mapping_options ORDER BY 1, 2, 3, 4;

0 commit comments

Comments
 (0)