Skip to content

Commit 7292055

Browse files
peterepetere
committed
Add support for privileges on types
This adds support for the more or less SQL-conforming USAGE privilege on types and domains. The intent is to be able restrict which users can create dependencies on types, which restricts the way in which owners can alter types. reviewed by Yeb Havinga
1 parent 05e992e commit 7292055

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+1249
-201
lines changed

‎doc/src/sgml/information_schema.sgml

Lines changed: 20 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,8 @@
284284
the attributes of composite data types defined in the database.
285285
(Note that the view does not give information about table columns,
286286
which are sometimes called attributes in PostgreSQL contexts.)
287+
Only those attributes are shown that the current user has access to (by way
288+
of being the owner of or having some privilege on the type).
287289
</para>
288290

289291
<table>
@@ -1915,8 +1917,10 @@
19151917
<title><literal>domain_constraints</literal></title>
19161918

19171919
<para>
1918-
The view <literal>domain_constraints</literal> contains all
1919-
constraints belonging to domains defined in the current database.
1920+
The view <literal>domain_constraints</literal> contains all constraints
1921+
belonging to domains defined in the current database. Only those domains
1922+
are shown that the current user has access to (by way of being the owner or
1923+
having some privilege).
19201924
</para>
19211925

19221926
<table>
@@ -2052,8 +2056,9 @@
20522056
<title><literal>domains</literal></title>
20532057

20542058
<para>
2055-
The view <literal>domains</literal> contains all domains defined in
2056-
the current database.
2059+
The view <literal>domains</literal> contains all domains defined in the
2060+
current database. Only those domains are shown that the current user has
2061+
access to (by way of being the owner or having some privilege).
20572062
</para>
20582063

20592064
<table>
@@ -5778,15 +5783,13 @@ ORDER BY c.ordinal_position;
57785783
<title><literal>udt_privileges</literal></title>
57795784

57805785
<para>
5781-
The view <literal>udt_privileges</literal> is intended to identify
5782-
<literal>USAGE</literal> privileges granted on user-defined types
5783-
to a currently enabled role or by a currently enabled role. Since
5784-
data types do not have real privileges
5785-
in <productname>PostgreSQL</productname>, this view shows implicit
5786-
non-grantable <literal>USAGE</literal> privileges granted by the
5787-
owner to <literal>PUBLIC</literal> for all types, including
5788-
built-in ones (except domains,
5789-
see <xref linkend="infoschema-usage-privileges"> for that).
5786+
The view <literal>udt_privileges</literal> identifies
5787+
<literal>USAGE</literal> privileges granted on user-defined types to a
5788+
currently enabled role or by a currently enabled role. There is one row for
5789+
each combination of column, grantor, and grantee. This view shows only
5790+
composite types (see under <xref linkend="infoschema-user-defined-types">
5791+
for why); see
5792+
<xref linkend="infoschema-usage-privileges"> for domain privileges.
57905793
</para>
57915794

57925795
<table>
@@ -5861,10 +5864,10 @@ ORDER BY c.ordinal_position;
58615864
</para>
58625865

58635866
<para>
5864-
Since collations and domains do not have real privileges
5867+
Since collations do not have real privileges
58655868
in <productname>PostgreSQL</productname>, this view shows implicit
58665869
non-grantable <literal>USAGE</literal> privileges granted by the
5867-
owner to <literal>PUBLIC</literal> for all collations and domains. The other
5870+
owner to <literal>PUBLIC</literal> for all collations. The other
58685871
object types, however, show real privileges.
58695872
</para>
58705873

@@ -5940,6 +5943,8 @@ ORDER BY c.ordinal_position;
59405943
<para>
59415944
The view <literal>user_defined_types</literal> currently contains
59425945
all composite types defined in the current database.
5946+
Only those types are shown that the current user has access to (by way
5947+
of being the owner or having some privilege).
59435948
</para>
59445949

59455950
<para>

‎doc/src/sgml/ref/alter_default_privileges.sgml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ GRANT { EXECUTE | ALL [ PRIVILEGES ] }
4242
ON FUNCTIONS
4343
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
4444

