diff options
| author | Stephen Frost <sfrost@snowman.net> | 2015-03-19 15:02:33 -0400 |
|---|---|---|
| committer | Stephen Frost <sfrost@snowman.net> | 2015-03-19 15:02:33 -0400 |
| commit | bf038899965263dbc4aef2b43c8fdfe6f49b788f (patch) | |
| tree | f69bedcc39eee9b9916047915de92e00d8448761 /src/backend/utils/adt/pgstatfuncs.c | |
| parent | 12968cf4085409c50f70c6643d92befdb34008f6 (diff) | |
| download | postgresql-bf038899965263dbc4aef2b43c8fdfe6f49b788f.tar.gz postgresql-bf038899965263dbc4aef2b43c8fdfe6f49b788f.zip | |
GetUserId() changes to has_privs_of_role()
The pg_stat and pg_signal-related functions have been using GetUserId()
instead of has_privs_of_role() for checking if the current user should
be able to see details in pg_stat_activity or signal other processes,
requiring a user to do 'SET ROLE' for inheirited roles for a permissions
check, unlike other permissions checks.
This patch changes that behavior to, instead, act like most other
permission checks and use has_privs_of_role(), removing the 'SET ROLE'
need. Documentation and error messages updated accordingly.
Per discussion with Alvaro, Peter, Adam (though not using Adam's patch),
and Robert.
Reviewed by Jeevan Chalke.
Diffstat (limited to 'src/backend/utils/adt/pgstatfuncs.c')
| -rw-r--r-- | src/backend/utils/adt/pgstatfuncs.c | 19 |
1 files changed, 10 insertions, 9 deletions
diff --git a/src/backend/utils/adt/pgstatfuncs.c b/src/backend/utils/adt/pgstatfuncs.c index 9964c5e1032..78adb2d853c 100644 --- a/src/backend/utils/adt/pgstatfuncs.c +++ b/src/backend/utils/adt/pgstatfuncs.c @@ -20,6 +20,7 @@ #include "libpq/ip.h" #include "miscadmin.h" #include "pgstat.h" +#include "utils/acl.h" #include "utils/builtins.h" #include "utils/inet.h" #include "utils/timestamp.h" @@ -675,8 +676,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS) else nulls[15] = true; - /* Values only available to same user or superuser */ - if (superuser() || beentry->st_userid == GetUserId()) + /* Values only available to role member */ + if (has_privs_of_role(GetUserId(), beentry->st_userid)) { SockAddr zero_clientaddr; @@ -878,7 +879,7 @@ pg_stat_get_backend_activity(PG_FUNCTION_ARGS) if ((beentry = pgstat_fetch_stat_beentry(beid)) == NULL) activity = "<backend information not available>"; - else if (!superuser() && beentry->st_userid != GetUserId()) + else if (!has_privs_of_role(GetUserId(), beentry->st_userid)) activity = "<insufficient privilege>"; else if (*(beentry->st_activity) == '\0') activity = "<command string not enabled>"; @@ -899,7 +900,7 @@ pg_stat_get_backend_waiting(PG_FUNCTION_ARGS) if ((beentry = pgstat_fetch_stat_beentry(beid)) == NULL) PG_RETURN_NULL(); - if (!superuser() && beentry->st_userid != GetUserId()) + if (!has_privs_of_role(GetUserId(), beentry->st_userid)) PG_RETURN_NULL(); result = beentry->st_waiting; @@ -918,7 +919,7 @@ pg_stat_get_backend_activity_start(PG_FUNCTION_ARGS) if ((beentry = pgstat_fetch_stat_beentry(beid)) == NULL) PG_RETURN_NULL(); - if (!superuser() && beentry->st_userid != GetUserId()) + if (!has_privs_of_role(GetUserId(), beentry->st_userid)) PG_RETURN_NULL(); result = beentry->st_activity_start_timestamp; @@ -944,7 +945,7 @@ pg_stat_get_backend_xact_start(PG_FUNCTION_ARGS) if ((beentry = pgstat_fetch_stat_beentry(beid)) == NULL) PG_RETURN_NULL(); - if (!superuser() && beentry->st_userid != GetUserId()) + if (!has_privs_of_role(GetUserId(), beentry->st_userid)) PG_RETURN_NULL(); result = beentry->st_xact_start_timestamp; @@ -966,7 +967,7 @@ pg_stat_get_backend_start(PG_FUNCTION_ARGS) if ((beentry = pgstat_fetch_stat_beentry(beid)) == NULL) PG_RETURN_NULL(); - if (!superuser() && beentry->st_userid != GetUserId()) + if (!has_privs_of_role(GetUserId(), beentry->st_userid)) PG_RETURN_NULL(); result = beentry->st_proc_start_timestamp; @@ -990,7 +991,7 @@ pg_stat_get_backend_client_addr(PG_FUNCTION_ARGS) if ((beentry = pgstat_fetch_stat_beentry(beid)) == NULL) PG_RETURN_NULL(); - if (!superuser() && beentry->st_userid != GetUserId()) + if (!has_privs_of_role(GetUserId(), beentry->st_userid)) PG_RETURN_NULL(); /* A zeroed client addr means we don't know */ @@ -1037,7 +1038,7 @@ pg_stat_get_backend_client_port(PG_FUNCTION_ARGS) if ((beentry = pgstat_fetch_stat_beentry(beid)) == NULL) PG_RETURN_NULL(); - if (!superuser() && beentry->st_userid != GetUserId()) + if (!has_privs_of_role(GetUserId(), beentry->st_userid)) PG_RETURN_NULL(); /* A zeroed client addr means we don't know */ |