From 7bae5a289c8fbe33aceb56f04e273eee2c1e7c39 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Tue, 5 Sep 2006 21:08:36 +0000 Subject: Get rid of the separate RULE privilege for tables: now only a table's owner can create or modify rules for the table. Do setRuleCheckAsUser() while loading rules into the relcache, rather than when defining a rule. This ensures that permission checks for tables referenced in a rule are done with respect to the current owner of the rule's table, whereas formerly ALTER TABLE OWNER would fail to update the permission checking for associated rules. Removal of separate RULE privilege is needed to prevent various scenarios in which a grantee of RULE privilege could effectively have any privilege of the table owner. For backwards compatibility, GRANT/REVOKE RULE is still accepted, but it doesn't do anything. Per discussion here: http://archives.postgresql.org/pgsql-hackers/2006-04/msg01138.php --- src/test/regress/expected/dependency.out | 16 ++++++++-------- src/test/regress/expected/privileges.out | 20 ++++---------------- src/test/regress/sql/privileges.sql | 8 +++----- 3 files changed, 15 insertions(+), 29 deletions(-) (limited to 'src/test') diff --git a/src/test/regress/expected/dependency.out b/src/test/regress/expected/dependency.out index ba65a351bc..82c1bf0138 100644 --- a/src/test/regress/expected/dependency.out +++ b/src/test/regress/expected/dependency.out @@ -68,19 +68,19 @@ NOTICE: CREATE TABLE / PRIMARY KEY will create implicit index "deptest_pkey" fo GRANT ALL ON deptest1 TO regression_user2; RESET SESSION AUTHORIZATION; \z deptest1 - Access privileges for database "regression" - Schema | Name | Type | Access privileges ---------+----------+-------+---------------------------------------------------------------------------------------------------------------------------------------- - public | deptest1 | table | {regression_user0=arwdRxt/regression_user0,regression_user1=a*r*w*d*R*x*t*/regression_user0,regression_user2=arwdRxt/regression_user1} + Access privileges for database "regression" + Schema | Name | Type | Access privileges +--------+----------+-------+------------------------------------------------------------------------------------------------------------------------------------ + public | deptest1 | table | {regression_user0=arwdxt/regression_user0,regression_user1=a*r*w*d*x*t*/regression_user0,regression_user2=arwdxt/regression_user1} (1 row) DROP OWNED BY regression_user1; -- all grants revoked \z deptest1 - Access privileges for database "regression" - Schema | Name | Type | Access privileges ---------+----------+-------+--------------------------------------------- - public | deptest1 | table | {regression_user0=arwdRxt/regression_user0} + Access privileges for database "regression" + Schema | Name | Type | Access privileges +--------+----------+-------+-------------------------------------------- + public | deptest1 | table | {regression_user0=arwdxt/regression_user0} (1 row) -- table was dropped diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index 201e8a11d3..5404969c60 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -301,7 +301,7 @@ select has_table_privilege('pg_authid','sel'); ERROR: unrecognized privilege type: "sel" select has_table_privilege(-999999,'pg_authid','update'); ERROR: role with OID 4293967297 does not exist -select has_table_privilege(1,'rule'); +select has_table_privilege(1,'select'); ERROR: relation with OID 1 does not exist -- superuser \c - @@ -331,11 +331,13 @@ from (select oid from pg_roles where rolname = current_user) as t2; t (1 row) +-- 'rule' privilege no longer exists, but for backwards compatibility +-- has_table_privilege still recognizes the keyword and says FALSE select has_table_privilege(current_user,t1.oid,'rule') from (select oid from pg_class where relname = 'pg_authid') as t1; has_table_privilege --------------------- - t + f (1 row) select has_table_privilege(current_user,t1.oid,'references') @@ -415,13 +417,6 @@ from (select oid from pg_roles where rolname = current_user) as t2; f (1 row) -select has_table_privilege(current_user,t1.oid,'rule') -from (select oid from pg_class where relname = 'pg_class') as t1; - has_table_privilege ---------------------- - f -(1 row) - select has_table_privilege(current_user,t1.oid,'references') from (select oid from pg_class where relname = 'pg_class') as t1; has_table_privilege @@ -497,13 +492,6 @@ from (select oid from pg_roles where rolname = current_user) as t2; f (1 row) -select has_table_privilege(current_user,t1.oid,'rule') -from (select oid from pg_class where relname = 'atest1') as t1; - has_table_privilege ---------------------- - f -(1 row) - select has_table_privilege(current_user,t1.oid,'references') from (select oid from pg_class where relname = 'atest1') as t1; has_table_privilege diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql index 3b96abe87e..4c0d9c43f2 100644 --- a/src/test/regress/sql/privileges.sql +++ b/src/test/regress/sql/privileges.sql @@ -214,7 +214,7 @@ select has_table_privilege('pg_shad','select'); select has_table_privilege('nosuchuser','pg_authid','select'); select has_table_privilege('pg_authid','sel'); select has_table_privilege(-999999,'pg_authid','update'); -select has_table_privilege(1,'rule'); +select has_table_privilege(1,'select'); -- superuser \c - @@ -227,6 +227,8 @@ from (select oid from pg_roles where rolname = current_user) as t2; select has_table_privilege(t2.oid,'pg_authid','delete') from (select oid from pg_roles where rolname = current_user) as t2; +-- 'rule' privilege no longer exists, but for backwards compatibility +-- has_table_privilege still recognizes the keyword and says FALSE select has_table_privilege(current_user,t1.oid,'rule') from (select oid from pg_class where relname = 'pg_authid') as t1; select has_table_privilege(current_user,t1.oid,'references') @@ -258,8 +260,6 @@ from (select oid from pg_roles where rolname = current_user) as t2; select has_table_privilege(t2.oid,'pg_class','delete') from (select oid from pg_roles where rolname = current_user) as t2; -select has_table_privilege(current_user,t1.oid,'rule') -from (select oid from pg_class where relname = 'pg_class') as t1; select has_table_privilege(current_user,t1.oid,'references') from (select oid from pg_class where relname = 'pg_class') as t1; @@ -286,8 +286,6 @@ from (select oid from pg_roles where rolname = current_user) as t2; select has_table_privilege(t2.oid,'atest1','delete') from (select oid from pg_roles where rolname = current_user) as t2; -select has_table_privilege(current_user,t1.oid,'rule') -from (select oid from pg_class where relname = 'atest1') as t1; select has_table_privilege(current_user,t1.oid,'references') from (select oid from pg_class where relname = 'atest1') as t1; -- cgit v1.2.1