45+
GRANT { USAGE | ALL [ PRIVILEGES ] }
46+
ON TYPES
47+
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
48+
4549
REVOKE [ GRANT OPTION FOR ]
4650
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
4751
[, ...] | ALL [ PRIVILEGES ] }
@@ -61,6 +65,12 @@ REVOKE [ GRANT OPTION FOR ]
6165
ON FUNCTIONS
6266
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
6367
[ CASCADE | RESTRICT ]
68+
69+
REVOKE [ GRANT OPTION FOR ]
70+
{ USAGE | ALL [ PRIVILEGES ] }
71+
ON TYPES
72+
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
73+
[ CASCADE | RESTRICT ]
6474
</synopsis>
6575
</refsynopsisdiv>
6676

@@ -72,7 +82,7 @@ REVOKE [ GRANT OPTION FOR ]
7282
that will be applied to objects created in the future. (It does not
7383
affect privileges assigned to already-existing objects.) Currently,
7484
only the privileges for tables (including views and foreign tables),
75-
sequences, and functions can be altered.
85+
sequences, functions, and types (including domains) can be altered.
7686
</para>
7787

7888
<para>

‎doc/src/sgml/ref/alter_foreign_table.sgml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,8 @@ ALTER FOREIGN TABLE <replaceable class="PARAMETER">name</replaceable>
157157
the table's schema. (These restrictions enforce that altering the owner
158158
doesn't do anything you couldn't do by dropping and recreating the table.
159159
However, a superuser can alter ownership of any table anyway.)
160+
To add a column or alter a column type, you must also
161+
have <literal>USAGE</literal> privilege on the data type.
160162
</para>
161163
</refsect1>
162164

‎doc/src/sgml/ref/alter_table.sgml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -594,6 +594,9 @@ ALTER TABLE <replaceable class="PARAMETER">name</replaceable>
594594
the table's schema. (These restrictions enforce that altering the owner
595595
doesn't do anything you couldn't do by dropping and recreating the table.
596596
However, a superuser can alter ownership of any table anyway.)
597+
To add a column or alter a column type or use the <literal>OF</literal>
598+
clause, you must also have <literal>USAGE</literal> privilege on the data
599+
type.
597600
</para>
598601
</refsect1>
599602

‎doc/src/sgml/ref/alter_type.sgml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,8 @@ ALTER TYPE <replaceable class="PARAMETER">name</replaceable> ADD VALUE <replacea
156156
the type's schema. (These restrictions enforce that altering the owner
157157
doesn't do anything you couldn't do by dropping and recreating the type.
158158
However, a superuser can alter ownership of any type anyway.)
159+
To add an attribute or alter an attribute type, you must also
160+
have <literal>USAGE</literal> privilege on the data type.
159161
</para>
160162
</refsect1>
161163

‎doc/src/sgml/ref/create_aggregate.sgml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -163,6 +163,13 @@ SELECT col FROM tab ORDER BY col USING sortop LIMIT 1;
163163
than</quote> or <quote>greater than</quote> strategy member of a B-tree
164164
index operator class.
165165
</para>
166+
167+
<para>
168+
To be able to create an aggregate function, you must
169+
have <literal>USAGE</literal> privilege on the argument types, the state
170+
type, and the return type, as well as <literal>EXECUTE</literal> privilege
171+
on the transition and final functions.
172+
</para>
166173
</refsect1>
167174

168175
<refsect1>

‎doc/src/sgml/ref/create_cast.sgml

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -159,10 +159,11 @@ SELECT CAST ( 2 AS numeric ) + 4.0;
159159
</note>
160160

161161
<para>
162-
To be able to create a cast, you must own the source or the target
163-
data type. To create a binary-coercible cast, you must be superuser.
164-
(This restriction is made because an erroneous binary-coercible cast
165-
conversion can easily crash the server.)
162+
To be able to create a cast, you must own the source or the target data type
163+
and have <literal>USAGE</literal> privilege on the other type. To create a
164+
binary-coercible cast, you must be superuser. (This restriction is made
165+
because an erroneous binary-coercible cast conversion can easily crash the
166+
server.)
166167
</para>
167168
</refsect1>
168169

‎doc/src/sgml/ref/create_domain.sgml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,11 @@ CREATE DOMAIN <replaceable class="parameter">name</replaceable> [ AS ] <replacea
5959
Define a domain rather than setting up each table's constraint
6060
individually.
6161
</para>
62+
63+
<para>
64+
To be able to create a domain, you must have <literal>USAGE</literal>
65+
privilege on the underlying type.
66+
</para>
6267
</refsect1>
6368

