aboutsummaryrefslogtreecommitdiff
path: root/src/backend/utils/adt/acl.c
Commit message (Collapse)AuthorAge
* pgindent run for 9.0Bruce Momjian2010-02-26
|
* Wrap calls to SearchSysCache and related functions using macros.Robert Haas2010-02-14
| | | | | | | | | | | | The purpose of this change is to eliminate the need for every caller of SearchSysCache, SearchSysCacheCopy, SearchSysCacheExists, GetSysCacheOid, and SearchSysCacheList to know the maximum number of allowable keys for a syscache entry (currently 4). This will make it far easier to increase the maximum number of keys in a future release should we choose to do so, and it makes the code shorter, too. Design and review by Tom Lane.
* Fix aclexplode to not explode on a zero-entry ACL array.Tom Lane2010-01-12
| | | | | | | | (An Assert is no substitute for thinking clearly :-() Minor style kibitzing too. Per report from Robert Treat.
* Update copyright for the year 2010.Bruce Momjian2010-01-02
|
* More cleanups for the recent large object permissions patch.Robert Haas2009-12-21
| | | | | | Rewrite or adjust various comments for clarity. Remove one bogus comment that doesn't reflect what the code actually does. Improve the description of the lo_compat_privileges option.
* Add large object access control.Itagaki Takahiro2009-12-11
| | | | | | | A new system catalog pg_largeobject_metadata manages ownership and access privileges of large objects. KaiGai Kohei, reviewed by Jaime Casanova.
* Speed up information schema privilege viewsPeter Eisentraut2009-12-05
| | | | | | | | | | | | | Instead of expensive cross joins to resolve the ACL, add table-returning function aclexplode() that expands the ACL into a useful form, and join against that. Also, implement the role_*_grants views as a thin layer over the respective *_privileges views instead of essentially repeating the same code twice. fixes bug #4596 by Joachim Wieland, with cleanup by me
* Create an ALTER DEFAULT PRIVILEGES command, which allows users to adjustTom Lane2009-10-05
| | | | | | | | | | | the privileges that will be applied to subsequently-created objects. Such adjustments are always per owning role, and can be restricted to objects created in particular schemas too. A notable benefit is that users can override the traditional default privilege settings, eg, the PUBLIC EXECUTE privilege traditionally granted by default for functions. Petr Jelinek
* Implement has_sequence_privilege()Joe Conway2009-08-03
| | | | | | | Add family of functions that did not exist earlier, mainly due to historical omission. Original patch by Abhijit Menon-Sen, with review and modifications by Joe Conway. catversion.h bumped.
* 8.4 pgindent run, with new combined Linux/FreeBSD/MinGW typedef listBruce Momjian2009-06-11
| | | | provided by Andrew.
* Clean up some loose ends from the column privileges patch: addTom Lane2009-02-06
| | | | | | | | | | | | | | | | | | | | | | has_column_privilege and has_any_column_privilege SQL functions; fix the information_schema views that are supposed to pay attention to column privileges; adjust pg_stats to show stats for any column you have select privilege on; and fix COPY to allow copying a subset of columns if the user has suitable per-column privileges for all the columns. To improve efficiency of some of the information_schema views, extend the has_xxx_privilege functions to allow inquiring about the OR of a set of privileges in just one call. This is just exposing capability that already existed in the underlying aclcheck routines. In passing, make the information_schema views report the owner's own privileges as being grantable, since Postgres assumes this even when the grant option bit is not set in the ACL. This is a longstanding oversight. Also, make the new has_xxx_privilege functions for foreign data objects follow the same coding conventions used by the older ones. Stephen Frost and Tom Lane
* Support column-level privileges, as required by SQL standard.Tom Lane2009-01-22
| | | | Stephen Frost, with help from KaiGai Kohei and others
* Update copyright for 2009.Bruce Momjian2009-01-01
|
* SQL/MED catalog manipulation facilitiesPeter Eisentraut2008-12-19
| | | | | | | | This doesn't do any remote or external things yet, but it gives modules like plproxy and dblink a standardized and future-proof system for managing their connection information. Martin Pihlak and Peter Eisentraut
* Arrange for the pg_foo_is_visible and has_foo_privilege families of functionsTom Lane2008-12-15
| | | | | | | | | | | to return NULL, instead of erroring out, if the target object is specified by OID and we can't find that OID in the catalogs. Since these functions operate internally on SnapshotNow rules, there is a race condition when using them in user queries: the query's MVCC snapshot might "see" a catalog row that's already committed dead, leading to a failure when the inquiry function is applied. Returning NULL should generally provide more convenient behavior. This issue has been complained of before, and in particular we are now seeing it in the regression tests due to another recent patch.
* Improve the plan cache invalidation mechanism to make it invalidate plansTom Lane2008-09-09
| | | | | | | | | when user-defined functions used in a plan are modified. Also invalidate plans when schemas, operators, or operator classes are modified; but for these cases we just invalidate everything rather than tracking exact dependencies, since these types of objects seldom change in a production database. Tom Lane; loosely based on a patch by Martin Pihlak.
