diff options
| author | Peter Eisentraut | 2022-11-13 07:11:17 +0000 |
|---|---|---|
| committer | Peter Eisentraut | 2022-11-13 08:02:41 +0000 |
| commit | c727f511bd7bf3c58063737bcf7a8f331346f253 (patch) | |
| tree | f59a013d0e7fe8b086eab5810b941de27695fe2d | |
| parent | afbfc02983f86c4d71825efa6befd547fe81a926 (diff) | |
Refactor aclcheck functions
Instead of dozens of mostly-duplicate pg_foo_aclcheck() functions,
write one common function object_aclcheck() that can handle almost all
of them. We already have all the information we need, such as which
system catalog corresponds to which catalog table and which column is
the ACL column.
There are a few pg_foo_aclcheck() that don't work via the generic
function and have special APIs, so those stay as is.
I also changed most pg_foo_aclmask() functions to static functions,
since they are not used outside of aclchk.c.
Reviewed-by: Corey Huinker <[email protected]>
Reviewed-by: Antonin Houska <[email protected]>
Discussion: https://www.postgresql.org/message-id/flat/[email protected]
37 files changed, 319 insertions, 682 deletions
diff --git a/contrib/dblink/dblink.c b/contrib/dblink/dblink.c index 9202c358475..04095a8f0ee 100644 --- a/contrib/dblink/dblink.c +++ b/contrib/dblink/dblink.c @@ -2838,7 +2838,7 @@ get_connect_string(const char *servername) fdw = GetForeignDataWrapper(fdwid); /* Check permissions, user must have usage on the server. */ - aclresult = pg_foreign_server_aclcheck(serverid, userid, ACL_USAGE); + aclresult = object_aclcheck(ForeignServerRelationId, serverid, userid, ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FOREIGN_SERVER, foreign_server->servername); diff --git a/src/backend/access/common/tupdesc.c b/src/backend/access/common/tupdesc.c index b7f918c877b..7857f55e24a 100644 --- a/src/backend/access/common/tupdesc.c +++ b/src/backend/access/common/tupdesc.c @@ -821,7 +821,7 @@ BuildDescForRelation(List *schema) attname = entry->colname; typenameTypeIdAndMod(NULL, entry->typeName, &atttypid, &atttypmod); - aclresult = pg_type_aclcheck(atttypid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, atttypid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, atttypid); diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c index 7302f035086..3c9f8e60ad2 100644 --- a/src/backend/catalog/aclchk.c +++ b/src/backend/catalog/aclchk.c @@ -139,8 +139,26 @@ static AclMode restrict_and_check_grant(bool is_grant, AclMode avail_goptions, Oid objectId, Oid grantorId, ObjectType objtype, const char *objname, AttrNumber att_number, const char *colname); -static AclMode pg_aclmask(ObjectType objtype, Oid table_oid, AttrNumber attnum, +static AclMode pg_aclmask(ObjectType objtype, Oid object_oid, AttrNumber attnum, Oid roleid, AclMode mask, AclMaskHow how); +static AclMode object_aclmask(Oid classid, Oid objectid, Oid roleid, + AclMode mask, AclMaskHow how); +static AclMode pg_attribute_aclmask(Oid table_oid, AttrNumber attnum, + Oid roleid, AclMode mask, AclMaskHow how); +static AclMode pg_attribute_aclmask_ext(Oid table_oid, AttrNumber attnum, + Oid roleid, AclMode mask, + AclMaskHow how, bool *is_missing); +static AclMode pg_class_aclmask_ext(Oid table_oid, Oid roleid, + AclMode mask, AclMaskHow how, + bool *is_missing); +static AclMode pg_parameter_acl_aclmask(Oid acl_oid, Oid roleid, + AclMode mask, AclMaskHow how); +static AclMode pg_largeobject_aclmask_snapshot(Oid lobj_oid, Oid roleid, + AclMode mask, AclMaskHow how, Snapshot snapshot); +static AclMode pg_namespace_aclmask(Oid nsp_oid, Oid roleid, + AclMode mask, AclMaskHow how); +static AclMode pg_type_aclmask(Oid type_oid, Oid roleid, + AclMode mask, AclMaskHow how); static void recordExtensionInitPriv(Oid objoid, Oid classoid, int objsubid, Acl *new_acl); static void recordExtensionInitPrivWorker(Oid objoid, Oid classoid, int objsubid, @@ -3787,47 +3805,47 @@ aclcheck_error_type(AclResult aclerr, Oid typeOid) * Relay for the various pg_*_mask routines depending on object kind */ static AclMode -pg_aclmask(ObjectType objtype, Oid table_oid, AttrNumber attnum, Oid roleid, +pg_aclmask(ObjectType objtype, Oid object_oid, AttrNumber attnum, Oid roleid, AclMode mask, AclMaskHow how) { switch (objtype) { case OBJECT_COLUMN: return - pg_class_aclmask(table_oid, roleid, mask, how) | - pg_attribute_aclmask(table_oid, attnum, roleid, mask, how); + pg_class_aclmask(object_oid, roleid, mask, how) | + pg_attribute_aclmask(object_oid, attnum, roleid, mask, how); case OBJECT_TABLE: case OBJECT_SEQUENCE: - return pg_class_aclmask(table_oid, roleid, mask, how); + return pg_class_aclmask(object_oid, roleid, mask, how); case OBJECT_DATABASE: - return pg_database_aclmask(table_oid, roleid, mask, how); + return object_aclmask(DatabaseRelationId, object_oid, roleid, mask, how); case OBJECT_FUNCTION: - return pg_proc_aclmask(table_oid, roleid, mask, how); + return object_aclmask(ProcedureRelationId, object_oid, roleid, mask, how); case OBJECT_LANGUAGE: - return pg_language_aclmask(table_oid, roleid, mask, how); + return object_aclmask(LanguageRelationId, object_oid, roleid, mask, how); case OBJECT_LARGEOBJECT: - return pg_largeobject_aclmask_snapshot(table_oid, roleid, + return pg_largeobject_aclmask_snapshot(object_oid, roleid, mask, how, NULL); case OBJECT_PARAMETER_ACL: - return pg_parameter_acl_aclmask(table_oid, roleid, mask, how); + return pg_parameter_acl_aclmask(object_oid, roleid, mask, how); case OBJECT_SCHEMA: - return pg_namespace_aclmask(table_oid, roleid, mask, how); + return object_aclmask(NamespaceRelationId, object_oid, roleid, mask, how); case OBJECT_STATISTIC_EXT: elog(ERROR, "grantable rights not supported for statistics objects"); /* not reached, but keep compiler quiet */ return ACL_NO_RIGHTS; case OBJECT_TABLESPACE: - return pg_tablespace_aclmask(table_oid, roleid, mask, how); + return object_aclmask(TableSpaceRelationId, object_oid, roleid, mask, how); case OBJECT_FDW: - return pg_foreign_data_wrapper_aclmask(table_oid, roleid, mask, how); + return object_aclmask(ForeignDataWrapperRelationId, object_oid, roleid, mask, how); case OBJECT_FOREIGN_SERVER: - return pg_foreign_server_aclmask(table_oid, roleid, mask, how); + return object_aclmask(ForeignServerRelationId, object_oid, roleid, mask, how); case OBJECT_EVENT_TRIGGER: elog(ERROR, "grantable rights not supported for event triggers"); /* not reached, but keep compiler quiet */ return ACL_NO_RIGHTS; case OBJECT_TYPE: - return pg_type_aclmask(table_oid, roleid, mask, how); + return object_aclmask(TypeRelationId, object_oid, roleid, mask, how); default: elog(ERROR, "unrecognized object type: %d", (int) objtype); @@ -3849,14 +3867,90 @@ pg_aclmask(ObjectType objtype, Oid table_oid, AttrNumber attnum, Oid roleid, */ /* - * Exported routine for examining a user's privileges for a column + * Generic routine for examining a user's privileges for an object + */ +static AclMode +object_aclmask(Oid classid, Oid objectid, Oid roleid, + AclMode mask, AclMaskHow how) +{ + int cacheid; + AclMode result; + HeapTuple tuple; + Datum aclDatum; + bool isNull; + Acl *acl; + Oid ownerId; + + /* Special cases */ + switch (classid) + { + case NamespaceRelationId: + return pg_namespace_aclmask(objectid, roleid, mask, how); + case TypeRelationId: + return pg_type_aclmask(objectid, roleid, mask, how); + } + + /* Even more special cases */ + Assert(classid != RelationRelationId); /* should use pg_class_acl* */ + Assert(classid != LargeObjectMetadataRelationId); /* should use + * pg_largeobject_acl* */ + + /* Superusers bypass all permission checking. */ + if (superuser_arg(roleid)) + return mask; + + /* + * Get the objects's ACL from its catalog + */ + + cacheid = get_object_catcache_oid(classid); + + tuple = SearchSysCache1(cacheid, ObjectIdGetDatum(objectid)); + if (!HeapTupleIsValid(tuple)) + ereport(ERROR, + (errcode(ERRCODE_UNDEFINED_DATABASE), + errmsg("%s with OID %u does not exist", get_object_class_descr(classid), objectid))); + + ownerId = DatumGetObjectId(SysCacheGetAttr(cacheid, + tuple, + get_object_attnum_owner(classid), + &isNull)); + Assert(!isNull); + + aclDatum = SysCacheGetAttr(cacheid, tuple, get_object_attnum_acl(classid), + &isNull); + if (isNull) + { + /* No ACL, so build default ACL */ + acl = acldefault(get_object_type(classid, objectid), ownerId); + aclDatum = (Datum) 0; + } + else + { + /* detoast ACL if necessary */ + acl = DatumGetAclP(aclDatum); + } + + result = aclmask(acl, roleid, ownerId, mask, how); + + /* if we have a detoasted copy, free it */ + if (acl && (Pointer) acl != DatumGetPointer(aclDatum)) + pfree(acl); + + ReleaseSysCache(tuple); + + return result; +} + +/* + * Routine for examining a user's privileges for a column * * Note: this considers only privileges granted specifically on the column. * It is caller's responsibility to take relation-level privileges into account * as appropriate. (For the same reason, we have no special case for * superuser-ness here.) */ -AclMode +static AclMode pg_attribute_aclmask(Oid table_oid, AttrNumber attnum, Oid roleid, AclMode mask, AclMaskHow how) { @@ -3865,12 +3959,12 @@ pg_attribute_aclmask(Oid table_oid, AttrNumber attnum, Oid roleid, } /* - * Exported routine for examining a user's privileges for a column + * Routine for examining a user's privileges for a column * * Does the bulk of the work for pg_attribute_aclmask(), and allows other * callers to avoid the missing attribute ERROR when is_missing is non-NULL. */ -AclMode +static AclMode pg_attribute_aclmask_ext(Oid table_oid, AttrNumber attnum, Oid roleid, AclMode mask, AclMaskHow how, bool *is_missing) { @@ -3983,12 +4077,12 @@ pg_class_aclmask(Oid table_oid, Oid roleid, } /* - * Exported routine for examining a user's privileges for a table + * Routine for examining a user's privileges for a table * * Does the bulk of the work for pg_class_aclmask(), and allows other * callers to avoid the missing relation ERROR when is_missing is non-NULL. */ -AclMode +static AclMode pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask, AclMaskHow how, bool *is_missing) { @@ -4104,64 +4198,10 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask, } /* - * Exported routine for examining a user's privileges for a database - */ -AclMode -pg_database_aclmask(Oid db_oid, Oid roleid, - AclMode mask, AclMaskHow how) -{ - AclMode result; - HeapTuple tuple; - Datum aclDatum; - bool isNull; - Acl *acl; - Oid ownerId; - - /* Superusers bypass all permission checking. */ - if (superuser_arg(roleid)) - return mask; - - /* - * Get the database's ACL from pg_database - */ - tuple = SearchSysCache1(DATABASEOID, ObjectIdGetDatum(db_oid)); - if (!HeapTupleIsValid(tuple)) - ereport(ERROR, - (errcode(ERRCODE_UNDEFINED_DATABASE), - errmsg("database with OID %u does not exist", db_oid))); - - ownerId = ((Form_pg_database) GETSTRUCT(tuple))->datdba; - - aclDatum = SysCacheGetAttr(DATABASEOID, tuple, Anum_pg_database_datacl, - &isNull); - if (isNull) - { - /* No ACL, so build default ACL */ - acl = acldefault(OBJECT_DATABASE, ownerId); - aclDatum = (Datum) 0; - } - else - { - /* detoast ACL if