Fix permission-checking bug reported by Tim Burgess 10-Feb-03 (this time

for sure...).  Rather than relying on the query context of a rangetable
entry to identify what permissions it wants checked, store a full AclMode
mask in each RTE, and check exactly those bits.  This allows an RTE
specifying, say, INSERT privilege on a view to be copied into a derived
UPDATE query without changing meaning.  Per recent discussion thread.
initdb forced due to change of stored rule representation.

Author: tglsfdc

src/backend/commands/view.c

@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/commands/view.c,v 1.80 2004/01/10 23:28:44 neilc Exp $
+ *	  $PostgreSQL: pgsql/src/backend/commands/view.c,v 1.81 2004/01/14 23:01:54 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -297,8 +297,8 @@ UpdateRangeTableOfViewParse(Oid viewOid, Query *viewParse)
 											  makeAlias("*NEW*", NIL),
 											  false, false);
 	/* Must override addRangeTableEntry's default access-check flags */
-	rt_entry1->checkForRead = false;
-	rt_entry2->checkForRead = false;
+	rt_entry1->requiredPerms = 0;
+	rt_entry2->requiredPerms = 0;
 
 	new_rt = lcons(rt_entry1, lcons(rt_entry2, viewParse->rtable));
 

src/backend/executor/execMain.c

@@ -26,7 +26,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/executor/execMain.c,v 1.226 2004/01/10 23:28:44 neilc Exp $
+ *	  $PostgreSQL: pgsql/src/backend/executor/execMain.c,v 1.227 2004/01/14 23:01:54 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -86,8 +86,8 @@ static void ExecUpdate(TupleTableSlot *slot, ItemPointer tupleid,
 		   EState *estate);
 static TupleTableSlot *EvalPlanQualNext(EState *estate);
 static void EndEvalPlanQual(EState *estate);
-static void ExecCheckRTEPerms(RangeTblEntry *rte, CmdType operation);
-static void ExecCheckXactReadOnly(Query *parsetree, CmdType operation);
+static void ExecCheckRTEPerms(RangeTblEntry *rte);
+static void ExecCheckXactReadOnly(Query *parsetree);
 static void EvalPlanQualStart(evalPlanQual *epq, EState *estate,
 				  evalPlanQual *priorepq);
 static void EvalPlanQualStop(evalPlanQual *epq);
@@ -136,8 +136,8 @@ ExecutorStart(QueryDesc *queryDesc, bool useCurrentSnapshot, bool explainOnly)
 	 * If the transaction is read-only, we need to check if any writes are
 	 * planned to non-temporary tables.
 	 */
-	if (!explainOnly)
-		ExecCheckXactReadOnly(queryDesc->parsetree, queryDesc->operation);
+	if (XactReadOnly && !explainOnly)
+		ExecCheckXactReadOnly(queryDesc->parsetree);
 
 	/*
 	 * Build EState, switch into per-query memory context for startup.
@@ -351,15 +351,15 @@ ExecutorRewind(QueryDesc *queryDesc)
  *		Check access permissions for all relations listed in a range table.
  */
 void
-ExecCheckRTPerms(List *rangeTable, CmdType operation)
+ExecCheckRTPerms(List *rangeTable)
 {
 	List	   *lp;
 
 	foreach(lp, rangeTable)
 	{
 		RangeTblEntry *rte = lfirst(lp);
 
-		ExecCheckRTEPerms(rte, operation);
+		ExecCheckRTEPerms(rte);
 	}
 }
 
@@ -368,18 +368,18 @@ ExecCheckRTPerms(List *rangeTable, CmdType operation)
  *		Check access permissions for a single RTE.
  */
 static void
-ExecCheckRTEPerms(RangeTblEntry *rte, CmdType operation)
+ExecCheckRTEPerms(RangeTblEntry *rte)
 {
+	AclMode		requiredPerms;
 	Oid			relOid;
 	AclId		userid;
-	AclResult	aclcheck_result;
 
 	/*
 	 * If it's a subquery, recursively examine its rangetable.
 	 */
 	if (rte->rtekind == RTE_SUBQUERY)
 	{
-		ExecCheckRTPerms(rte->subquery->rtable, operation);
+		ExecCheckRTPerms(rte->subquery->rtable);
 		return;
 	}
 
@@ -391,6 +391,13 @@ ExecCheckRTEPerms(RangeTblEntry *rte, CmdType operation)
 	if (rte->rtekind != RTE_RELATION)
 		return;
 
+	/*
+	 * No work if requiredPerms is empty.
+	 */
+	requiredPerms = rte->requiredPerms;
+	if (requiredPerms == 0)
+		return;
+
 	relOid = rte->relid;
 
 	/*
@@ -404,77 +411,68 @@ ExecCheckRTEPerms(RangeTblEntry *rte, CmdType operation)
 	 */
 	userid = rte->checkAsUser ? rte->checkAsUser : GetUserId();
 
