Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 2822788

Browse files
tglsfdctglsfdc
committed
Accept SET SESSION AUTHORIZATION DEFAULT and RESET SESSION AUTHORIZATION
to reset session userid to the originally-authenticated name. Also, relax SET SESSION AUTHORIZATION to allow specifying one's own username even if one is not superuser, so as to avoid unnecessary error messages when loading a pg_dump file that uses this command. Per discussion from several months ago.
1 parent 15162ae commit 2822788

File tree

4 files changed

+88
-27
lines changed

4 files changed

+88
-27
lines changed

‎doc/src/sgml/ref/set_session_auth.sgml

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/ref/set_session_auth.sgml,v 1.4 2002/01/20 22:19:57 petere Exp $ -->
1+
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/ref/set_session_auth.sgml,v 1.5 2002/05/06 19:47:30 tgl Exp $ -->
22
<refentry id="SQL-SET-SESSION-AUTHORIZATION">
33
<docinfo>
44
<date>2001-04-21</date>
@@ -16,7 +16,9 @@
1616

1717
<refsynopsisdiv>
1818
<synopsis>
19-
SET SESSION AUTHORIZATION '<parameter>username</parameter>'
19+
SET SESSION AUTHORIZATION <parameter>username</parameter>
20+
SET SESSION AUTHORIZATION DEFAULT
21+
RESET SESSION AUTHORIZATION
2022
</synopsis>
2123
</refsynopsisdiv>
2224

@@ -26,7 +28,11 @@ SET SESSION AUTHORIZATION '<parameter>username</parameter>'
2628
<para>
2729
This command sets the session user identifier and the current user
2830
identifier of the current SQL-session context to be
29-
<parameter>username</parameter>.
31+
<parameter>username</parameter>. The user name may be written as
32+
either an identifier or a string literal.
33+
The session user identifier is valid for the duration of a
34+
connection; for example, it is possible to temporarily become an
35+
unprivileged user and later switch back to become a superuser.
3036
</para>
3137

3238
<para>
@@ -39,12 +45,18 @@ SET SESSION AUTHORIZATION '<parameter>username</parameter>'
3945
</para>
4046

4147
<para>
42-
Execution of this command is only permitted if the initial session
48+
The session user identifier may be changed only if the initial session
4349
user (the <firstterm>authenticated user</firstterm>) had the
44-
superuser privilege. This permission is kept for the duration of a
45-
connection; for example, it is possible to temporarily become an
46-
unprivileged user and later switch back to become a superuser.
50+
superuser privilege. Otherwise, the command is accepted only if it
51+
specifies the authenticated username.
4752
</para>
53+
54+
<para>
55+
The <literal>DEFAULT</> and <literal>RESET</> forms reset the session
56+
and current user identifiers to be the originally authenticated user
57+
name. These forms are always accepted.
58+
</para>
59+
4860
</refsect1>
4961

5062
<refsect1>

‎src/backend/commands/variable.c

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
*
1010
*
1111
* IDENTIFICATION
12-
* $Header: /cvsroot/pgsql/src/backend/commands/variable.c,v 1.65 2002/04/22 15:13:53 thomas Exp $
12+
* $Header: /cvsroot/pgsql/src/backend/commands/variable.c,v 1.66 2002/05/06 19:47:30 tgl Exp $
1313
*
1414
*-------------------------------------------------------------------------
1515
*/
@@ -815,6 +815,15 @@ reset_server_encoding(void)
815815
}
816816

817817

818+
static bool
819+
show_session_authorization(void)
820+
{
821+
elog(INFO, "Current session authorization is '%s'",
822+
GetUserName(GetSessionUserId()));
823+
return TRUE;
824+
}
825+
826+
818827

