From c44f6334ca6ff6d242d9eb6742441bc4e1294067 Mon Sep 17 00:00:00 2001 From: Jeff Davis Date: Fri, 13 Jan 2023 14:14:54 -0800 Subject: Simplify permissions for LOCK TABLE. The prior behavior was confusing and hard to document. For instance, if you had UPDATE privileges, you could lock a table in any lock mode except ACCESS SHARE mode. Now, if granted a privilege to lock at a given mode, one also has privileges to lock at a less-conflicting mode. MAINTAIN, UPDATE, DELETE, and TRUNCATE privileges allow any lock mode. INSERT privileges allow ROW EXCLUSIVE (or below). SELECT privileges allow ACCESS SHARE. Reviewed-by: Nathan Bossart Discussion: https://postgr.es/m/9550c76535404a83156252b25a11babb4792ea1e.camel%40j-davis.com --- src/backend/commands/lockcmds.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'src/backend/commands/lockcmds.c') diff --git a/src/backend/commands/lockcmds.c b/src/backend/commands/lockcmds.c index 99e68bff85d..410d78b040f 100644 --- a/src/backend/commands/lockcmds.c +++ b/src/backend/commands/lockcmds.c @@ -292,16 +292,16 @@ LockTableAclCheck(Oid reloid, LOCKMODE lockmode, Oid userid) AclResult aclresult; AclMode aclmask; - /* Verify adequate privilege */ - if (lockmode == AccessShareLock) - aclmask = ACL_SELECT; - else if (lockmode == RowExclusiveLock) - aclmask = ACL_INSERT | ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE; - else - aclmask = ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE; + /* any of these privileges permit any lock mode */ + aclmask = ACL_MAINTAIN | ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE; + + /* SELECT privileges also permit ACCESS SHARE and below */ + if (lockmode <= AccessShareLock) + aclmask |= ACL_SELECT; - /* MAINTAIN privilege allows all lock modes */ - aclmask |= ACL_MAINTAIN; + /* INSERT privileges also permit ROW EXCLUSIVE and below */ + if (lockmode <= RowExclusiveLock) + aclmask |= ACL_INSERT; aclresult = pg_class_aclcheck(reloid, userid, aclmask); -- cgit v1.2.3