diff options
| author | Jeff Davis <jdavis@postgresql.org> | 2023-01-13 14:14:54 -0800 |
|---|---|---|
| committer | Jeff Davis <jdavis@postgresql.org> | 2023-01-13 14:33:19 -0800 |
| commit | c44f6334ca6ff6d242d9eb6742441bc4e1294067 (patch) | |
| tree | 96737157311289cfc4ffbebe74ada84016423a76 /src/backend/commands/lockcmds.c | |
| parent | b7ae03953690a1dee455ba3823cc8f71a72cbe1d (diff) | |
| download | postgresql-c44f6334ca6ff6d242d9eb6742441bc4e1294067.tar.gz postgresql-c44f6334ca6ff6d242d9eb6742441bc4e1294067.zip | |
Simplify permissions for LOCK TABLE.
The prior behavior was confusing and hard to document. For instance,
if you had UPDATE privileges, you could lock a table in any lock mode
except ACCESS SHARE mode.
Now, if granted a privilege to lock at a given mode, one also has
privileges to lock at a less-conflicting mode. MAINTAIN, UPDATE,
DELETE, and TRUNCATE privileges allow any lock mode. INSERT privileges
allow ROW EXCLUSIVE (or below). SELECT privileges allow ACCESS SHARE.
Reviewed-by: Nathan Bossart
Discussion: https://postgr.es/m/9550c76535404a83156252b25a11babb4792ea1e.camel%40j-davis.com
Diffstat (limited to 'src/backend/commands/lockcmds.c')
| -rw-r--r-- | src/backend/commands/lockcmds.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/src/backend/commands/lockcmds.c b/src/backend/commands/lockcmds.c index 99e68bff85d..410d78b040f 100644 --- a/src/backend/commands/lockcmds.c +++ b/src/backend/commands/lockcmds.c @@ -292,16 +292,16 @@ LockTableAclCheck(Oid reloid, LOCKMODE lockmode, Oid userid) AclResult aclresult; AclMode aclmask; - /* Verify adequate privilege */ - if (lockmode == AccessShareLock) - aclmask = ACL_SELECT; - else if (lockmode == RowExclusiveLock) - aclmask = ACL_INSERT | ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE; - else - aclmask = ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE; + /* any of these privileges permit any lock mode */ + aclmask = ACL_MAINTAIN | ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE; + + /* SELECT privileges also permit ACCESS SHARE and below */ + if (lockmode <= AccessShareLock) + aclmask |= ACL_SELECT; - /* MAINTAIN privilege allows all lock modes */ - aclmask |= ACL_MAINTAIN; + /* INSERT privileges also permit ROW EXCLUSIVE and below */ + if (lockmode <= RowExclusiveLock) + aclmask |= ACL_INSERT; aclresult = pg_class_aclcheck(reloid, userid, aclmask); |