819828
/* SetPGVariable()
820829
* Dispatcher for handling SET commands.
@@ -902,6 +911,8 @@ GetPGVariable(const char *name)
902911
show_server_encoding();
903912
else if (strcasecmp(name, "seed") == 0)
904913
show_random_seed();
914+
else if (strcasecmp(name, "session_authorization") == 0)
915+
show_session_authorization();
905916
else if (strcasecmp(name, "all") == 0)
906917
{
907918
ShowAllGUCConfig();
@@ -935,13 +946,16 @@ ResetPGVariable(const char *name)
935946
reset_server_encoding();
936947
else if (strcasecmp(name, "seed") == 0)
937948
reset_random_seed();
949+
else if (strcasecmp(name, "session_authorization") == 0)
950+
SetSessionAuthorization(NULL);
938951
else if (strcasecmp(name, "all") == 0)
939952
{
940953
reset_random_seed();
941954
/* reset_server_encoding(); */
942955
reset_client_encoding();
943956
reset_datestyle();
944957
reset_timezone();
958+
/* should we reset session authorization here? */
945959

946960
ResetAllOptions(false);
947961
}

‎src/backend/parser/gram.y

Lines changed: 23 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $Header: /cvsroot/pgsql/src/backend/parser/gram.y,v 2.312 2002/05/03 00:32:16 tgl Exp $
14+
* $Header: /cvsroot/pgsql/src/backend/parser/gram.y,v 2.313 2002/05/06 19:47:30 tgl Exp $
1515
*
1616
* HISTORY
1717
* AUTHOR DATE MAJOR EVENT
@@ -281,7 +281,7 @@ static void doNegateFloat(Value *v);
281281
%type <ival> Iconst
282282
%type <str> Sconst, comment_text
283283
%type <str> UserId, opt_boolean, ColId_or_Sconst
284-
%type <list> var_list
284+
%type <list> var_list, var_list_or_default
285285
%type <str> ColId, ColLabel, type_name
286286
%type <node> var_value, zone_value
287287

@@ -833,14 +833,14 @@ schema_stmt: CreateStmt
833833
*
834834
*****************************************************************************/
835835

836-
VariableSetStmt: SET ColId TO var_list
836+
VariableSetStmt: SET ColId TO var_list_or_default
837837
{
838838
VariableSetStmt *n = makeNode(VariableSetStmt);
839839
n->name = $2;
840840
n->args = $4;
841841
$$ = (Node *) n;
842842
}
843-
| SET ColId '=' var_list
843+
| SET ColId '=' var_list_or_default
844844
{
845845
VariableSetStmt *n = makeNode(VariableSetStmt);
846846
n->name = $2;
@@ -884,14 +884,25 @@ VariableSetStmt: SET ColId TO var_list
884884
n->args = makeList1(makeStringConst($4, NULL));
885885
$$ = (Node *) n;
886886
}
887+
| SET SESSION AUTHORIZATION DEFAULT
888+
{
889+
VariableSetStmt *n = makeNode(VariableSetStmt);
890+
n->name = "session_authorization";
891+
n->args = NIL;
892+
$$ = (Node *) n;
893+
}
894+
;
895+
896+
var_list_or_default: var_list
897+
{ $$ = $1; }
898+
| DEFAULT
899+
{ $$ = NIL; }
887900
;
888901

889902
var_list: var_value
890903
{ $$ = makeList1($1); }
891904
| var_list ',' var_value
892905
{ $$ = lappend($1, $3); }
893-
| DEFAULT
894-
{ $$ = NIL; }
895906
;
896907

897908
var_value: opt_boolean
@@ -1017,6 +1028,12 @@ VariableResetStmt: RESET ColId
10171028
n->name = "XactIsoLevel";
10181029
$$ = (Node *) n;
10191030
}
1031+
| RESET SESSION AUTHORIZATION
1032+
{
1033+
VariableResetStmt *n = makeNode(VariableResetStmt);
1034+
n->name = "session_authorization";
1035+
$$ = (Node *) n;
1036+
}
10201037
| RESET ALL
10211038
{
10221039
VariableResetStmt *n = makeNode(VariableResetStmt);