* Create a separate grantable privilege for TRUNCATE, rather than having it beTom Lane2008-09-08
| | | | | | | always owner-only. The TRUNCATE privilege works identically to the DELETE privilege so far as interactions with the rest of the system go. Robert Haas
* Simplify and standardize conversions between TEXT datums and ordinary CTom Lane2008-03-25
| | | | | | | | | | | | | | | | | | | | strings. This patch introduces four support functions cstring_to_text, cstring_to_text_with_len, text_to_cstring, and text_to_cstring_buffer, and two macros CStringGetTextDatum and TextDatumGetCString. A number of existing macros that provided variants on these themes were removed. Most of the places that need to make such conversions now require just one function or macro call, in place of the multiple notational layers that used to be needed. There are no longer any direct calls of textout or textin, and we got most of the places that were using handmade conversions via memcpy (there may be a few still lurking, though). This commit doesn't make any serious effort to eliminate transient memory leaks caused by detoasting toasted text objects before they reach text_to_cstring. We changed PG_GETARG_TEXT_P to PG_GETARG_TEXT_PP in a few places where it was easy, but much more could be done. Brendan Jurd and Tom Lane
* Update copyrights in source tree to 2008.Bruce Momjian2008-01-01
|
* Replace direct assignments to VARATT_SIZEP(x) with SET_VARSIZE(x, len).Tom Lane2007-02-27
| | | | | | | | | | | Get rid of VARATT_SIZE and VARATT_DATA, which were simply redundant with VARSIZE and VARDATA, and as a consequence almost no code was using the longer names. Rename the length fields of struct varlena and various derived structures to catch anyplace that was accessing them directly; and clean up various places so caught. In itself this patch doesn't change any behavior at all, but it is necessary infrastructure if we hope to play any games with the representation of varlena headers. Greg Stark and Tom Lane
* Update CVS HEAD for 2007 copyright. Back branches are typically notBruce Momjian2007-01-05
| | | | back-stamped for this.
* Message style improvementsPeter Eisentraut2006-10-06
|
* Get rid of the separate RULE privilege for tables: now only a table's ownerTom Lane2006-09-05
| | | | | | | | | | | | | can create or modify rules for the table. Do setRuleCheckAsUser() while loading rules into the relcache, rather than when defining a rule. This ensures that permission checks for tables referenced in a rule are done with respect to the current owner of the rule's table, whereas formerly ALTER TABLE OWNER would fail to update the permission checking for associated rules. Removal of separate RULE privilege is needed to prevent various scenarios in which a grantee of RULE privilege could effectively have any privilege of the table owner. For backwards compatibility, GRANT/REVOKE RULE is still accepted, but it doesn't do anything. Per discussion here: http://archives.postgresql.org/pgsql-hackers/2006-04/msg01138.php
* Remove 576 references of include files that were not needed.Bruce Momjian2006-07-14
|
* Code review for GRANT CONNECT patch. Spell the privilege as CONNECT notTom Lane2006-04-30
| | | | | CONNECTION, fix a number of places that were missed (eg pg_dump support), avoid executing an extra search of pg_database during startup.
* Add GRANT CONNECTION ON DATABASE, to be used in addition to pg_hba.conf.Bruce Momjian2006-04-30
| | | | Gevik Babakhani
* Update copyright for 2006. Update scripts.Bruce Momjian2006-03-05
|
* Add GRANT ON SEQUENCE syntax to support sequence-only permissions.Bruce Momjian2006-01-21
| | | | | | | | | | | | | Continue to support GRANT ON [TABLE] for sequences for backward compatibility; issue warning for invalid sequence permissions. [Backward compatibility warning message.] Add USAGE permission for sequences that allows only currval() and nextval(), not setval(). Mention object name in grant/revoke warnings because of possible multi-object operations.
* Mop-up for nulls-in-arrays patch: fix some places that access arrayTom Lane2005-11-18
| | | | contents directly.
* Make SQL arrays support null elements. This commit fixes the core arrayTom Lane2005-11-17
| | | | | | | | functionality, but I still need to make another pass looking at places that incidentally use arrays (such as ACL manipulation) to make sure they are null-safe. Contrib needs work too. I have not changed the behaviors that are still under discussion about array comparison and what to do with lower bounds.
* Disregard superuserness when checking to see if a role GRANT wouldTom Lane2005-11-04
| | | | | | | | | create circularity of role memberships. This is a minimum-impact fix for the problem reported by Florian Pflug. I thought about removing the superuser_arg test from is_member_of_role() altogether, as it seems redundant for many of the callers --- but not all, and it's way too late in the 8.1 cycle to be making large changes. Perhaps reconsider this later.