6469
<refsect1>

‎doc/src/sgml/ref/create_foreign_table.sgml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,11 @@ CREATE FOREIGN TABLE [ IF NOT EXISTS ] <replaceable class="PARAMETER">table_name
5252
the foreign table. Therefore, foreign tables cannot have the same
5353
name as any existing data type in the same schema.
5454
</para>
55+
56+
<para>
57+
To be able to create a table, you must have <literal>USAGE</literal>
58+
privilege on all column types.
59+
</para>
5560
</refsect1>
5661

5762
<refsect1>

‎doc/src/sgml/ref/create_function.sgml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,11 @@ CREATE [ OR REPLACE ] FUNCTION
9292
<para>
9393
The user that creates the function becomes the owner of the function.
9494
</para>
95+
96+
<para>
97+
To be able to create a function, you must have <literal>USAGE</literal>
98+
privilege on the argument types and the return type.
99+
</para>
95100
</refsect1>
96101

97102
<refsect1>

‎doc/src/sgml/ref/create_operator.sgml

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,13 @@ CREATE OPERATOR <replaceable>name</replaceable> (
103103
The other clauses specify optional operator optimization clauses.
104104
Their meaning is detailed in <xref linkend="xoper-optimization">.
105105
</para>
106+
107+
<para>
108+
To be able to create an operator, you must have <literal>USAGE</literal>
109+
privilege on the argument types and the return type, as well
110+
as <literal>EXECUTE</literal> privilege on the underlying function. If a
111+
commutator or negator operator is specified, you must own these operators.
112+
</para>
106113
</refsect1>
107114

108115
<refsect1>

‎doc/src/sgml/ref/create_table.sgml

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -124,6 +124,12 @@ CREATE [ [ GLOBAL | LOCAL ] { TEMPORARY | TEMP } | UNLOGGED ] TABLE [ IF NOT EXI
124124
a column constraint is only a notational convenience for use when the
125125
constraint only affects one column.
126126
</para>
127+
128+
<para>
129+
To be able to create a table, you must have <literal>USAGE</literal>
130+
privilege on all column types or the type in the <literal>OF</literal>
131+
clause, respectively.
132+
</para>
127133
</refsect1>
128134

129135
<refsect1>

‎doc/src/sgml/ref/create_type.sgml

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,6 +104,11 @@ CREATE TYPE <replaceable class="parameter">name</replaceable>
104104
A stand-alone composite type is useful, for example, as the argument or
105105
return type of a function.
106106
</para>
107+
108+
<para>
109+
To be able to create a composite type, you must
110+
have <literal>USAGE</literal> privilege on all attribute types.
111+
</para>
107112
</refsect2>
108113

109114
<refsect2 id="SQL-CREATETYPE-enum">

‎doc/src/sgml/ref/grant.sgml

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,10 @@ GRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }
4242
ON DATABASE <replaceable>database_name</replaceable> [, ...]
4343
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
4444

45+
GRANT { USAGE | ALL [ PRIVILEGES ] }
46+
ON DOMAIN <replaceable>domain_name</replaceable> [, ...]
47+
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
48+
4549
GRANT { USAGE | ALL [ PRIVILEGES ] }
4650
ON FOREIGN DATA WRAPPER <replaceable>fdw_name</replaceable> [, ...]
4751
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
@@ -71,6 +75,10 @@ GRANT { CREATE | ALL [ PRIVILEGES ] }
7175
ON TABLESPACE <replaceable>tablespace_name</replaceable> [, ...]
7276
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
7377

78+
GRANT { USAGE | ALL [ PRIVILEGES ] }
79+
ON TYPE <replaceable>type_name</replaceable> [, ...]
80+
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
81+
7482
GRANT <replaceable class="PARAMETER">role_name</replaceable> [, ...] TO <replaceable class="PARAMETER">role_name</replaceable> [, ...] [ WITH ADMIN OPTION ]
7583
</synopsis>
7684
</refsynopsisdiv>
@@ -335,6 +343,15 @@ GRANT <replaceable class="PARAMETER">role_name</replaceable> [, ...] TO <replace
335343
For sequences, this privilege allows the use of the
336344
<function>currval</function> and <function>nextval</function> functions.
337345
</para>
346+
<para>
347+
For types and domains, this privilege allow the use of the type or
348+
domain in the creation of tables, functions, and other schema objects.
349+
(Note that it does not control general <quote>usage</quote> of the type,
350+
such as values of the type appearing in queries. It only prevents
351+
objects from being created that depend on the type. The main purpose of
352+
the privilege is controlling which users create dependencies on a type,
353+
which could prevent the owner from changing the type later.)
354+
</para>
338355
<para>
339356
For foreign-data wrappers, this privilege enables the grantee
340357
to create new servers using that foreign-data wrapper.
@@ -616,7 +633,7 @@ GRANT admins TO joe;
616633
<para>
617634
The SQL standard provides for a <literal>USAGE</literal> privilege
618635
on other kinds of objects: character sets, collations,
619-
translations, domains.
636+
translations.
620637
</para>
621638