-#define CHECK(MODE)		pg_class_aclcheck(relOid, userid, MODE)
+	/*
+	 * For each bit in requiredPerms, apply the required check.  (We can't
+	 * do this in one aclcheck call because aclcheck treats multiple bits
+	 * as OR semantics, when we want AND.)
+	 *
+	 * We use a well-known cute trick for isolating the rightmost one-bit
+	 * in a nonzero word.  See nodes/bitmapset.c for commentary.
+	 */
+#define RIGHTMOST_ONE(x) ((int32) (x) & -((int32) (x)))
 
-	if (rte->checkForRead)
+	while (requiredPerms != 0)
 	{
-		aclcheck_result = CHECK(ACL_SELECT);
-		if (aclcheck_result != ACLCHECK_OK)
-			aclcheck_error(aclcheck_result, ACL_KIND_CLASS,
-						   get_rel_name(relOid));
-	}
+		AclMode		thisPerm;
+		AclResult	aclcheck_result;
 
-	if (rte->checkForWrite)
-	{
-		/*
-		 * Note: write access in a SELECT context means SELECT FOR UPDATE.
-		 * Right now we don't distinguish that from true update as far as
-		 * permissions checks are concerned.
-		 */
-		switch (operation)
-		{
-			case CMD_INSERT:
-				aclcheck_result = CHECK(ACL_INSERT);
-				break;
-			case CMD_SELECT:
-			case CMD_UPDATE:
-				aclcheck_result = CHECK(ACL_UPDATE);
-				break;
-			case CMD_DELETE:
-				aclcheck_result = CHECK(ACL_DELETE);
-				break;
-			default:
-				elog(ERROR, "unrecognized operation code: %d",
-					 (int) operation);
-				aclcheck_result = ACLCHECK_OK;	/* keep compiler quiet */
-				break;
-		}
+		thisPerm = RIGHTMOST_ONE(requiredPerms);
+		requiredPerms &= ~thisPerm;
+
+		aclcheck_result = pg_class_aclcheck(relOid, userid, thisPerm);
 		if (aclcheck_result != ACLCHECK_OK)
 			aclcheck_error(aclcheck_result, ACL_KIND_CLASS,
 						   get_rel_name(relOid));
 	}
 }
 
+/*
+ * Check that the query does not imply any writes to non-temp tables.
+ */
 static void
-ExecCheckXactReadOnly(Query *parsetree, CmdType operation)
+ExecCheckXactReadOnly(Query *parsetree)
 {
-	if (!XactReadOnly)
-		return;
+	List	   *lp;
 
-	/* CREATE TABLE AS or SELECT INTO */
-	if (operation == CMD_SELECT && parsetree->into != NULL)
+	/*
+	 * CREATE TABLE AS or SELECT INTO?
+	 *
+	 * XXX should we allow this if the destination is temp?
+	 */
+	if (parsetree->into != NULL)
 		goto fail;
 
-	if (operation == CMD_DELETE || operation == CMD_INSERT
-		|| operation == CMD_UPDATE)
+	/* Fail if write permissions are requested on any non-temp table */
+	foreach(lp, parsetree->rtable)
 	{
-		List	   *lp;
+		RangeTblEntry *rte = lfirst(lp);
 
-		foreach(lp, parsetree->rtable)
+		if (rte->rtekind == RTE_SUBQUERY)
 		{
-			RangeTblEntry *rte = lfirst(lp);
+			ExecCheckXactReadOnly(rte->subquery);
+			continue;
+		}
 
-			if (rte->rtekind != RTE_RELATION)
-				continue;
+		if (rte->rtekind != RTE_RELATION)
+			continue;
 
-			if (!rte->checkForWrite)
-				continue;
+		if ((rte->requiredPerms & (~ACL_SELECT)) == 0)
+			continue;
 
-			if (isTempNamespace(get_rel_namespace(rte->relid)))
-				continue;
+		if (isTempNamespace(get_rel_namespace(rte->relid)))
+			continue;
 
-			goto fail;
-		}
+		goto fail;
 	}
 
 	return;
@@ -511,7 +509,7 @@ InitPlan(QueryDesc *queryDesc, bool explainOnly)
 	 * rangetable here --- subplan RTEs will be checked during
 	 * ExecInitSubPlan().
 	 */
-	ExecCheckRTPerms(parseTree->rtable, operation);
+	ExecCheckRTPerms(parseTree->rtable);
 
 	/*
 	 * get information from query descriptor

src/backend/executor/nodeSubplan.c

@@ -7,7 +7,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/executor/nodeSubplan.c,v 1.59 2003/11/29 19:51:48 pgsql Exp $
+ *	  $PostgreSQL: pgsql/src/backend/executor/nodeSubplan.c,v 1.60 2004/01/14 23:01:54 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -670,10 +670,9 @@ ExecInitSubPlan(SubPlanState *node, EState *estate)
 	MemoryContext oldcontext;
 
