pgsql: Use has_privs_for_roles for predefined role checks

From: Joe Conway <mail(at)joeconway(dot)com>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Use has_privs_for_roles for predefined role checks
Date: 2022-03-28 19:11:08
Message-ID: E1nYulf-001nTy-TU@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Use has_privs_for_roles for predefined role checks

Generally if a role is granted membership to another role with NOINHERIT
they must use SET ROLE to access the privileges of that role, however
with predefined roles the membership and privilege is conflated. Fix that
by replacing is_member_of_role with has_privs_for_role for predefined
roles. Patch does not remove is_member_of_role from acl.h, but it does
add a warning not to use that function for privilege checking. Not
backpatched based on hackers list discussion.

Author: Joshua Brindle
Reviewed-by: Stephen Frost, Nathan Bossart, Joe Conway
Discussion: https://postgr.es/m/flat/CAGB+Vh4Zv_TvKt2tv3QNS6tUM_F_9icmuj0zjywwcgVi4PAhFA(at)mail(dot)gmail(dot)com

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/6198420ad8a72e37f4fe4964616b17e0fd33b808

Modified Files
--------------
contrib/adminpack/adminpack.c | 2 +-
contrib/file_fdw/expected/file_fdw.out | 2 +-
contrib/file_fdw/file_fdw.c | 8 ++++----
contrib/pg_stat_statements/pg_stat_statements.c | 4 ++--
contrib/pgrowlocks/pgrowlocks.c | 2 +-
doc/src/sgml/adminpack.sgml | 6 +++---
doc/src/sgml/catalogs.sgml | 12 ++++++------
doc/src/sgml/func.sgml | 12 ++++++------
doc/src/sgml/monitoring.sgml | 2 +-
doc/src/sgml/pgbuffercache.sgml | 2 +-
doc/src/sgml/pgfreespacemap.sgml | 2 +-
doc/src/sgml/pgrowlocks.sgml | 2 +-
doc/src/sgml/pgstatstatements.sgml | 2 +-
doc/src/sgml/pgvisibility.sgml | 4 ++--
src/backend/commands/copy.c | 12 ++++++------
src/backend/replication/walreceiver.c | 8 ++++----
src/backend/replication/walsender.c | 8 ++++----
src/backend/utils/adt/acl.c | 4 ++++
src/backend/utils/adt/dbsize.c | 8 ++++----
src/backend/utils/adt/genfile.c | 6 +++---
src/backend/utils/adt/pgstatfuncs.c | 2 +-
src/backend/utils/misc/guc.c | 20 ++++++++++----------
src/test/modules/unsafe_tests/expected/rolenames.out | 2 +-
23 files changed, 68 insertions(+), 64 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Andrew Dunstan 2022-03-28 19:37:30 pgsql: IS JSON predicate
Previous Message Robert Haas 2022-03-28 18:31:02 pgsql: Remove the ability of a role to administer itself.