* Standard pgindent run for 8.1.Bruce Momjian2005-10-15
|
* Fix the problem of GRANTs creating "dangling" privileges not directlyTom Lane2005-10-10
| | | | | | traceable to grant options. As per my earlier proposal, a GRANT made by a role member has to be recorded as being granted by the role that actually holds the grant option, and not the member.
* Marginal performance improvement in aclmask(): don't bother withTom Lane2005-10-07
| | | | | | testing ownership if the caller isn't interested in any GOPTION bits (which is the common case). It did not matter in 8.0 where the ownership test was just a trivial equality test, but it matters now.
* Make use of new list primitives list_append_unique and list_concat_uniqueTom Lane2005-07-28
| | | | where applicable.
* Add a role property 'rolinherit' which, when false, denotes that the roleTom Lane2005-07-26
| | | | | | | | | doesn't automatically inherit the privileges of roles it is a member of; for such a role, membership in another role can be exploited only by doing explicit SET ROLE. The default inherit setting is TRUE, so by default the behavior doesn't change, but creating a user with NOINHERIT gives closer adherence to our current reading of SQL99. Documentation still lacking, and I think the information schema needs another look.
* Add pg_has_role() family of privilege inquiry functions modeled after theTom Lane2005-07-26
| | | | | | | existing ones for object privileges. Update the information_schema for roles --- pg_has_role() makes this a whole lot easier, removing the need for most of the explicit joins with pg_user. The views should be a tad faster now, too. Stephen Frost and Tom Lane.
* Remove unnecessary parentheses in assignments.Bruce Momjian2005-07-21
| | | | | Add spaces where needed. Reference time interval variables as tinterval.
* Adjust permissions checking for ALTER OWNER commands: instead ofTom Lane2005-07-14
| | | | | | | | | | | requiring superuserness always, allow an owner to reassign ownership to any role he is a member of, if that role would have the right to create a similar object. These three requirements essentially state that the would-be alterer has enough privilege to DROP the existing object and then re-CREATE it as the new role; so we might as well let him do it in one step. The ALTER TABLESPACE case is a bit squirrely, but the whole concept of non-superuser tablespace owners is pretty dubious anyway. Stephen Frost, code review by Tom Lane.
* Track dependencies on shared objects (which is to say, roles; we alreadyTom Lane2005-07-07
| | | | | | | have adequate mechanisms for tracking the contents of databases and tablespaces). This solves the longstanding problem that you can drop a user who still owns objects and/or has access permissions. Alvaro Herrera, with some kibitzing from Tom Lane.
* More cleanup on roles patch. Allow admin option to be inherited throughTom Lane2005-06-29
| | | | | | role memberships; make superuser/createrole distinction do something useful; fix some locking and CommandCounterIncrement issues; prevent creation of loops in the membership graph.
* Bring syntax of role-related commands into SQL compliance. To avoidTom Lane2005-06-28
| | | | | | | | | syntactic conflicts, both privilege and role GRANT/REVOKE commands have to use the same production for scanning the list of tokens that might eventually turn out to be privileges or role names. So, change the existing GRANT/REVOKE code to expect a list of strings not pre-reduced AclMode values. Fix a couple other minor issues while at it, such as InitializeAcl function name conflicting with a Windows system function.
* Replace pg_shadow and pg_group by new role-capable catalogs pg_authidTom Lane2005-06-28
| | | | | | | | and pg_auth_members. There are still many loose ends to finish in this patch (no documentation, no regression tests, no pg_dump support for instance). But I'm going to commit it now anyway so that Alvaro can make some progress on shared dependencies. The catalog changes should be pretty much done.
* Remove second argument from textToQualifiedNameList(), as it is no longerNeil Conway2005-05-27
| | | | used. From Jaime Casanova.
* Tag appropriate files for rc3PostgreSQL Daemon2004-12-31
| | | | | | | | Also performed an initial run through of upgrading our Copyright date to extend to 2005 ... first run here was very simple ... change everything where: grep 1996-2004 && the word 'Copyright' ... scanned through the generated list with 'less' first, and after, to make sure that I only picked up the right entries ...
* Adjust comments previously moved to column 1 by pgident.Bruce Momjian2004-10-07
|
* Pgindent run for 8.0.Bruce Momjian2004-08-29
|
* Update copyright to 2004.Bruce Momjian2004-08-29
|
* Use one, not zero, as the default lower bound for arrays of AclItems.Tom Lane2004-08-06
| | | | | | | | This avoids changing the displayed appearance of ACL columns now that array_out decorates its output with bounds information when the lower bound isn't one. Per gripe from Gaetano Mendola. Note that I did not force initdb for this, although any database initdb'd in the last couple of days is going to have some problems.
* Cause ALTER OWNER commands to update the object's ACL, replacing referencesTom Lane2004-08-01
| | | | | | to the old owner with the new owner. This is not necessarily right, but it's sure a lot more likely to be what the user wants than doing nothing. Christopher Kings-Lynne, some rework by Tom Lane.
generated by cgit v1.2.3 (git 2.25.1) at 2025-06-06 07:07:00 +0000