 	/*
-	 * Do access checking on the rangetable entries in the subquery. Here,
-	 * we assume the subquery is a SELECT.
+	 * Do access checking on the rangetable entries in the subquery.
 	 */
-	ExecCheckRTPerms(subplan->rtable, CMD_SELECT);
+	ExecCheckRTPerms(subplan->rtable);
 
 	/*
 	 * initialize my state

src/backend/nodes/copyfuncs.c

@@ -15,7 +15,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/nodes/copyfuncs.c,v 1.276 2004/01/10 23:28:44 neilc Exp $
+ *	  $PostgreSQL: pgsql/src/backend/nodes/copyfuncs.c,v 1.277 2004/01/14 23:01:54 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -1258,8 +1258,7 @@ _copyRangeTblEntry(RangeTblEntry *from)
 	COPY_NODE_FIELD(eref);
 	COPY_SCALAR_FIELD(inh);
 	COPY_SCALAR_FIELD(inFromCl);
-	COPY_SCALAR_FIELD(checkForRead);
-	COPY_SCALAR_FIELD(checkForWrite);
+	COPY_SCALAR_FIELD(requiredPerms);
 	COPY_SCALAR_FIELD(checkAsUser);
 
 	return newnode;

src/backend/nodes/equalfuncs.c

@@ -18,7 +18,7 @@
  * Portions Copyright (c) 1994, Regents of the University of California
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/nodes/equalfuncs.c,v 1.214 2004/01/10 23:28:45 neilc Exp $
+ *	  $PostgreSQL: pgsql/src/backend/nodes/equalfuncs.c,v 1.215 2004/01/14 23:01:55 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -1574,8 +1574,7 @@ _equalRangeTblEntry(RangeTblEntry *a, RangeTblEntry *b)
 	COMPARE_NODE_FIELD(eref);
 	COMPARE_SCALAR_FIELD(inh);
 	COMPARE_SCALAR_FIELD(inFromCl);
-	COMPARE_SCALAR_FIELD(checkForRead);
-	COMPARE_SCALAR_FIELD(checkForWrite);
+	COMPARE_SCALAR_FIELD(requiredPerms);
 	COMPARE_SCALAR_FIELD(checkAsUser);
 
 	return true;

src/backend/nodes/outfuncs.c

@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/nodes/outfuncs.c,v 1.229 2004/01/06 04:31:01 tgl Exp $
+ *	  $PostgreSQL: pgsql/src/backend/nodes/outfuncs.c,v 1.230 2004/01/14 23:01:55 tgl Exp $
  *
  * NOTES
  *	  Every node type that can appear in stored rules' parsetrees *must*
@@ -1358,9 +1358,8 @@ _outRangeTblEntry(StringInfo str, RangeTblEntry *node)
 
 	WRITE_BOOL_FIELD(inh);
 	WRITE_BOOL_FIELD(inFromCl);
-	WRITE_BOOL_FIELD(checkForRead);
-	WRITE_BOOL_FIELD(checkForWrite);
-	WRITE_OID_FIELD(checkAsUser);
+	WRITE_UINT_FIELD(requiredPerms);
+	WRITE_UINT_FIELD(checkAsUser);
 }
 
 static void

src/backend/nodes/readfuncs.c

@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/nodes/readfuncs.c,v 1.164 2004/01/07 18:56:26 neilc Exp $
+ *	  $PostgreSQL: pgsql/src/backend/nodes/readfuncs.c,v 1.165 2004/01/14 23:01:55 tgl Exp $
  *
  * NOTES
  *	  Path and Plan nodes do not have any readfuncs support, because we
@@ -939,9 +939,8 @@ _readRangeTblEntry(void)
 
 	READ_BOOL_FIELD(inh);
 	READ_BOOL_FIELD(inFromCl);
-	READ_BOOL_FIELD(checkForRead);
-	READ_BOOL_FIELD(checkForWrite);
-	READ_OID_FIELD(checkAsUser);
+	READ_UINT_FIELD(requiredPerms);
+	READ_UINT_FIELD(checkAsUser);
 
 	READ_DONE();
 }

src/backend/optimizer/path/allpaths.c

@@ -8,7 +8,7 @@
  *
  *
  * IDENTIFICATION
- *	  $PostgreSQL: pgsql/src/backend/optimizer/path/allpaths.c,v 1.111 2004/01/05 05:07:35 tgl Exp $
+ *	  $PostgreSQL: pgsql/src/backend/optimizer/path/allpaths.c,v 1.112 2004/01/14 23:01:55 tgl Exp $
  *
  *-------------------------------------------------------------------------
  */
@@ -227,8 +227,7 @@ set_inherited_rel_pathlist(Query *root, RelOptInfo *rel,
 	 * it examines the parent's inheritlist entry.  There's no need to
 	 * check twice, so turn off access check bits in the original RTE.
 	 */
-	rte->checkForRead = false;
-	rte->checkForWrite = false;
+	rte->requiredPerms = 0;
 
 	/*
 	 * Initialize to compute size estimates for whole inheritance tree