622639
<para>

‎doc/src/sgml/ref/psql-ref.sgml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1048,7 +1048,7 @@ testdb=&gt;
10481048
pattern or the <literal>S</literal> modifier to include system
10491049
objects.
10501050
If <literal>+</literal> is appended to the command name, each object
1051-
is listed with its associated description.
1051+
is listed with its associated permissions and description.
10521052
</para>
10531053
</listitem>
10541054
</varlistentry>
@@ -1387,8 +1387,8 @@ testdb=&gt;
13871387
If <replaceable class="parameter">pattern</replaceable> is
13881388
specified, only types whose names match the pattern are listed.
13891389
If <literal>+</literal> is appended to the command name, each type is
1390-
listed with its internal name and size, as well as its allowed values
1391-
if it is an <type>enum</> type.
1390+
listed with its internal name and size, its allowed values
1391+
if it is an <type>enum</> type, and its associated permissions.
13921392
By default, only user-created objects are shown; supply a
13931393
pattern or the <literal>S</literal> modifier to include system
13941394
objects.

‎doc/src/sgml/ref/revoke.sgml

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,12 @@ REVOKE [ GRANT OPTION FOR ]
5050
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
5151
[ CASCADE | RESTRICT ]
5252

53+
REVOKE [ GRANT OPTION FOR ]
54+
{ USAGE | ALL [ PRIVILEGES ] }
55+
ON DOMAIN <replaceable>domain_name</replaceable> [, ...]
56+
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
57+
[ CASCADE | RESTRICT ]
58+
5359
REVOKE [ GRANT OPTION FOR ]
5460
{ USAGE | ALL [ PRIVILEGES ] }
5561
ON FOREIGN DATA WRAPPER <replaceable>fdw_name</replaceable> [, ...]
@@ -93,6 +99,12 @@ REVOKE [ GRANT OPTION FOR ]
9399
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
94100
[ CASCADE | RESTRICT ]
95101

102+
REVOKE [ GRANT OPTION FOR ]
103+
{ USAGE | ALL [ PRIVILEGES ] }
104+
ON TYPE <replaceable>type_name</replaceable> [, ...]
105+
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
106+
[ CASCADE | RESTRICT ]
107+
96108
REVOKE [ ADMIN OPTION FOR ]
97109
<replaceable class="PARAMETER">role_name</replaceable> [, ...] FROM <replaceable class="PARAMETER">role_name</replaceable> [, ...]
98110
[ CASCADE | RESTRICT ]

‎src/backend/access/common/tupdesc.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,9 @@
2020
#include "postgres.h"
2121

2222
#include "catalog/pg_type.h"
23+
#include "miscadmin.h"
2324
#include "parser/parse_type.h"
25+
#include "utils/acl.h"
2426
#include "utils/builtins.h"
2527
#include "utils/resowner.h"
2628
#include "utils/syscache.h"
@@ -557,6 +559,7 @@ BuildDescForRelation(List *schema)
557559
foreach(l, schema)
558560
{
559561
ColumnDef *entry = lfirst(l);
562+
AclResult aclresult;
560563

561564
/*
562565
* for each entry in the list, get the name and type information from
@@ -567,6 +570,12 @@ BuildDescForRelation(List *schema)
567570

568571
attname = entry->colname;
569572
typenameTypeIdAndMod(NULL, entry->typeName, &atttypid, &atttypmod);
573+
574+
aclresult = pg_type_aclcheck(atttypid, GetUserId(), ACL_USAGE);
575+
if (aclresult != ACLCHECK_OK)
576+
aclcheck_error(aclresult, ACL_KIND_TYPE,
577+
format_type_be(atttypid));
578+
570579
attcollation = GetColumnDefCollation(NULL, entry, atttypid);
571580
attdim = list_length(entry->typeName->arrayBounds);
572581

0 commit comments

Comments
 (0)