necessary */ - acl = DatumGetAclP(aclDatum); - } - - result = aclmask(acl, roleid, ownerId, mask, how); - - /* if we have a detoasted copy, free it */ - if (acl && (Pointer) acl != DatumGetPointer(aclDatum)) - pfree(acl); - - ReleaseSysCache(tuple); - - return result; -} - -/* - * Exported routine for examining a user's privileges for a configuration + * Routine for examining a user's privileges for a configuration * parameter (GUC), identified by GUC name. */ -AclMode +static AclMode pg_parameter_aclmask(const char *name, Oid roleid, AclMode mask, AclMaskHow how) { AclMode result; @@ -4222,10 +4262,10 @@ pg_parameter_aclmask(const char *name, Oid roleid, AclMode mask, AclMaskHow how) } /* - * Exported routine for examining a user's privileges for a configuration + * Routine for examining a user's privileges for a configuration * parameter (GUC), identified by the OID of its pg_parameter_acl entry. */ -AclMode +static AclMode pg_parameter_acl_aclmask(Oid acl_oid, Oid roleid, AclMode mask, AclMaskHow how) { AclMode result; @@ -4273,115 +4313,7 @@ pg_parameter_acl_aclmask(Oid acl_oid, Oid roleid, AclMode mask, AclMaskHow how) } /* - * Exported routine for examining a user's privileges for a function - */ -AclMode -pg_proc_aclmask(Oid proc_oid, Oid roleid, - AclMode mask, AclMaskHow how) -{ - AclMode result; - HeapTuple tuple; - Datum aclDatum; - bool isNull; - Acl *acl; - Oid ownerId; - - /* Superusers bypass all permission checking. */ - if (superuser_arg(roleid)) - return mask; - - /* - * Get the function's ACL from pg_proc - */ - tuple = SearchSysCache1(PROCOID, ObjectIdGetDatum(proc_oid)); - if (!HeapTupleIsValid(tuple)) - ereport(ERROR, - (errcode(ERRCODE_UNDEFINED_FUNCTION), - errmsg("function with OID %u does not exist", proc_oid))); - - ownerId = ((Form_pg_proc) GETSTRUCT(tuple))->proowner; - - aclDatum = SysCacheGetAttr(PROCOID, tuple, Anum_pg_proc_proacl, - &isNull); - if (isNull) - { - /* No ACL, so build default ACL */ - acl = acldefault(OBJECT_FUNCTION, ownerId); - aclDatum = (Datum) 0; - } - else - { - /* detoast ACL if necessary */ - acl = DatumGetAclP(aclDatum); - } - - result = aclmask(acl, roleid, ownerId, mask, how); - - /* if we have a detoasted copy, free it */ - if (acl && (Pointer) acl != DatumGetPointer(aclDatum)) - pfree(acl); - - ReleaseSysCache(tuple); - - return result; -} - -/* - * Exported routine for examining a user's privileges for a language - */ -AclMode -pg_language_aclmask(Oid lang_oid, Oid roleid, - AclMode mask, AclMaskHow how) -{ - AclMode result; - HeapTuple tuple; - Datum aclDatum; - bool isNull; - Acl *acl; - Oid ownerId; - - /* Superusers bypass all permission checking. */ - if (superuser_arg(roleid)) - return mask; - - /* - * Get the language's ACL from pg_language - */ - tuple = SearchSysCache1(LANGOID, ObjectIdGetDatum(lang_oid)); - if (!HeapTupleIsValid(tuple)) - ereport(ERROR, - (errcode(ERRCODE_UNDEFINED_OBJECT), - errmsg("language with OID %u does not exist", lang_oid))); - - ownerId = ((Form_pg_language) GETSTRUCT(tuple))->lanowner; - - aclDatum = SysCacheGetAttr(LANGOID, tuple, Anum_pg_language_lanacl, - &isNull); - if (isNull) - { - /* No ACL, so build default ACL */ - acl = acldefault(OBJECT_LANGUAGE, ownerId); - aclDatum = (Datum) 0; - } - else - { - /* detoast ACL if necessary */ - acl = DatumGetAclP(aclDatum); - } - - result = aclmask(acl, roleid, ownerId, mask, how); - - /* if we have a detoasted copy, free it */ - if (acl && (Pointer) acl != DatumGetPointer(aclDatum)) - pfree(acl); - - ReleaseSysCache(tuple); - - return result; -} - -/* - * Exported routine for examining a user's privileges for a largeobject + * Routine for examining a user's privileges for a largeobject * * When a large object is opened for reading, it is opened relative to the * caller's snapshot, but when it is opened for writing, a current @@ -4392,7 +4324,7 @@ pg_language_aclmask(Oid lang_oid, Oid roleid, * snapshot, since all we do with the snapshot argument is pass it through * to systable_beginscan(). */ -AclMode +static AclMode pg_largeobject_aclmask_snapshot(Oid lobj_oid, Oid roleid, AclMode mask, AclMaskHow how, Snapshot snapshot) @@ -4463,9 +4395,9 @@ pg_largeobject_aclmask_snapshot(Oid lobj_oid, Oid roleid, } /* - * Exported routine for examining a user's privileges for a namespace + * Routine for examining a user's privileges for a namespace */ -AclMode +static AclMode pg_namespace_aclmask(Oid nsp_oid, Oid roleid, AclMode mask, AclMaskHow how) { @@ -4501,8 +4433,8 @@ pg_namespace_aclmask(Oid nsp_oid, Oid roleid, */ if (isTempNamespace(nsp_oid)) { - if (pg_database_aclcheck(MyDatabaseId, roleid, - ACL_CREATE_TEMP) == ACLCHECK_OK) + if (object_aclcheck(DatabaseRelationId, MyDatabaseId, roleid, + ACL_CREATE_TEMP) == ACLCHECK_OK) return mask & ACL_ALL_RIGHTS_SCHEMA; else return mask & ACL_USAGE; @@ -4555,189 +4487,9 @@ pg_namespace_aclmask(Oid nsp_oid, Oid roleid, } /* - * Exported routine for examining a user's privileges for a tablespace - */ -AclMode -pg_tablespace_aclmask(Oid spc_oid, Oid roleid, - AclMode mask, AclMaskHow how) -{ - AclMode result; - HeapTuple tuple; - Datum aclDatum; - bool isNull; - Acl *acl; - Oid ownerId; - - /* Superusers bypass all permission checking. */ - if (superuser_arg(roleid)) - return mask; - - /* - * Get the tablespace's ACL from pg_tablespace - */ - tuple = SearchSysCache1(TABLESPACEOID, ObjectIdGetDatum(spc_oid)); - if (!HeapTupleIsValid(tuple)) - ereport(ERROR, - (errcode(ERRCODE_UNDEFINED_OBJECT), - errmsg("tablespace with OID %u does not exist", spc_oid))); - - ownerId = ((Form_pg_tablespace) GETSTRUCT(tuple))->spcowner; - - aclDatum = SysCacheGetAttr(TABLESPACEOID, tuple, - Anum_pg_tablespace_spcacl, - &isNull); - - if (isNull) - { - /* No ACL, so build default ACL */ - acl = acldefault(OBJECT_TABLESPACE, ownerId); - aclDatum = (Datum) 0; - } - else - { - /* detoast ACL if necessary */ - acl = DatumGetAclP(aclDatum); - } - - result = aclmask(acl, roleid, ownerId, mask, how); - - /* if we have a detoasted copy, free it */ - if (acl && (Pointer) acl != DatumGetPointer(aclDatum)) - pfree(acl); - - ReleaseSysCache(tuple); - - return result; -} - -/* - * Exported routine for examining a user's privileges for a foreign - * data wrapper - */ -AclMode -pg_foreign_data_wrapper_aclmask(Oid fdw_oid, Oid roleid, - AclMode mask, AclMaskHow how) -{ - AclMode result; - HeapTuple tuple; - Datum aclDatum; - bool isNull; - Acl *acl; - Oid ownerId; - - Form_pg_foreign_data_wrapper fdwForm; - - /* Bypass permission checks for superusers */ - if (superuser_arg(roleid)) - return mask; - - /* - * Must get the FDW's tuple from pg_foreign_data_wrapper - */ - tuple = SearchSysCache1(FOREIGNDATAWRAPPEROID, ObjectIdGetDatum(fdw_oid)); - if (!HeapTupleIsValid(tuple)) - ereport(ERROR, - (errcode(ERRCODE_UNDEFINED_OBJECT), - errmsg("foreign-data wrapper with OID %u does not exist", - fdw_oid))); - fdwForm = (Form_pg_foreign_data_wrapper) GETSTRUCT(tuple); - - /* - * Normal case: get the FDW's ACL from pg_foreign_data_wrapper - */ - ownerId = fdwForm->fdwowner; - - aclDatum = SysCacheGetAttr(FOREIGNDATAWRAPPEROID, tuple, - Anum_pg_foreign_data_wrapper_fdwacl, &isNull); - if (isNull) - { - /* No ACL, so build default ACL */ - acl = acldefault(OBJECT_FDW, ownerId); - aclDatum = (Datum) 0; - } - else - { - /* detoast rel's ACL if necessary */ - acl = DatumGetAclP(aclDatum); - } - - result = aclmask(acl, roleid, ownerId, mask, how); - - /* if we have a detoasted copy, free it */ - if (acl && (Pointer) acl != DatumGetPointer(aclDatum)) - pfree(acl); - - ReleaseSysCache(tuple); - - return result; -} - -/* - * Exported routine for examining a user's privileges for a foreign - * server. - */ -AclMode -pg_foreign_server_aclmask(Oid srv_oid, Oid roleid, - AclMode mask, AclMaskHow how) -{ - AclMode result; - HeapTuple tuple; - Datum aclDatum; - bool isNull; - Acl *acl; - Oid ownerId; - - Form_pg_foreign_server srvForm; - - /* Bypass permission checks for superusers */ - if (superuser_arg(roleid)) - return mask; - - /* - * Must get the FDW's tuple from pg_foreign_data_wrapper - */ - tuple = SearchSysCache1(FOREIGNSERVEROID, ObjectIdGetDatum(srv_oid)); - if (!HeapTupleIsValid(tuple)) - ereport(ERROR, - (errcode(ERRCODE_UNDEFINED_OBJECT), - errmsg("foreign server with OID %u does not exist", - srv_oid))); - srvForm = (Form_pg_foreign_server) GETSTRUCT(tuple); - - /* - * Normal case: get the foreign server's ACL from pg_foreign_server - */ - ownerId = srvForm->srvowner; - - aclDatum = SysCacheGetAttr(FOREIGNSERVEROID, tuple, - Anum_pg_foreign_server_srvacl, &isNull); - if (isNull) - { - /* No ACL, so build default ACL */ - acl = acldefault(OBJECT_FOREIGN_SERVER, ownerId); - aclDatum = (Datum) 0; - } - else - { - /* detoast rel's ACL if necessary */ - acl = DatumGetAclP(aclDatum); - } - - result = aclmask(acl, roleid, ownerId, mask, how); - - /* if we have a detoasted copy, free it */ - if (acl && (Pointer) acl != DatumGetPointer(aclDatum)) - pfree(acl); - - ReleaseSysCache(tuple); - - return result; -} - -/* - * Exported routine for examining a user's privileges for a type. + * Routine for examining a user's privileges for a type. */ -AclMode +static AclMode pg_type_aclmask(Oid type_oid, Oid roleid, AclMode mask, AclMaskHow how) { AclMode result; @@ -4812,6 +4564,18 @@ pg_type_aclmask(Oid type_oid, Oid roleid, AclMode mask, AclMaskHow how) } /* + * Exported generic routine for checking a user's access privileges to an object + */ +AclResult +object_aclcheck(Oid classid, Oid objectid, Oid roleid, AclMode mode) +{ + if (object_aclmask(classid, objectid, roleid, mode, ACLMASK_ANY) != 0) + return ACLCHECK_OK; + else + return ACLCHECK_NO_PRIV; +} + +/* * Exported routine for checking a user's access privileges to a column * * Returns ACLCHECK_OK if the user has any of the privileges identified by @@ -4974,18 +4738,6 @@ pg_class_aclcheck_ext(Oid table_oid, Oid roleid, } /* - * Exported routine for checking a user's access privileges to a database - */ -AclResult -pg_database_aclcheck(Oid db_oid, Oid roleid, AclMode mode) -{ - if (pg_database_aclmask(db_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* * Exported routine for checking a user's access privileges to a configuration * parameter (GUC), identified by GUC name. */ @@ -4999,43 +4751,6 @@ pg_parameter_aclcheck(const char *name, Oid roleid, AclMode mode) } /* - * Exported routine for checking a user's access privileges to a configuration - * parameter (GUC), identified by the OID of its pg_parameter_acl entry. - */ -AclResult -pg_parameter_acl_aclcheck(Oid acl_oid, Oid roleid, AclMode mode) -{ - if (pg_parameter_acl_aclmask(acl_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* - * Exported routine for checking a user's access privileges to a function - */ -AclResult -pg_proc_aclcheck(Oid proc_oid, Oid roleid, AclMode mode) -{ - if (pg_proc_aclmask(proc_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* - * Exported routine for checking a user's access privileges to a language - */ -AclResult -pg_language_aclcheck(Oid lang_oid, Oid roleid, AclMode mode) -{ - if (pg_language_aclmask(lang_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* * Exported routine for checking a user's access privileges to a largeobject */ AclResult @@ -5050,68 +4765,6 @@ pg_largeobject_aclcheck_snapshot(Oid lobj_oid, Oid roleid, AclMode mode, } /* - * Exported routine for checking a user's access privileges to a namespace - */ -AclResult -pg_namespace_aclcheck(Oid nsp_oid, Oid roleid, AclMode mode) -{ - if (pg_namespace_aclmask(nsp_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* - * Exported routine for checking a user's access privileges to a tablespace - */ -AclResult -pg_tablespace_aclcheck(Oid spc_oid, Oid roleid, AclMode mode) -{ - if (pg_tablespace_aclmask(spc_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* - * Exported routine for checking a user's access privileges to a foreign - * data wrapper - */ -AclResult -pg_foreign_data_wrapper_aclcheck(Oid fdw_oid, Oid roleid, AclMode mode) -{ - if (pg_foreign_data_wrapper_aclmask(fdw_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* - * Exported routine for checking a user's access privileges to a foreign - * server - */ -AclResult -pg_foreign_server_aclcheck(Oid srv_oid, Oid roleid, AclMode mode) -{ - if (pg_foreign_server_aclmask(srv_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* - * Exported routine for checking a user's access privileges to a type - */ -AclResult -pg_type_aclcheck(Oid type_oid, Oid roleid, AclMode mode) -{ - if (pg_type_aclmask(type_oid, roleid, mode, ACLMASK_ANY) != 0) - return ACLCHECK_OK; - else - return ACLCHECK_NO_PRIV; -} - -/* * Generic ownership check for an object */ bool diff --git a/src/backend/catalog/namespace.c b/src/backend/catalog/namespace.c index 1543f2abcd8..bac0deb6da3 100644 --- a/src/backend/catalog/namespace.c +++ b/src/backend/catalog/namespace.c @@ -28,6 +28,7 @@ #include "catalog/pg_authid.h" #include "catalog/pg_collation.h" #include "catalog/pg_conversion.h" +#include "catalog/pg_database.h" #include "catalog/pg_namespace.h" #include "catalog/pg_opclass.h" #include "catalog/pg_operator.h" @@ -586,7 +587,7 @@ RangeVarGetAndCheckCreationNamespace(RangeVar *relation, break; /* Check namespace permissions. */ - aclresult = pg_namespace_aclcheck(nspid, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, nspid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(nspid)); @@ -2954,7 +2955,7 @@ LookupExplicitNamespace(const char *nspname, bool missing_ok) if (missing_ok && !OidIsValid(namespaceId)) return InvalidOid; - aclresult = pg_namespace_aclcheck(namespaceId, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(NamespaceRelationId, namespaceId, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, nspname); @@ -2990,7 +2991,7 @@ LookupCreationNamespace(const char *nspname) namespaceId = get_namespace_oid(nspname, false); - aclresult = pg_namespace_aclcheck(namespaceId, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, namespaceId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, nspname); @@ -3836,7 +3837,7 @@ recomputeNamespacePath(void) ReleaseSysCache(tuple); if (OidIsValid(namespaceId) && !list_member_oid(oidlist, namespaceId) && - pg_namespace_aclcheck(namespaceId, roleid, + object_aclcheck(NamespaceRelationId, namespaceId, roleid, ACL_USAGE) == ACLCHECK_OK && InvokeNamespaceSearchHook(namespaceId, false)) oidlist = lappend_oid(oidlist, namespaceId); @@ -3864,7 +3865,7 @@ recomputeNamespacePath(void) namespaceId = get_namespace_oid(curname, true); if (OidIsValid(namespaceId) && !list_member_oid(oidlist, namespaceId) && - pg_namespace_aclcheck(namespaceId, roleid, + object_aclcheck(NamespaceRelationId, namespaceId, roleid, ACL_USAGE) == ACLCHECK_OK && InvokeNamespaceSearchHook(namespaceId, false)) oidlist = lappend_oid(oidlist, namespaceId); @@ -4000,7 +4001,7 @@ InitTempTableNamespace(void) * But there's no need to make the namespace in the first place until a * temp table creation request is made by someone with appropriate rights. */ - if (pg_database_aclcheck(MyDatabaseId, GetUserId(), + if (object_aclcheck(DatabaseRelationId, MyDatabaseId, GetUserId(), ACL_CREATE_TEMP) != ACLCHECK_OK) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), diff --git a/src/backend/catalog/pg_aggregate.c b/src/backend/catalog/pg_aggregate.c index 0d0daa69b34..a98445b741a 100644 --- a/src/backend/catalog/pg_aggregate.c +++ b/src/backend/catalog/pg_aggregate.c @@ -586,23 +586,23 @@ AggregateCreate(const char *aggName, */ for (i = 0; i < numArgs; i++) { - aclresult = pg_type_aclcheck(aggArgTypes[i], GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, aggArgTypes[i], GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, aggArgTypes[i]); } - aclresult = pg_type_aclcheck(aggTransType, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, aggTransType, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, aggTransType); if (OidIsValid(aggmTransType)) { - aclresult = pg_type_aclcheck(aggmTransType, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, aggmTransType, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, aggmTransType); } - aclresult = pg_type_aclcheck(finaltype, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, finaltype, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, finaltype); @@ -906,7 +906,7 @@ lookup_agg_function(List *fnName, } /* Check aggregate creator has permission to call the function */ - aclresult = pg_proc_aclcheck(fnOid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, fnOid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(fnOid)); diff --git a/src/backend/catalog/pg_operator.c b/src/backend/catalog/pg_operator.c index e6e794b6ff9..1017f2eed18 100644 --- a/src/backend/catalog/pg_operator.c +++ b/src/backend/catalog/pg_operator.c @@ -624,7 +624,7 @@ get_other_operator(List *otherOp, Oid otherLeftTypeId, Oid otherRightTypeId, /* not in catalogs, different from operator, so make shell */ - aclresult = pg_namespace_aclcheck(otherNamespace, GetUserId(), + aclresult = object_aclcheck(NamespaceRelationId, otherNamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, diff --git a/src/backend/commands/aggregatecmds.c b/src/backend/commands/aggregatecmds.c index 010eca7340a..a9339e40b31 100644 --- a/src/backend/commands/aggregatecmds.c +++ b/src/backend/commands/aggregatecmds.c @@ -25,6 +25,7 @@ #include "access/htup_details.h" #include "catalog/dependency.h" #include "catalog/pg_aggregate.h" +#include "catalog/pg_namespace.h" #include "catalog/pg_proc.h" #include "catalog/pg_type.h" #include "commands/alter.h" @@ -104,7 +105,7 @@ DefineAggregate(ParseState *pstate, aggNamespace = QualifiedNameGetCreationNamespace(name, &aggName); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(aggNamespace, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, aggNamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(aggNamespace)); diff --git a/src/backend/commands/alter.c b/src/backend/commands/alter.c index 5dabba4dd06..b2089d785b6 100644 --- a/src/backend/commands/alter.c +++ b/src/backend/commands/alter.c @@ -228,7 +228,7 @@ AlterObjectRename_internal(Relation rel, Oid objectId, const char *new_name) /* User must have CREATE privilege on the namespace */ if (OidIsValid(namespaceId)) { - aclresult = pg_namespace_aclcheck(namespaceId, GetUserId(), + aclresult = object_aclcheck(NamespaceRelationId, namespaceId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, @@ -757,7 +757,7 @@ AlterObjectNamespace_internal(Relation rel, Oid objid, Oid nspOid) NameStr(*(DatumGetName(name)))); /* User must have CREATE privilege on new namespace */ - aclresult = pg_namespace_aclcheck(nspOid, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, nspOid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(nspOid)); @@ -1006,7 +1006,7 @@ AlterObjectOwner_internal(Relation rel, Oid objectId, Oid new_ownerId) { AclResult aclresult; - aclresult = pg_namespace_aclcheck(namespaceId, new_ownerId, + aclresult = object_aclcheck(NamespaceRelationId, namespaceId, new_ownerId, ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, diff --git a/src/backend/commands/collationcmds.c b/src/backend/commands/collationcmds.c index 1753d67b612..25efa6e0bf0 100644 --- a/src/backend/commands/collationcmds.c +++ b/src/backend/commands/collationcmds.c @@ -23,6 +23,7 @@ #include "catalog/objectaccess.h" #include "catalog/pg_collation.h" #include "catalog/pg_database.h" +#include "catalog/pg_namespace.h" #include "commands/alter.h" #include "commands/collationcmds.h" #include "commands/comment.h" @@ -76,7 +77,7 @@ DefineCollation(ParseState *pstate, List *names, List *parameters, bool if_not_e collNamespace = QualifiedNameGetCreationNamespace(names, &collName); - aclresult = pg_namespace_aclcheck(collNamespace, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, collNamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(collNamespace)); diff --git a/src/backend/commands/conversioncmds.c b/src/backend/commands/conversioncmds.c index 67feda33ec5..7f721cca714 100644 --- a/src/backend/commands/conversioncmds.c +++ b/src/backend/commands/conversioncmds.c @@ -18,6 +18,8 @@ #include "catalog/dependency.h" #include "catalog/indexing.h" #include "catalog/pg_conversion.h" +#include "catalog/pg_namespace.h" +#include "catalog/pg_proc.h" #include "catalog/pg_type.h" #include "commands/alter.h" #include "commands/conversioncmds.h" @@ -54,7 +56,7 @@ CreateConversionCommand(CreateConversionStmt *stmt) &conversion_name); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(namespaceId, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, namespaceId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(namespaceId)); @@ -101,7 +103,7 @@ CreateConversionCommand(CreateConversionStmt *stmt) NameListToString(func_name), "integer"))); /* Check we have EXECUTE rights for the function */ - aclresult = pg_proc_aclcheck(funcoid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, funcoid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, NameListToString(func_name)); diff --git a/src/backend/commands/dbcommands.c b/src/backend/commands/dbcommands.c index 0d6a1228639..a67ea86619c 100644 --- a/src/backend/commands/dbcommands.c +++ b/src/backend/commands/dbcommands.c @@ -1164,7 +1164,7 @@ createdb(ParseState *pstate, const CreatedbStmt *stmt) tablespacename = defGetString(dtablespacename); dst_deftablespace = get_tablespace_oid(tablespacename, false); /* check permissions */ - aclresult = pg_tablespace_aclcheck(dst_deftablespace, GetUserId(), + aclresult = object_aclcheck(TableSpaceRelationId, dst_deftablespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, @@ -1874,7 +1874,7 @@ movedb(const char *dbname, const char *tblspcname) /* * Permission checks */ - aclresult = pg_tablespace_aclcheck(dst_tblspcoid, GetUserId(), + aclresult = object_aclcheck(TableSpaceRelationId, dst_tblspcoid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, diff --git a/src/backend/commands/extension.c b/src/backend/commands/extension.c index 722e94bbce0..806d6056ab6 100644 --- a/src/backend/commands/extension.c +++ b/src/backend/commands/extension.c @@ -42,6 +42,7 @@ #include "catalog/objectaccess.h" #include "catalog/pg_authid.h" #include "catalog/pg_collation.h" +#include "catalog/pg_database.h" #include "catalog/pg_depend.h" #include "catalog/pg_extension.h" #include "catalog/pg_namespace.h" @@ -832,7 +833,7 @@ extension_is_trusted(ExtensionControlFile *control) if (!control->trusted) return false; /* Allow if user has CREATE privilege on current database */ - aclresult = pg_database_aclcheck(MyDatabaseId, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(DatabaseRelationId, MyDatabaseId, GetUserId(), ACL_CREATE); if (aclresult == ACLCHECK_OK) return true; return false; @@ -2732,7 +2733,7 @@ AlterExtensionNamespace(const char *extensionName, const char *newschema, Oid *o extensionName); /* Permission check: must have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(nspOid, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, nspOid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, newschema); diff --git a/src/backend/commands/foreigncmds.c b/src/backend/commands/foreigncmds.c index e6e6d128d11..55b0be9e1d1 100644 --- a/src/backend/commands/foreigncmds.c +++ b/src/backend/commands/foreigncmds.c @@ -366,7 +366,7 @@ AlterForeignServerOwner_internal(Relation rel, HeapTuple tup, Oid newOwnerId) check_is_member_of_role(GetUserId(), newOwnerId); /* New owner must have USAGE privilege on foreign-data wrapper */ - aclresult = pg_foreign_data_wrapper_aclcheck(form->srvfdw, newOwnerId, ACL_USAGE); + aclresult = object_aclcheck(ForeignDataWrapperRelationId, form->srvfdw, newOwnerId, ACL_USAGE); if (aclresult != ACLCHECK_OK) { ForeignDataWrapper *fdw = GetForeignDataWrapper(form->srvfdw); @@ -891,7 +891,7 @@ CreateForeignServer(CreateForeignServerStmt *stmt) */ fdw = GetForeignDataWrapperByName(stmt->fdwname, false); - aclresult = pg_foreign_data_wrapper_aclcheck(fdw->fdwid, ownerId, ACL_USAGE); + aclresult = object_aclcheck(ForeignDataWrapperRelationId, fdw->fdwid, ownerId, ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FDW, fdw->fdwname); @@ -1082,7 +1082,7 @@ user_mapping_ddl_aclcheck(Oid umuserid, Oid serverid, const char *servername) { AclResult aclresult; - aclresult = pg_foreign_server_aclcheck(serverid, curuserid, ACL_USAGE); + aclresult = object_aclcheck(ForeignServerRelationId, serverid, curuserid, ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FOREIGN_SERVER, servername); } @@ -1433,7 +1433,7 @@ CreateForeignTable(CreateForeignTableStmt *stmt, Oid relid) * get the actual FDW for option validation etc. */ server = GetForeignServerByName(stmt->servername, false); - aclresult = pg_foreign_server_aclcheck(server->serverid, ownerId, ACL_USAGE); + aclresult = object_aclcheck(ForeignServerRelationId, server->serverid, ownerId, ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FOREIGN_SERVER, server->servername); @@ -1492,7 +1492,7 @@ ImportForeignSchema(ImportForeignSchemaStmt *stmt) /* Check that the foreign server exists and that we have USAGE on it */ server = GetForeignServerByName(stmt->server_name, false); - aclresult = pg_foreign_server_aclcheck(server->serverid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(ForeignServerRelationId, server->serverid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FOREIGN_SERVER, server->servername); diff --git a/src/backend/commands/functioncmds.c b/src/backend/commands/functioncmds.c index 3645216c4b5..57489f65f2e 100644 --- a/src/backend/commands/functioncmds.c +++ b/src/backend/commands/functioncmds.c @@ -150,7 +150,7 @@ compute_return_type(TypeName *returnType, Oid languageOid, errdetail("Creating a shell type definition."))); namespaceId = QualifiedNameGetCreationNamespace(returnType->names, &typname); - aclresult = pg_namespace_aclcheck(namespaceId, GetUserId(), + aclresult = object_aclcheck(NamespaceRelationId, namespaceId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, @@ -160,7 +160,7 @@ compute_return_type(TypeName *returnType, Oid languageOid, Assert(OidIsValid(rettype)); } - aclresult = pg_type_aclcheck(rettype, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, rettype, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, rettype); @@ -272,7 +272,7 @@ interpret_function_parameter_list(ParseState *pstate, toid = InvalidOid; /* keep compiler quiet */ } - aclresult = pg_type_aclcheck(toid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, toid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, toid); @@ -1057,7 +1057,7 @@ CreateFunction(ParseState *pstate, CreateFunctionStmt *stmt) &funcname); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(namespaceId, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, namespaceId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(namespaceId)); @@ -1111,7 +1111,7 @@ CreateFunction(ParseState *pstate, CreateFunctionStmt *stmt) if (languageStruct->lanpltrusted) { /* if trusted language, need USAGE privilege */ - aclresult = pg_language_aclcheck(languageOid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(LanguageRelationId, languageOid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_LANGUAGE, NameStr(languageStruct->lanname)); @@ -1562,11 +1562,11 @@ CreateCast(CreateCastStmt *stmt) format_type_be(sourcetypeid), format_type_be(targettypeid)))); - aclresult = pg_type_aclcheck(sourcetypeid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, sourcetypeid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, sourcetypeid); - aclresult = pg_type_aclcheck(targettypeid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, targettypeid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, targettypeid); @@ -1841,7 +1841,7 @@ CreateTransform(CreateTransformStmt *stmt) if (!object_ownercheck(TypeRelationId, typeid, GetUserId())) aclcheck_error_type(ACLCHECK_NOT_OWNER, typeid); - aclresult = pg_type_aclcheck(typeid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, typeid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, typeid); @@ -1850,7 +1850,7 @@ CreateTransform(CreateTransformStmt *stmt) */ langid = get_language_oid(stmt->lang, false); - aclresult = pg_language_aclcheck(langid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(LanguageRelationId, langid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_LANGUAGE, stmt->lang); @@ -1864,7 +1864,7 @@ CreateTransform(CreateTransformStmt *stmt) if (!object_ownercheck(ProcedureRelationId, fromsqlfuncid, GetUserId())) aclcheck_error(ACLCHECK_NOT_OWNER, OBJECT_FUNCTION, NameListToString(stmt->fromsql->objname)); - aclresult = pg_proc_aclcheck(fromsqlfuncid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, fromsqlfuncid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, NameListToString(stmt->fromsql->objname)); @@ -1890,7 +1890,7 @@ CreateTransform(CreateTransformStmt *stmt) if (!object_ownercheck(ProcedureRelationId, tosqlfuncid, GetUserId())) aclcheck_error(ACLCHECK_NOT_OWNER, OBJECT_FUNCTION, NameListToString(stmt->tosql->objname)); - aclresult = pg_proc_aclcheck(tosqlfuncid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, tosqlfuncid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, NameListToString(stmt->tosql->objname)); @@ -2116,7 +2116,7 @@ ExecuteDoStmt(ParseState *pstate, DoStmt *stmt, bool atomic) /* if trusted language, need USAGE privilege */ AclResult aclresult; - aclresult = pg_language_aclcheck(codeblock->langOid, GetUserId(), + aclresult = object_aclcheck(LanguageRelationId, codeblock->langOid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_LANGUAGE, @@ -2193,7 +2193,7 @@ ExecuteCallStmt(CallStmt *stmt, ParamListInfo params, bool atomic, DestReceiver Assert(fexpr); Assert(IsA(fexpr, FuncExpr)); - aclresult = pg_proc_aclcheck(fexpr->funcid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, fexpr->funcid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_PROCEDURE, get_func_name(fexpr->funcid)); diff --git a/src/backend/commands/indexcmds.c b/src/backend/commands/indexcmds.c index aadd67b07f5..91cee27743d 100644 --- a/src/backend/commands/indexcmds.c +++ b/src/backend/commands/indexcmds.c @@ -742,7 +742,7 @@ DefineIndex(Oid relationId, { AclResult aclresult; - aclresult = pg_namespace_aclcheck(namespaceId, root_save_userid, + aclresult = object_aclcheck(NamespaceRelationId, namespaceId, root_save_userid, ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, @@ -774,7 +774,7 @@ DefineIndex(Oid relationId, { AclResult aclresult; - aclresult = pg_tablespace_aclcheck(tablespaceId, root_save_userid, + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceId, root_save_userid, ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, @@ -2648,7 +2648,7 @@ ExecReindex(ParseState *pstate, ReindexStmt *stmt, bool isTopLevel) { AclResult aclresult; - aclresult = pg_tablespace_aclcheck(params.tablespaceOid, + aclresult = object_aclcheck(TableSpaceRelationId, params.tablespaceOid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, @@ -3245,7 +3245,7 @@ ReindexMultipleInternal(List *relids, ReindexParams *params) { AclResult aclresult; - aclresult = pg_tablespace_aclcheck(params->tablespaceOid, + aclresult = object_aclcheck(TableSpaceRelationId, params->tablespaceOid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, diff --git a/src/backend/commands/opclasscmds.c b/src/backend/commands/opclasscmds.c index c004e303e28..0bc6deda008 100644 --- a/src/backend/commands/opclasscmds.c +++ b/src/backend/commands/opclasscmds.c @@ -362,7 +362,7 @@ DefineOpClass(CreateOpClassStmt *stmt) &opcname); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(namespaceoid, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, namespaceoid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(namespaceoid)); @@ -781,7 +781,7 @@ DefineOpFamily(CreateOpFamilyStmt *stmt) &opfname); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(namespaceoid, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, namespaceoid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(namespaceoid)); diff --git a/src/backend/commands/operatorcmds.c b/src/backend/commands/operatorcmds.c index a2d7ae89d74..8dc57976268 100644 --- a/src/backend/commands/operatorcmds.c +++ b/src/backend/commands/operatorcmds.c @@ -36,7 +36,9 @@ #include "catalog/dependency.h" #include "catalog/indexing.h" #include "catalog/objectaccess.h" +#include "catalog/pg_namespace.h" #include "catalog/pg_operator.h" +#include "catalog/pg_proc.h" #include "catalog/pg_type.h" #include "commands/alter.h" #include "commands/defrem.h" @@ -90,7 +92,7 @@ DefineOperator(List *names, List *parameters) oprNamespace = QualifiedNameGetCreationNamespace(names, &oprName); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(oprNamespace, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, oprNamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(oprNamespace)); @@ -187,14 +189,14 @@ DefineOperator(List *names, List *parameters) if (typeName1) { - aclresult = pg_type_aclcheck(typeId1, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, typeId1, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, typeId1); } if (typeName2) { - aclresult = pg_type_aclcheck(typeId2, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, typeId2, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, typeId2); } @@ -225,13 +227,13 @@ DefineOperator(List *names, List *parameters) * necessary, since EXECUTE will be checked at any attempted use of the * operator, but it seems like a good idea anyway. */ - aclresult = pg_proc_aclcheck(functionOid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, functionOid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, NameListToString(functionName)); rettype = get_func_rettype(functionOid); - aclresult = pg_type_aclcheck(rettype, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, rettype, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, rettype); @@ -291,7 +293,7 @@ ValidateRestrictionEstimator(List *restrictionName) NameListToString(restrictionName), "float8"))); /* Require EXECUTE rights for the estimator */ - aclresult = pg_proc_aclcheck(restrictionOid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, restrictionOid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, NameListToString(restrictionName)); @@ -349,7 +351,7 @@ ValidateJoinEstimator(List *joinName) NameListToString(joinName), "float8"))); /* Require EXECUTE rights for the estimator */ - aclresult = pg_proc_aclcheck(joinOid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, joinOid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, NameListToString(joinName)); diff --git a/src/backend/commands/publicationcmds.c b/src/backend/commands/publicationcmds.c index 8428e9e7b22..940655b9be0 100644 --- a/src/backend/commands/publicationcmds.c +++ b/src/backend/commands/publicationcmds.c @@ -24,6 +24,7 @@ #include "catalog/objectaccess.h" #include "catalog/objectaddress.h" #include "catalog/partition.h" +#include "catalog/pg_database.h" #include "catalog/pg_inherits.h" #include "catalog/pg_namespace.h" #include "catalog/pg_proc.h" @@ -748,7 +749,7 @@ CreatePublication(ParseState *pstate, CreatePublicationStmt *stmt) List *schemaidlist = NIL; /* must have CREATE privilege on database */ - aclresult = pg_database_aclcheck(MyDatabaseId, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(DatabaseRelationId, MyDatabaseId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_DATABASE, get_database_name(MyDatabaseId)); @@ -1913,7 +1914,7 @@ AlterPublicationOwner_internal(Relation rel, HeapTuple tup, Oid newOwnerId) check_is_member_of_role(GetUserId(), newOwnerId); /* New owner must have CREATE privilege on database */ - aclresult = pg_database_aclcheck(MyDatabaseId, newOwnerId, ACL_CREATE); + aclresult = object_aclcheck(DatabaseRelationId, MyDatabaseId, newOwnerId, ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_DATABASE, get_database_name(MyDatabaseId)); diff --git a/src/backend/commands/schemacmds.c b/src/backend/commands/schemacmds.c index 3005a059e82..b03f07a2322 100644 --- a/src/backend/commands/schemacmds.c +++ b/src/backend/commands/schemacmds.c @@ -23,6 +23,7 @@ #include "catalog/namespace.h" #include "catalog/objectaccess.h" #include "catalog/pg_authid.h" +#include "catalog/pg_database.h" #include "catalog/pg_namespace.h" #include "commands/dbcommands.h" #include "commands/event_trigger.h" @@ -91,7 +92,7 @@ CreateSchemaCommand(CreateSchemaStmt *stmt, const char *queryString, * The latter provision guards against "giveaway" attacks. Note that a * superuser will always have both of these privileges a fortiori. */ - aclresult = pg_database_aclcheck(MyDatabaseId, saved_uid, ACL_CREATE); + aclresult = object_aclcheck(DatabaseRelationId, MyDatabaseId, saved_uid, ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_DATABASE, get_database_name(MyDatabaseId)); @@ -259,7 +260,7 @@ RenameSchema(const char *oldname, const char *newname) oldname); /* must have CREATE privilege on database */ - aclresult = pg_database_aclcheck(MyDatabaseId, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(DatabaseRelationId, MyDatabaseId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_DATABASE, get_database_name(MyDatabaseId)); @@ -380,7 +381,7 @@ AlterSchemaOwner_internal(HeapTuple tup, Relation rel, Oid newOwnerId) * schemas. Because superusers will always have this right, we need * no special case for them. */ - aclresult = pg_database_aclcheck(MyDatabaseId, GetUserId(), + aclresult = object_aclcheck(DatabaseRelationId, MyDatabaseId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_DATABASE, diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c index 6804c7a8597..f0068078520 100644 --- a/src/backend/commands/tablecmds.c +++ b/src/backend/commands/tablecmds.c @@ -804,7 +804,7 @@ DefineRelation(CreateStmt *stmt, char relkind, Oid ownerId, { AclResult aclresult; - aclresult = pg_tablespace_aclcheck(tablespaceId, GetUserId(), + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, @@ -845,7 +845,7 @@ DefineRelation(CreateStmt *stmt, char relkind, Oid ownerId, ofTypeId = typenameTypeId(NULL, stmt->ofTypename); - aclresult = pg_type_aclcheck(ofTypeId, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, ofTypeId, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, ofTypeId); } @@ -6830,7 +6830,7 @@ ATExecAddColumn(List **wqueue, AlteredTableInfo *tab, Relation rel, tform = (Form_pg_type) GETSTRUCT(typeTuple); typeOid = tform->oid; - aclresult = pg_type_aclcheck(typeOid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, typeOid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, typeOid); @@ -12164,7 +12164,7 @@ ATPrepAlterColumnType(List **wqueue, /* Look up the target type */ typenameTypeIdAndMod(NULL, typeName, &targettype, &targettypmod); - aclresult = pg_type_aclcheck(targettype, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, targettype, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, targettype); @@ -13836,7 +13836,7 @@ ATExecChangeOwner(Oid relationOid, Oid newOwnerId, bool recursing, LOCKMODE lock check_is_member_of_role(GetUserId(), newOwnerId); /* New owner must have CREATE privilege on namespace */ - aclresult = pg_namespace_aclcheck(namespaceOid, newOwnerId, + aclresult = object_aclcheck(NamespaceRelationId, namespaceOid, newOwnerId, ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, @@ -14152,7 +14152,7 @@ ATPrepSetTableSpace(AlteredTableInfo *tab, Relation rel, const char *tablespacen { AclResult aclresult; - aclresult = pg_tablespace_aclcheck(tablespaceId, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceId, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, tablespacename); } @@ -14545,7 +14545,7 @@ AlterTableMoveAll(AlterTableMoveAllStmt *stmt) { AclResult aclresult; - aclresult = pg_tablespace_aclcheck(new_tablespaceoid, GetUserId(), + aclresult = object_aclcheck(TableSpaceRelationId, new_tablespaceoid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, @@ -17052,7 +17052,7 @@ RangeVarCallbackForAlterRelation(const RangeVar *rv, Oid relid, Oid oldrelid, */ if (IsA(stmt, RenameStmt)) { - aclresult = pg_namespace_aclcheck(classform->relnamespace, + aclresult = object_aclcheck(NamespaceRelationId, classform->relnamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, diff --git a/src/backend/commands/tablespace.c b/src/backend/commands/tablespace.c index b60cb712c1f..76e100b5602 100644 --- a/src/backend/commands/tablespace.c +++ b/src/backend/commands/tablespace.c @@ -1277,7 +1277,7 @@ check_temp_tablespaces(char **newval, void **extra, GucSource source) } /* Check permissions, similarly complaining only if interactive */ - aclresult = pg_tablespace_aclcheck(curoid, GetUserId(), + aclresult = object_aclcheck(TableSpaceRelationId, curoid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) { @@ -1407,7 +1407,7 @@ PrepareTempTablespaces(void) } /* Check permissions similarly */ - aclresult = pg_tablespace_aclcheck(curoid, GetUserId(), + aclresult = object_aclcheck(TableSpaceRelationId, curoid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) continue; diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c index df408092820..aaf54874be2 100644 --- a/src/backend/commands/trigger.c +++ b/src/backend/commands/trigger.c @@ -696,7 +696,7 @@ CreateTriggerFiringOn(CreateTrigStmt *stmt, const char *queryString, funcoid = LookupFuncName(stmt->funcname, 0, NULL, false); if (!isInternal) { - aclresult = pg_proc_aclcheck(funcoid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, funcoid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, NameListToString(stmt->funcname)); diff --git a/src/backend/commands/tsearchcmds.c b/src/backend/commands/tsearchcmds.c index 365bfd30fdf..9304c53d4ba 100644 --- a/src/backend/commands/tsearchcmds.c +++ b/src/backend/commands/tsearchcmds.c @@ -408,7 +408,7 @@ DefineTSDictionary(List *names, List *parameters) namespaceoid = QualifiedNameGetCreationNamespace(names, &dictname); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(namespaceoid, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, namespaceoid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(namespaceoid)); @@ -911,7 +911,7 @@ DefineTSConfiguration(List *names, List *parameters, ObjectAddress *copied) namespaceoid = QualifiedNameGetCreationNamespace(names, &cfgname); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(namespaceoid, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, namespaceoid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(namespaceoid)); diff --git a/src/backend/commands/typecmds.c b/src/backend/commands/typecmds.c index b7e0194d236..ecc8b3f44c9 100644 --- a/src/backend/commands/typecmds.c +++ b/src/backend/commands/typecmds.c @@ -222,7 +222,7 @@ DefineType(ParseState *pstate, List *names, List *parameters) #ifdef NOT_USED /* XXX this is unnecessary given the superuser check above */ /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(typeNamespace, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, typeNamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(typeNamespace)); @@ -733,7 +733,7 @@ DefineDomain(CreateDomainStmt *stmt) &domainName); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(domainNamespace, GetUserId(), + aclresult = object_aclcheck(NamespaceRelationId, domainNamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, @@ -781,7 +781,7 @@ DefineDomain(CreateDomainStmt *stmt) errmsg("\"%s\" is not a valid base type for a domain", TypeNameToString(stmt->typeName)))); - aclresult = pg_type_aclcheck(basetypeoid, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(TypeRelationId, basetypeoid, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error_type(aclresult, basetypeoid); @@ -1149,7 +1149,7 @@ DefineEnum(CreateEnumStmt *stmt) &enumName); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(enumNamespace, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, enumNamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(enumNamespace)); @@ -1369,7 +1369,7 @@ DefineRange(ParseState *pstate, CreateRangeStmt *stmt) &typeName); /* Check we have creation rights in target namespace */ - aclresult = pg_namespace_aclcheck(typeNamespace, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(NamespaceRelationId, typeNamespace, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(typeNamespace)); @@ -2341,7 +2341,7 @@ findRangeCanonicalFunction(List *procname, Oid typeOid) func_signature_string(procname, 1, NIL, argList)))); /* Also, range type's creator must have permission to call function */ - aclresult = pg_proc_aclcheck(procOid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, procOid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(procOid)); @@ -2384,7 +2384,7 @@ findRangeSubtypeDiffFunction(List *procname, Oid subtype) func_signature_string(procname, 2, NIL, argList)))); /* Also, range type's creator must have permission to call function */ - aclresult = pg_proc_aclcheck(procOid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, procOid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(procOid)); @@ -3748,7 +3748,7 @@ AlterTypeOwner(List *names, Oid newOwnerId, ObjectType objecttype) check_is_member_of_role(GetUserId(), newOwnerId); /* New owner must have CREATE privilege on namespace */ - aclresult = pg_namespace_aclcheck(typTup->typnamespace, + aclresult = object_aclcheck(NamespaceRelationId, typTup->typnamespace, newOwnerId, ACL_CREATE); if (aclresult != ACLCHECK_OK) diff --git a/src/backend/executor/execExpr.c b/src/backend/executor/execExpr.c index 25a94bbaaaa..0ecb2f86100 100644 --- a/src/backend/executor/execExpr.c +++ b/src/backend/executor/execExpr.c @@ -32,6 +32,7 @@ #include "access/nbtree.h" #include "catalog/objectaccess.h" +#include "catalog/pg_proc.h" #include "catalog/pg_type.h" #include "executor/execExpr.h" #include "executor/nodeSubplan.h" @@ -1224,7 +1225,7 @@ ExecInitExprRec(Expr *node, ExprState *state, arrayarg = (Expr *) lsecond(opexpr->args); /* Check permission to call function */ - aclresult = pg_proc_aclcheck(cmpfuncid, + aclresult = object_aclcheck(ProcedureRelationId, cmpfuncid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) @@ -1234,7 +1235,7 @@ ExecInitExprRec(Expr *node, ExprState *state, if (OidIsValid(opexpr->hashfuncid)) { - aclresult = pg_proc_aclcheck(opexpr->hashfuncid, + aclresult = object_aclcheck(ProcedureRelationId, opexpr->hashfuncid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) @@ -2462,7 +2463,7 @@ ExecInitFunc(ExprEvalStep *scratch, Expr *node, List *args, Oid funcid, ListCell *lc; /* Check permission to call function */ - aclresult = pg_proc_aclcheck(funcid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, funcid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(funcid)); InvokeFunctionExecuteHook(funcid); @@ -3797,7 +3798,7 @@ ExecBuildGroupingEqual(TupleDesc ldesc, TupleDesc rdesc, AclResult aclresult; /* Check permission to call function */ - aclresult = pg_proc_aclcheck(foid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, foid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(foid)); @@ -3931,7 +3932,7 @@ ExecBuildParamSetEqual(TupleDesc desc, AclResult aclresult; /* Check permission to call function */ - aclresult = pg_proc_aclcheck(foid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, foid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(foid)); diff --git a/src/backend/executor/execSRF.c b/src/backend/executor/execSRF.c index c2ad4d731b8..d8a5e3ce35b 100644 --- a/src/backend/executor/execSRF.c +++ b/src/backend/executor/execSRF.c @@ -20,6 +20,7 @@ #include "access/htup_details.h" #include "catalog/objectaccess.h" +#include "catalog/pg_proc.h" #include "executor/execdebug.h" #include "funcapi.h" #include "miscadmin.h" @@ -701,7 +702,7 @@ init_sexpr(Oid foid, Oid input_collation, Expr *node, size_t numargs = list_length(sexpr->args); /* Check permission to call function */ - aclresult = pg_proc_aclcheck(foid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, foid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(foid)); InvokeFunctionExecuteHook(foid); diff --git a/src/backend/executor/nodeAgg.c b/src/backend/executor/nodeAgg.c index 28f6f9c5c5a..30c91431838 100644 --- a/src/backend/executor/nodeAgg.c +++ b/src/backend/executor/nodeAgg.c @@ -3676,7 +3676,7 @@ ExecInitAgg(Agg *node, EState *estate, int eflags) aggform = (Form_pg_aggregate) GETSTRUCT(aggTuple); /* Check permission to call aggregate function */ - aclresult = pg_proc_aclcheck(aggref->aggfnoid, GetUserId(), + aclresult = object_aclcheck(ProcedureRelationId, aggref->aggfnoid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_AGGREGATE, @@ -3743,7 +3743,7 @@ ExecInitAgg(Agg *node, EState *estate, int eflags) if (OidIsValid(finalfn_oid)) { - aclresult = pg_proc_aclcheck(finalfn_oid, aggOwner, + aclresult = object_aclcheck(ProcedureRelationId, finalfn_oid, aggOwner, ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, @@ -3752,7 +3752,7 @@ ExecInitAgg(Agg *node, EState *estate, int eflags) } if (OidIsValid(serialfn_oid)) { - aclresult = pg_proc_aclcheck(serialfn_oid, aggOwner, + aclresult = object_aclcheck(ProcedureRelationId, serialfn_oid, aggOwner, ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, @@ -3761,7 +3761,7 @@ ExecInitAgg(Agg *node, EState *estate, int eflags) } if (OidIsValid(deserialfn_oid)) { - aclresult = pg_proc_aclcheck(deserialfn_oid, aggOwner, + aclresult = object_aclcheck(ProcedureRelationId, deserialfn_oid, aggOwner, ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, @@ -3841,7 +3841,7 @@ ExecInitAgg(Agg *node, EState *estate, int eflags) else transfn_oid = aggform->aggtransfn; - aclresult = pg_proc_aclcheck(transfn_oid, aggOwner, ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, transfn_oid, aggOwner, ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(transfn_oid)); diff --git a/src/backend/executor/nodeWindowAgg.c b/src/backend/executor/nodeWindowAgg.c index 1750121c492..81ba024bbaf 100644 --- a/src/backend/executor/nodeWindowAgg.c +++ b/src/backend/executor/nodeWindowAgg.c @@ -2553,7 +2553,7 @@ ExecInitWindowAgg(WindowAgg *node, EState *estate, int eflags) wfuncstate->wfuncno = wfuncno; /* Check permission to call window function */ - aclresult = pg_proc_aclcheck(wfunc->winfnoid, GetUserId(), + aclresult = object_aclcheck(ProcedureRelationId, wfunc->winfnoid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, @@ -2834,7 +2834,7 @@ initialize_peragg(WindowAggState *winstate, WindowFunc *wfunc, aggOwner = ((Form_pg_proc) GETSTRUCT(procTuple))->proowner; ReleaseSysCache(procTuple); - aclresult = pg_proc_aclcheck(transfn_oid, aggOwner, + aclresult = object_aclcheck(ProcedureRelationId, transfn_oid, aggOwner, ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, @@ -2843,7 +2843,7 @@ initialize_peragg(WindowAggState *winstate, WindowFunc *wfunc, if (OidIsValid(invtransfn_oid)) { - aclresult = pg_proc_aclcheck(invtransfn_oid, aggOwner, + aclresult = object_aclcheck(ProcedureRelationId, invtransfn_oid, aggOwner, ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, @@ -2853,7 +2853,7 @@ initialize_peragg(WindowAggState *winstate, WindowFunc *wfunc, if (OidIsValid(finalfn_oid)) { - aclresult = pg_proc_aclcheck(finalfn_oid, aggOwner, + aclresult = object_aclcheck(ProcedureRelationId, finalfn_oid, aggOwner, ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, diff --git a/src/backend/optimizer/util/clauses.c b/src/backend/optimizer/util/clauses.c index 5e791333cbd..317c10c2b9f 100644 --- a/src/backend/optimizer/util/clauses.c +++ b/src/backend/optimizer/util/clauses.c @@ -4436,7 +4436,7 @@ inline_function(Oid funcid, Oid result_type, Oid result_collid, return NULL; /* Check permission to call function (fail later, if not) */ - if (pg_proc_aclcheck(funcid, GetUserId(), ACL_EXECUTE) != ACLCHECK_OK) + if (object_aclcheck(ProcedureRelationId, funcid, GetUserId(), ACL_EXECUTE) != ACLCHECK_OK) return NULL; /* Check whether a plugin wants to hook function entry/exit */ @@ -4978,7 +4978,7 @@ inline_set_returning_function(PlannerInfo *root, RangeTblEntry *rte) return NULL; /* Check permission to call function (fail later, if not) */ - if (pg_proc_aclcheck(func_oid, GetUserId(), ACL_EXECUTE) != ACLCHECK_OK) + if (object_aclcheck(ProcedureRelationId, func_oid, GetUserId(), ACL_EXECUTE) != ACLCHECK_OK) return NULL; /* Check whether a plugin wants to hook function entry/exit */ diff --git a/src/backend/parser/parse_utilcmd.c b/src/backend/parser/parse_utilcmd.c index 8140e79d8f1..487eb2041be 100644 --- a/src/backend/parser/parse_utilcmd.c +++ b/src/backend/parser/parse_utilcmd.c @@ -996,7 +996,7 @@ transformTableLikeClause(CreateStmtContext *cxt, TableLikeClause *table_like_cla */ if (relation->rd_rel->relkind == RELKIND_COMPOSITE_TYPE) { - aclresult = pg_type_aclcheck(relation->rd_rel->reltype, GetUserId(), + aclresult = object_aclcheck(TypeRelationId, relation->rd_rel->reltype, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TYPE, diff --git a/src/backend/tcop/fastpath.c b/src/backend/tcop/fastpath.c index d429aa46631..4e6cc0667d3 100644 --- a/src/backend/tcop/fastpath.c +++ b/src/backend/tcop/fastpath.c @@ -20,6 +20,7 @@ #include "access/htup_details.h" #include "access/xact.h" #include "catalog/objectaccess.h" +#include "catalog/pg_namespace.h" #include "catalog/pg_proc.h" #include "libpq/libpq.h" #include "libpq/pqformat.h" @@ -239,13 +240,13 @@ HandleFunctionRequest(StringInfo msgBuf) * Check permission to access and call function. Since we didn't go * through a normal name lookup, we need to check schema usage too. */ - aclresult = pg_namespace_aclcheck(fip->namespace, GetUserId(), ACL_USAGE); + aclresult = object_aclcheck(NamespaceRelationId, fip->namespace, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_SCHEMA, get_namespace_name(fip->namespace)); InvokeNamespaceSearchHook(fip->namespace, true); - aclresult = pg_proc_aclcheck(fid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, fid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, get_func_name(fid)); diff --git a/src/backend/utils/adt/acl.c b/src/backend/utils/adt/acl.c index 0bc79cba2b1..8bdb9461b7f 100644 --- a/src/backend/utils/adt/acl.c +++ b/src/backend/utils/adt/acl.c @@ -23,7 +23,13 @@ #include "catalog/pg_authid.h" #include "catalog/pg_class.h" #include "catalog/pg_database.h" +#include "catalog/pg_foreign_data_wrapper.h" +#include "catalog/pg_foreign_server.h" +#include "catalog/pg_language.h" +#include "catalog/pg_namespace.h" #include "catalog/pg_parameter_acl.h" +#include "catalog/pg_proc.h" +#include "catalog/pg_tablespace.h" #include "catalog/pg_type.h" #include "commands/dbcommands.h" #include "commands/proclang.h" @@ -2902,7 +2908,7 @@ has_database_privilege_name_name(PG_FUNCTION_ARGS) databaseoid = convert_database_name(databasename); mode = convert_database_priv_string(priv_type_text); - aclresult = pg_database_aclcheck(databaseoid, roleid, mode); + aclresult = object_aclcheck(DatabaseRelationId, databaseoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -2927,7 +2933,7 @@ has_database_privilege_name(PG_FUNCTION_ARGS) databaseoid = convert_database_name(databasename); mode = convert_database_priv_string(priv_type_text); - aclresult = pg_database_aclcheck(databaseoid, roleid, mode); + aclresult = object_aclcheck(DatabaseRelationId, databaseoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -2953,7 +2959,7 @@ has_database_privilege_name_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(DATABASEOID, ObjectIdGetDatum(databaseoid))) PG_RETURN_NULL(); - aclresult = pg_database_aclcheck(databaseoid, roleid, mode); + aclresult = object_aclcheck(DatabaseRelationId, databaseoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -2979,7 +2985,7 @@ has_database_privilege_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(DATABASEOID, ObjectIdGetDatum(databaseoid))) PG_RETURN_NULL(); - aclresult = pg_database_aclcheck(databaseoid, roleid, mode); + aclresult = object_aclcheck(DatabaseRelationId, databaseoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3002,7 +3008,7 @@ has_database_privilege_id_name(PG_FUNCTION_ARGS) databaseoid = convert_database_name(databasename); mode = convert_database_priv_string(priv_type_text); - aclresult = pg_database_aclcheck(databaseoid, roleid, mode); + aclresult = object_aclcheck(DatabaseRelationId, databaseoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3026,7 +3032,7 @@ has_database_privilege_id_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(DATABASEOID, ObjectIdGetDatum(databaseoid))) PG_RETURN_NULL(); - aclresult = pg_database_aclcheck(databaseoid, roleid, mode); + aclresult = object_aclcheck(DatabaseRelationId, databaseoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3099,7 +3105,7 @@ has_foreign_data_wrapper_privilege_name_name(PG_FUNCTION_ARGS) fdwid = convert_foreign_data_wrapper_name(fdwname); mode = convert_foreign_data_wrapper_priv_string(priv_type_text); - aclresult = pg_foreign_data_wrapper_aclcheck(fdwid, roleid, mode); + aclresult = object_aclcheck(ForeignDataWrapperRelationId, fdwid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3124,7 +3130,7 @@ has_foreign_data_wrapper_privilege_name(PG_FUNCTION_ARGS) fdwid = convert_foreign_data_wrapper_name(fdwname); mode = convert_foreign_data_wrapper_priv_string(priv_type_text); - aclresult = pg_foreign_data_wrapper_aclcheck(fdwid, roleid, mode); + aclresult = object_aclcheck(ForeignDataWrapperRelationId, fdwid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3150,7 +3156,7 @@ has_foreign_data_wrapper_privilege_name_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(FOREIGNDATAWRAPPEROID, ObjectIdGetDatum(fdwid))) PG_RETURN_NULL(); - aclresult = pg_foreign_data_wrapper_aclcheck(fdwid, roleid, mode); + aclresult = object_aclcheck(ForeignDataWrapperRelationId, fdwid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3176,7 +3182,7 @@ has_foreign_data_wrapper_privilege_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(FOREIGNDATAWRAPPEROID, ObjectIdGetDatum(fdwid))) PG_RETURN_NULL(); - aclresult = pg_foreign_data_wrapper_aclcheck(fdwid, roleid, mode); + aclresult = object_aclcheck(ForeignDataWrapperRelationId, fdwid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3199,7 +3205,7 @@ has_foreign_data_wrapper_privilege_id_name(PG_FUNCTION_ARGS) fdwid = convert_foreign_data_wrapper_name(fdwname); mode = convert_foreign_data_wrapper_priv_string(priv_type_text); - aclresult = pg_foreign_data_wrapper_aclcheck(fdwid, roleid, mode); + aclresult = object_aclcheck(ForeignDataWrapperRelationId, fdwid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3223,7 +3229,7 @@ has_foreign_data_wrapper_privilege_id_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(FOREIGNDATAWRAPPEROID, ObjectIdGetDatum(fdwid))) PG_RETURN_NULL(); - aclresult = pg_foreign_data_wrapper_aclcheck(fdwid, roleid, mode); + aclresult = object_aclcheck(ForeignDataWrapperRelationId, fdwid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3290,7 +3296,7 @@ has_function_privilege_name_name(PG_FUNCTION_ARGS) functionoid = convert_function_name(functionname); mode = convert_function_priv_string(priv_type_text); - aclresult = pg_proc_aclcheck(functionoid, roleid, mode); + aclresult = object_aclcheck(ProcedureRelationId, functionoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3315,7 +3321,7 @@ has_function_privilege_name(PG_FUNCTION_ARGS) functionoid = convert_function_name(functionname); mode = convert_function_priv_string(priv_type_text); - aclresult = pg_proc_aclcheck(functionoid, roleid, mode); + aclresult = object_aclcheck(ProcedureRelationId, functionoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3341,7 +3347,7 @@ has_function_privilege_name_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(PROCOID, ObjectIdGetDatum(functionoid))) PG_RETURN_NULL(); - aclresult = pg_proc_aclcheck(functionoid, roleid, mode); + aclresult = object_aclcheck(ProcedureRelationId, functionoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3367,7 +3373,7 @@ has_function_privilege_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(PROCOID, ObjectIdGetDatum(functionoid))) PG_RETURN_NULL(); - aclresult = pg_proc_aclcheck(functionoid, roleid, mode); + aclresult = object_aclcheck(ProcedureRelationId, functionoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3390,7 +3396,7 @@ has_function_privilege_id_name(PG_FUNCTION_ARGS) functionoid = convert_function_name(functionname); mode = convert_function_priv_string(priv_type_text); - aclresult = pg_proc_aclcheck(functionoid, roleid, mode); + aclresult = object_aclcheck(ProcedureRelationId, functionoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3414,7 +3420,7 @@ has_function_privilege_id_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(PROCOID, ObjectIdGetDatum(functionoid))) PG_RETURN_NULL(); - aclresult = pg_proc_aclcheck(functionoid, roleid, mode); + aclresult = object_aclcheck(ProcedureRelationId, functionoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3490,7 +3496,7 @@ has_language_privilege_name_name(PG_FUNCTION_ARGS) languageoid = convert_language_name(languagename); mode = convert_language_priv_string(priv_type_text); - aclresult = pg_language_aclcheck(languageoid, roleid, mode); + aclresult = object_aclcheck(LanguageRelationId, languageoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3515,7 +3521,7 @@ has_language_privilege_name(PG_FUNCTION_ARGS) languageoid = convert_language_name(languagename); mode = convert_language_priv_string(priv_type_text); - aclresult = pg_language_aclcheck(languageoid, roleid, mode); + aclresult = object_aclcheck(LanguageRelationId, languageoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3541,7 +3547,7 @@ has_language_privilege_name_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(LANGOID, ObjectIdGetDatum(languageoid))) PG_RETURN_NULL(); - aclresult = pg_language_aclcheck(languageoid, roleid, mode); + aclresult = object_aclcheck(LanguageRelationId, languageoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3567,7 +3573,7 @@ has_language_privilege_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(LANGOID, ObjectIdGetDatum(languageoid))) PG_RETURN_NULL(); - aclresult = pg_language_aclcheck(languageoid, roleid, mode); + aclresult = object_aclcheck(LanguageRelationId, languageoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3590,7 +3596,7 @@ has_language_privilege_id_name(PG_FUNCTION_ARGS) languageoid = convert_language_name(languagename); mode = convert_language_priv_string(priv_type_text); - aclresult = pg_language_aclcheck(languageoid, roleid, mode); + aclresult = object_aclcheck(LanguageRelationId, languageoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3614,7 +3620,7 @@ has_language_privilege_id_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(LANGOID, ObjectIdGetDatum(languageoid))) PG_RETURN_NULL(); - aclresult = pg_language_aclcheck(languageoid, roleid, mode); + aclresult = object_aclcheck(LanguageRelationId, languageoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3681,7 +3687,7 @@ has_schema_privilege_name_name(PG_FUNCTION_ARGS) schemaoid = convert_schema_name(schemaname); mode = convert_schema_priv_string(priv_type_text); - aclresult = pg_namespace_aclcheck(schemaoid, roleid, mode); + aclresult = object_aclcheck(NamespaceRelationId, schemaoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3706,7 +3712,7 @@ has_schema_privilege_name(PG_FUNCTION_ARGS) schemaoid = convert_schema_name(schemaname); mode = convert_schema_priv_string(priv_type_text); - aclresult = pg_namespace_aclcheck(schemaoid, roleid, mode); + aclresult = object_aclcheck(NamespaceRelationId, schemaoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3732,7 +3738,7 @@ has_schema_privilege_name_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(NAMESPACEOID, ObjectIdGetDatum(schemaoid))) PG_RETURN_NULL(); - aclresult = pg_namespace_aclcheck(schemaoid, roleid, mode); + aclresult = object_aclcheck(NamespaceRelationId, schemaoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3758,7 +3764,7 @@ has_schema_privilege_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(NAMESPACEOID, ObjectIdGetDatum(schemaoid))) PG_RETURN_NULL(); - aclresult = pg_namespace_aclcheck(schemaoid, roleid, mode); + aclresult = object_aclcheck(NamespaceRelationId, schemaoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3781,7 +3787,7 @@ has_schema_privilege_id_name(PG_FUNCTION_ARGS) schemaoid = convert_schema_name(schemaname); mode = convert_schema_priv_string(priv_type_text); - aclresult = pg_namespace_aclcheck(schemaoid, roleid, mode); + aclresult = object_aclcheck(NamespaceRelationId, schemaoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3805,7 +3811,7 @@ has_schema_privilege_id_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(NAMESPACEOID, ObjectIdGetDatum(schemaoid))) PG_RETURN_NULL(); - aclresult = pg_namespace_aclcheck(schemaoid, roleid, mode); + aclresult = object_aclcheck(NamespaceRelationId, schemaoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3874,7 +3880,7 @@ has_server_privilege_name_name(PG_FUNCTION_ARGS) serverid = convert_server_name(servername); mode = convert_server_priv_string(priv_type_text); - aclresult = pg_foreign_server_aclcheck(serverid, roleid, mode); + aclresult = object_aclcheck(ForeignServerRelationId, serverid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3899,7 +3905,7 @@ has_server_privilege_name(PG_FUNCTION_ARGS) serverid = convert_server_name(servername); mode = convert_server_priv_string(priv_type_text); - aclresult = pg_foreign_server_aclcheck(serverid, roleid, mode); + aclresult = object_aclcheck(ForeignServerRelationId, serverid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3925,7 +3931,7 @@ has_server_privilege_name_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(FOREIGNSERVEROID, ObjectIdGetDatum(serverid))) PG_RETURN_NULL(); - aclresult = pg_foreign_server_aclcheck(serverid, roleid, mode); + aclresult = object_aclcheck(ForeignServerRelationId, serverid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3951,7 +3957,7 @@ has_server_privilege_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(FOREIGNSERVEROID, ObjectIdGetDatum(serverid))) PG_RETURN_NULL(); - aclresult = pg_foreign_server_aclcheck(serverid, roleid, mode); + aclresult = object_aclcheck(ForeignServerRelationId, serverid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3974,7 +3980,7 @@ has_server_privilege_id_name(PG_FUNCTION_ARGS) serverid = convert_server_name(servername); mode = convert_server_priv_string(priv_type_text); - aclresult = pg_foreign_server_aclcheck(serverid, roleid, mode); + aclresult = object_aclcheck(ForeignServerRelationId, serverid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -3998,7 +4004,7 @@ has_server_privilege_id_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(FOREIGNSERVEROID, ObjectIdGetDatum(serverid))) PG_RETURN_NULL(); - aclresult = pg_foreign_server_aclcheck(serverid, roleid, mode); + aclresult = object_aclcheck(ForeignServerRelationId, serverid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4065,7 +4071,7 @@ has_tablespace_privilege_name_name(PG_FUNCTION_ARGS) tablespaceoid = convert_tablespace_name(tablespacename); mode = convert_tablespace_priv_string(priv_type_text); - aclresult = pg_tablespace_aclcheck(tablespaceoid, roleid, mode); + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4090,7 +4096,7 @@ has_tablespace_privilege_name(PG_FUNCTION_ARGS) tablespaceoid = convert_tablespace_name(tablespacename); mode = convert_tablespace_priv_string(priv_type_text); - aclresult = pg_tablespace_aclcheck(tablespaceoid, roleid, mode); + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4116,7 +4122,7 @@ has_tablespace_privilege_name_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(TABLESPACEOID, ObjectIdGetDatum(tablespaceoid))) PG_RETURN_NULL(); - aclresult = pg_tablespace_aclcheck(tablespaceoid, roleid, mode); + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4142,7 +4148,7 @@ has_tablespace_privilege_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(TABLESPACEOID, ObjectIdGetDatum(tablespaceoid))) PG_RETURN_NULL(); - aclresult = pg_tablespace_aclcheck(tablespaceoid, roleid, mode); + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4165,7 +4171,7 @@ has_tablespace_privilege_id_name(PG_FUNCTION_ARGS) tablespaceoid = convert_tablespace_name(tablespacename); mode = convert_tablespace_priv_string(priv_type_text); - aclresult = pg_tablespace_aclcheck(tablespaceoid, roleid, mode); + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4189,7 +4195,7 @@ has_tablespace_privilege_id_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(TABLESPACEOID, ObjectIdGetDatum(tablespaceoid))) PG_RETURN_NULL(); - aclresult = pg_tablespace_aclcheck(tablespaceoid, roleid, mode); + aclresult = object_aclcheck(TableSpaceRelationId, tablespaceoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4255,7 +4261,7 @@ has_type_privilege_name_name(PG_FUNCTION_ARGS) typeoid = convert_type_name(typename); mode = convert_type_priv_string(priv_type_text); - aclresult = pg_type_aclcheck(typeoid, roleid, mode); + aclresult = object_aclcheck(TypeRelationId, typeoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4280,7 +4286,7 @@ has_type_privilege_name(PG_FUNCTION_ARGS) typeoid = convert_type_name(typename); mode = convert_type_priv_string(priv_type_text); - aclresult = pg_type_aclcheck(typeoid, roleid, mode); + aclresult = object_aclcheck(TypeRelationId, typeoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4306,7 +4312,7 @@ has_type_privilege_name_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(TYPEOID, ObjectIdGetDatum(typeoid))) PG_RETURN_NULL(); - aclresult = pg_type_aclcheck(typeoid, roleid, mode); + aclresult = object_aclcheck(TypeRelationId, typeoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4332,7 +4338,7 @@ has_type_privilege_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(TYPEOID, ObjectIdGetDatum(typeoid))) PG_RETURN_NULL(); - aclresult = pg_type_aclcheck(typeoid, roleid, mode); + aclresult = object_aclcheck(TypeRelationId, typeoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4355,7 +4361,7 @@ has_type_privilege_id_name(PG_FUNCTION_ARGS) typeoid = convert_type_name(typename); mode = convert_type_priv_string(priv_type_text); - aclresult = pg_type_aclcheck(typeoid, roleid, mode); + aclresult = object_aclcheck(TypeRelationId, typeoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } @@ -4379,7 +4385,7 @@ has_type_privilege_id_id(PG_FUNCTION_ARGS) if (!SearchSysCacheExists1(TYPEOID, ObjectIdGetDatum(typeoid))) PG_RETURN_NULL(); - aclresult = pg_type_aclcheck(typeoid, roleid, mode); + aclresult = object_aclcheck(TypeRelationId, typeoid, roleid, mode); PG_RETURN_BOOL(aclresult == ACLCHECK_OK); } diff --git a/src/backend/utils/adt/dbsize.c b/src/backend/utils/adt/dbsize.c index 0a9b93f2634..141db7c9c1c 100644 --- a/src/backend/utils/adt/dbsize.c +++ b/src/backend/utils/adt/dbsize.c @@ -18,6 +18,7 @@ #include "catalog/catalog.h" #include "catalog/namespace.h" #include "catalog/pg_authid.h" +#include "catalog/pg_database.h" #include "catalog/pg_tablespace.h" #include "commands/dbcommands.h" #include "commands/tablespace.h" @@ -115,7 +116,7 @@ calculate_database_size(Oid dbOid) * User must have connect privilege for target database or have privileges * of pg_read_all_stats */ - aclresult = pg_database_aclcheck(dbOid, GetUserId(), ACL_CONNECT); + aclresult = object_aclcheck(DatabaseRelationId, dbOid, GetUserId(), ACL_CONNECT); if (aclresult != ACLCHECK_OK && !has_privs_of_role(GetUserId(), ROLE_PG_READ_ALL_STATS)) { @@ -203,7 +204,7 @@ calculate_tablespace_size(Oid tblspcOid) if (tblspcOid != MyDatabaseTableSpace && !has_privs_of_role(GetUserId(), ROLE_PG_READ_ALL_STATS)) { - aclresult = pg_tablespace_aclcheck(tblspcOid, GetUserId(), ACL_CREATE); + aclresult = object_aclcheck(TableSpaceRelationId, tblspcOid, GetUserId(), ACL_CREATE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_TABLESPACE, get_tablespace_name(tblspcOid)); diff --git a/src/backend/utils/fmgr/fmgr.c b/src/backend/utils/fmgr/fmgr.c index a9dd068095b..3c210297aa1 100644 --- a/src/backend/utils/fmgr/fmgr.c +++ b/src/backend/utils/fmgr/fmgr.c @@ -2054,7 +2054,7 @@ CheckFunctionValidatorAccess(Oid validatorOid, Oid functionOid) langStruct->lanvalidator))); /* first validate that we have permissions to use the language */ - aclresult = pg_language_aclcheck(procStruct->prolang, GetUserId(), + aclresult = object_aclcheck(LanguageRelationId, procStruct->prolang, GetUserId(), ACL_USAGE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_LANGUAGE, @@ -2065,7 +2065,7 @@ CheckFunctionValidatorAccess(Oid validatorOid, Oid functionOid) * execute it, there should be no possible side-effect of * compiling/validation that execution can't have. */ - aclresult = pg_proc_aclcheck(functionOid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, functionOid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, NameStr(procStruct->proname)); diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c index 31b7e1de5df..a990c833c5b 100644 --- a/src/backend/utils/init/postinit.c +++ b/src/backend/utils/init/postinit.c @@ -359,7 +359,7 @@ CheckMyDatabase(const char *name, bool am_superuser, bool override_allow_connect * and save a few cycles.) */ if (!am_superuser && - pg_database_aclcheck(MyDatabaseId, GetUserId(), + object_aclcheck(DatabaseRelationId, MyDatabaseId, GetUserId(), ACL_CONNECT) != ACLCHECK_OK) ereport(FATAL, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), diff --git a/src/include/utils/acl.h b/src/include/utils/acl.h index 79eff597689..35b3d8dd88b 100644 --- a/src/include/utils/acl.h +++ b/src/include/utils/acl.h @@ -235,39 +235,13 @@ extern void ExecAlterDefaultPrivilegesStmt(ParseState *pstate, AlterDefaultPrivi extern void RemoveRoleFromObjectACL(Oid roleid, Oid classid, Oid objid); -extern AclMode pg_attribute_aclmask(Oid table_oid, AttrNumber attnum, - Oid roleid, AclMode mask, AclMaskHow how); -extern AclMode pg_attribute_aclmask_ext(Oid table_oid, AttrNumber attnum, - Oid roleid, AclMode mask, - AclMaskHow how, bool *is_missing); extern AclMode pg_class_aclmask(Oid table_oid, Oid roleid, AclMode mask, AclMaskHow how); -extern AclMode pg_class_aclmask_ext(Oid table_oid, Oid roleid, - AclMode mask, AclMaskHow how, - bool *is_missing); -extern AclMode pg_database_aclmask(Oid db_oid, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_parameter_aclmask(const char *name, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_parameter_acl_aclmask(Oid acl_oid, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_proc_aclmask(Oid proc_oid, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_language_aclmask(Oid lang_oid, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_largeobject_aclmask_snapshot(Oid lobj_oid, Oid roleid, - AclMode mask, AclMaskHow how, Snapshot snapshot); -extern AclMode pg_namespace_aclmask(Oid nsp_oid, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_tablespace_aclmask(Oid spc_oid, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_foreign_data_wrapper_aclmask(Oid fdw_oid, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_foreign_server_aclmask(Oid srv_oid, Oid roleid, - AclMode mask, AclMaskHow how); -extern AclMode pg_type_aclmask(Oid type_oid, Oid roleid, - AclMode mask, AclMaskHow how); +/* generic function */ +extern AclResult object_aclcheck(Oid classid, Oid objectid, Oid roleid, AclMode mode); + +/* special cases */ extern AclResult pg_attribute_aclcheck(Oid table_oid, AttrNumber attnum, Oid roleid, AclMode mode); extern AclResult pg_attribute_aclcheck_ext(Oid table_oid, AttrNumber attnum, @@ -278,20 +252,10 @@ extern AclResult pg_attribute_aclcheck_all(Oid table_oid, Oid roleid, extern AclResult pg_class_aclcheck(Oid table_oid, Oid roleid, AclMode mode); extern AclResult pg_class_aclcheck_ext(Oid table_oid, Oid roleid, AclMode mode, bool *is_missing); -extern AclResult pg_database_aclcheck(Oid db_oid, Oid roleid, AclMode mode); extern AclResult pg_parameter_aclcheck(const char *name, Oid roleid, AclMode mode); -extern AclResult pg_parameter_acl_aclcheck(Oid acl_oid, Oid roleid, - AclMode mode); -extern AclResult pg_proc_aclcheck(Oid proc_oid, Oid roleid, AclMode mode); -extern AclResult pg_language_aclcheck(Oid lang_oid, Oid roleid, AclMode mode); extern AclResult pg_largeobject_aclcheck_snapshot(Oid lobj_oid, Oid roleid, AclMode mode, Snapshot snapshot); -extern AclResult pg_namespace_aclcheck(Oid nsp_oid, Oid roleid, AclMode mode); -extern AclResult pg_tablespace_aclcheck(Oid spc_oid, Oid roleid, AclMode mode); -extern AclResult pg_foreign_data_wrapper_aclcheck(Oid fdw_oid, Oid roleid, AclMode mode); -extern AclResult pg_foreign_server_aclcheck(Oid srv_oid, Oid roleid, AclMode mode); -extern AclResult pg_type_aclcheck(Oid type_oid, Oid roleid, AclMode mode); extern void aclcheck_error(AclResult aclerr, ObjectType objtype, const char *objectname); diff --git a/src/pl/tcl/pltcl.c b/src/pl/tcl/pltcl.c index eaa98d42c2e..4185fb12210 100644 --- a/src/pl/tcl/pltcl.c +++ b/src/pl/tcl/pltcl.c @@ -619,7 +619,7 @@ call_pltcl_start_proc(Oid prolang, bool pltrusted) procOid = LookupFuncName(namelist, 0, NULL, false); /* Current user must have permission to call function */ - aclresult = pg_proc_aclcheck(procOid, GetUserId(), ACL_EXECUTE); + aclresult = object_aclcheck(ProcedureRelationId, procOid, GetUserId(), ACL_EXECUTE); if (aclresult != ACLCHECK_OK) aclcheck_error(aclresult, OBJECT_FUNCTION, start_proc); |