From: Michael Paquier Date: Wed, 10 Jul 2024 01:14:37 +0000 (+0900) Subject: Extend pg_get_acl() to handle sub-object IDs X-Git-Tag: REL_18_BETA1~2428 X-Git-Url: http://git.postgresql.org/gitweb/?a=commitdiff_plain;h=d898665b;p=postgresql.git Extend pg_get_acl() to handle sub-object IDs This patch modifies the pg_get_acl() function to accept a third argument called "objsubid", bringing it on par with similar functions in this area like pg_describe_object(). This enables the retrieval of ACLs for relation attributes when scanning dependencies. Bump catalog version. Author: Joel Jacobson Discussion: https://postgr.es/m/f2539bff-64be-47f0-9f0b-df85d3cc0432@app.fastmail.com --- diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml index f1ce1db6bcd..135590ba574 100644 --- a/doc/src/sgml/func.sgml +++ b/doc/src/sgml/func.sgml @@ -26661,12 +26661,12 @@ SELECT currval(pg_get_serial_sequence('sometable', 'id')); pg_get_acl - pg_get_acl ( classid oid, objid oid ) + pg_get_acl ( classid oid, objid oid, objsubid integer ) aclitem[] Returns the ACL for a database object, specified - by catalog OID and object OID. This function returns + by catalog OID, object OID and sub-object ID. This function returns NULL values for undefined objects. @@ -26792,7 +26792,7 @@ SELECT currval(pg_get_serial_sequence('sometable', 'id')); postgres=# SELECT (pg_identify_object(s.classid,s.objid,s.objsubid)).*, - pg_catalog.pg_get_acl(s.classid,s.objid) AS acl + pg_catalog.pg_get_acl(s.classid,s.objid,s.objsubid) AS acl FROM pg_catalog.pg_shdepend AS s JOIN pg_catalog.pg_database AS d ON d.datname = current_database() AND diff --git a/src/backend/catalog/objectaddress.c b/src/backend/catalog/objectaddress.c index 2983b9180fc..85a7b7e641a 100644 --- a/src/backend/catalog/objectaddress.c +++ b/src/backend/catalog/objectaddress.c @@ -4364,19 +4364,19 @@ pg_identify_object_as_address(PG_FUNCTION_ARGS) /* * SQL-level callable function to obtain the ACL of a specified object, given - * its catalog OID and object OID. + * its catalog OID, object OID and sub-object ID. */ Datum pg_get_acl(PG_FUNCTION_ARGS) { Oid classId = PG_GETARG_OID(0); Oid objectId = PG_GETARG_OID(1); + int32 objsubid = PG_GETARG_INT32(2); Oid catalogId; AttrNumber Anum_acl; - Relation rel; - HeapTuple tup; Datum datum; bool isnull; + HeapTuple tup; /* for "pinned" items in pg_depend, return null */ if (!OidIsValid(classId) && !OidIsValid(objectId)) @@ -4391,19 +4391,40 @@ pg_get_acl(PG_FUNCTION_ARGS) if (Anum_acl == InvalidAttrNumber) PG_RETURN_NULL(); - rel = table_open(catalogId, AccessShareLock); + /* + * If dealing with a relation's attribute (objsubid is set), the ACL is + * retrieved from pg_attribute. + */ + if (classId == RelationRelationId && objsubid != 0) + { + AttrNumber attnum = (AttrNumber) objsubid; - tup = get_catalog_object_by_oid(rel, get_object_attnum_oid(catalogId), - objectId); - if (!HeapTupleIsValid(tup)) + tup = SearchSysCacheCopyAttNum(objectId, attnum); + + if (!HeapTupleIsValid(tup)) + PG_RETURN_NULL(); + + datum = SysCacheGetAttr(ATTNUM, tup, Anum_pg_attribute_attacl, + &isnull); + } + else { + Relation rel; + + rel = table_open(catalogId, AccessShareLock); + + tup = get_catalog_object_by_oid(rel, get_object_attnum_oid(catalogId), + objectId); + if (!HeapTupleIsValid(tup)) + { + table_close(rel, AccessShareLock); + PG_RETURN_NULL(); + } + + datum = heap_getattr(tup, Anum_acl, RelationGetDescr(rel), &isnull); table_close(rel, AccessShareLock); - PG_RETURN_NULL(); } - datum = heap_getattr(tup, Anum_acl, RelationGetDescr(rel), &isnull); - table_close(rel, AccessShareLock); - if (isnull) PG_RETURN_NULL(); diff --git a/src/include/catalog/catversion.h b/src/include/catalog/catversion.h index 06f43c496f3..87b52fffdde 100644 --- a/src/include/catalog/catversion.h +++ b/src/include/catalog/catversion.h @@ -57,6 +57,6 @@ */ /* yyyymmddN */ -#define CATALOG_VERSION_NO 202407091 +#define CATALOG_VERSION_NO 202407101 #endif diff --git a/src/include/catalog/pg_proc.dat b/src/include/catalog/pg_proc.dat index e899ed5e77e..0d140003e74 100644 --- a/src/include/catalog/pg_proc.dat +++ b/src/include/catalog/pg_proc.dat @@ -6364,7 +6364,7 @@ { oid => '8730', descr => 'get ACL for SQL object', proname => 'pg_get_acl', provolatile => 's', prorettype => '_aclitem', - proargtypes => 'oid oid', proargnames => '{classid,objid}', + proargtypes => 'oid oid int4', proargnames => '{classid,objid,objsubid}', prosrc => 'pg_get_acl' }, { oid => '3839', diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index 332bc584eb2..fab0cc800fc 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -213,7 +213,7 @@ SELECT * FROM atest1; (0 rows) CREATE TABLE atest2 (col1 varchar(10), col2 boolean); -SELECT pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid); +SELECT pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid, 0); pg_get_acl ------------ @@ -223,7 +223,7 @@ GRANT SELECT ON atest2 TO regress_priv_user2; GRANT UPDATE ON atest2 TO regress_priv_user3; GRANT INSERT ON atest2 TO regress_priv_user4 GRANTED BY CURRENT_USER; GRANT TRUNCATE ON atest2 TO regress_priv_user5 GRANTED BY CURRENT_ROLE; -SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid)); +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid, 0)); unnest ------------------------------------------------ regress_priv_user1=arwdDxtm/regress_priv_user1 @@ -234,13 +234,13 @@ SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid)); (5 rows) -- Invalid inputs -SELECT pg_get_acl('pg_class'::regclass, 0); -- null +SELECT pg_get_acl('pg_class'::regclass, 0, 0); -- null pg_get_acl ------------ (1 row) -SELECT pg_get_acl(0, 0); -- null +SELECT pg_get_acl(0, 0, 0); -- null pg_get_acl ------------ @@ -653,6 +653,30 @@ CREATE TABLE atest5 (one int, two int unique, three int, four int unique); CREATE TABLE atest6 (one int, two int, blue int); GRANT SELECT (one), INSERT (two), UPDATE (three) ON atest5 TO regress_priv_user4; GRANT ALL (one) ON atest5 TO regress_priv_user3; +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 1)); + unnest +-------------------------------------------- + regress_priv_user4=r/regress_priv_user1 + regress_priv_user3=arwx/regress_priv_user1 +(2 rows) + +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 2)); + unnest +----------------------------------------- + regress_priv_user4=a/regress_priv_user1 +(1 row) + +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 3)); + unnest +----------------------------------------- + regress_priv_user4=w/regress_priv_user1 +(1 row) + +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 4)); + unnest +-------- +(0 rows) + INSERT INTO atest5 VALUES (1,2,3); SET SESSION AUTHORIZATION regress_priv_user4; SELECT * FROM atest5; -- fail diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql index 980d19bde56..ae338e8cc8e 100644 --- a/src/test/regress/sql/privileges.sql +++ b/src/test/regress/sql/privileges.sql @@ -183,16 +183,16 @@ GRANT SELECT ON atest1 TO regress_priv_user3, regress_priv_user4; SELECT * FROM atest1; CREATE TABLE atest2 (col1 varchar(10), col2 boolean); -SELECT pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid); +SELECT pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid, 0); GRANT SELECT ON atest2 TO regress_priv_user2; GRANT UPDATE ON atest2 TO regress_priv_user3; GRANT INSERT ON atest2 TO regress_priv_user4 GRANTED BY CURRENT_USER; GRANT TRUNCATE ON atest2 TO regress_priv_user5 GRANTED BY CURRENT_ROLE; -SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid)); +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest2'::regclass::oid, 0)); -- Invalid inputs -SELECT pg_get_acl('pg_class'::regclass, 0); -- null -SELECT pg_get_acl(0, 0); -- null +SELECT pg_get_acl('pg_class'::regclass, 0, 0); -- null +SELECT pg_get_acl(0, 0, 0); -- null GRANT TRUNCATE ON atest2 TO regress_priv_user4 GRANTED BY regress_priv_user5; -- error @@ -439,6 +439,10 @@ CREATE TABLE atest5 (one int, two int unique, three int, four int unique); CREATE TABLE atest6 (one int, two int, blue int); GRANT SELECT (one), INSERT (two), UPDATE (three) ON atest5 TO regress_priv_user4; GRANT ALL (one) ON atest5 TO regress_priv_user3; +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 1)); +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 2)); +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 3)); +SELECT unnest(pg_get_acl('pg_class'::regclass, 'atest5'::regclass::oid, 4)); INSERT INTO atest5 VALUES (1,2,3);