‎src/backend/utils/init/miscinit.c

Lines changed: 31 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $Header: /cvsroot/pgsql/src/backend/utils/init/miscinit.c,v 1.89 2002/05/05 00:03:29 tgl Exp $
11+
* $Header: /cvsroot/pgsql/src/backend/utils/init/miscinit.c,v 1.90 2002/05/06 19:47:30 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -529,15 +529,17 @@ GetCharSetByHost(char *TableName, int host, const char *DataDir)
529529
/* ----------------------------------------------------------------
530530
* User ID things
531531
*
532-
* The session user is determined at connection start and never
533-
* changes. The current user may change when "setuid" functions
532+
* The authenticated user is determined at connection start and never
533+
* changes. The session user can be changed only by SET SESSION
534+
* AUTHORIZATION. The current user may change when "setuid" functions
534535
* are implemented. Conceptually there is a stack, whose bottom
535536
* is the session user. You are yourself responsible to save and
536537
* restore the current user id if you need to change it.
537538
* ----------------------------------------------------------------
538539
*/
539-
static Oid CurrentUserId = InvalidOid;
540+
static Oid AuthenticatedUserId = InvalidOid;
540541
static Oid SessionUserId = InvalidOid;
542+
static Oid CurrentUserId = InvalidOid;
541543

542544
static bool AuthenticatedUserIsSuperuser = false;
543545

@@ -588,6 +590,7 @@ InitializeSessionUserId(const char *username)
588590
HeapTuple userTup;
589591
Datum datum;
590592
bool isnull;
593+
Oid usesysid;
591594

592595
/*
593596
* Don't do scans if we're bootstrapping, none of the system catalogs
@@ -596,18 +599,22 @@ InitializeSessionUserId(const char *username)
596599
AssertState(!IsBootstrapProcessingMode());
597600

598601
/* call only once */
599-
AssertState(!OidIsValid(SessionUserId));
602+
AssertState(!OidIsValid(AuthenticatedUserId));
600603

601604
userTup = SearchSysCache(SHADOWNAME,
602605
PointerGetDatum(username),
603606
0, 0, 0);
604607
if (!HeapTupleIsValid(userTup))
605608
elog(FATAL, "user \"%s\" does not exist", username);
606609

607-
SetSessionUserId(((Form_pg_shadow) GETSTRUCT(userTup))->usesysid);
610+
usesysid = ((Form_pg_shadow) GETSTRUCT(userTup))->usesysid;
608611

612+
AuthenticatedUserId = usesysid;
609613
AuthenticatedUserIsSuperuser = ((Form_pg_shadow) GETSTRUCT(userTup))->usesuper;
610614

615+
SetSessionUserId(usesysid); /* sets CurrentUserId too */
616+
617+
611618
/*
612619
* Set up user-specific configuration variables. This is a good
613620
* place to do it so we don't have to read pg_shadow twice during
@@ -633,25 +640,36 @@ InitializeSessionUserIdStandalone(void)
633640
AssertState(!IsUnderPostmaster);
634641

635642
/* call only once */
636-
AssertState(!OidIsValid(SessionUserId));
643+
AssertState(!OidIsValid(AuthenticatedUserId));
637644

638-
SetSessionUserId(BOOTSTRAP_USESYSID);
645+
AuthenticatedUserId = BOOTSTRAP_USESYSID;
639646
AuthenticatedUserIsSuperuser = true;
647+
648+
SetSessionUserId(BOOTSTRAP_USESYSID);
640649
}
641650

642651

643652
/*
644653
* Change session auth ID while running
654+
*
655+
* Only a superuser may set auth ID to something other than himself.
656+
*
657+
* username == NULL implies reset to default (AuthenticatedUserId).
645658
*/
646659
void
647660
SetSessionAuthorization(const char *username)
648661
{
649-
int32 userid;
650-
651-
if (!AuthenticatedUserIsSuperuser)
652-
elog(ERROR, "permission denied");
662+
Oid userid;
653663

654-
userid = get_usesysid(username);
664+
if (username == NULL)
665+
userid = AuthenticatedUserId;
666+
else
667+
{
668+
userid = get_usesysid(username);
669+
if (userid != AuthenticatedUserId &&
670+
!AuthenticatedUserIsSuperuser)
671+
elog(ERROR, "permission denied");
672+
}
655673

656674
SetSessionUserId(userid);
657675
SetUserId(userid);

0 commit comments

Comments
 (0)