Re: [PATCH] Largeobject access controls
От | KaiGai Kohei |
---|---|
Тема | Re: [PATCH] Largeobject access controls |
Дата | |
Msg-id | 4ABB02F4.2060601@ak.jp.nec.com обсуждение исходный текст |
Ответ на | Re: [PATCH] Largeobject access controls (KaiGai Kohei <kaigai@ak.jp.nec.com>) |
Ответы |
Re: [PATCH] Largeobject access controls
(Jaime Casanova <jcasanov@systemguards.com.ec>)
|
Список | pgsql-hackers |
> Now, I'm revising the patch as follows: > - pg_largeobject_meta is renamed to pg_largeobject_metadata > - The GUC of largeobject_compat_dac is renamed to largeobject_compat_acl > - psql supports \dl to show owner of the largeobject > - add documentation for the GUC, and add it to the postgresql.conf.sample Here is the revised patch. The \dl command in psql is enhanced as follows: postgres=# \dl Large objects ID | Owner | Description -------+--------+--------------------- 16448 | kaigai | 16449 | kaigai | test large object 1 16450 | ymj | 16451 | ymj | 16452 | ymj | test large object 2 16453 | tak | 16454 | tak | (7 rows) The functionality of largeobject_compat_acl (which was named as largeobject_compat_dac at the previous patch) is changed a bit. Its default is 'off'. When it is turned on, access control features on largeobjects performs with the compatible mode. It also checks access permissions on largeobjects, but its results are ignored with notification messages to inform access violation. It means the v8.5.x provides access control on largeobjects in default, although it also provides compatible mode. However, it should be informed to users their SQL to be revised. Example) postgres=# SET SESSION AUTHORIZATION ymj; SET postgres=> SELECT loread(lo_open(16453, x'40000'::int), 20); ERROR: permission denied for largeobject 16453 postgres=# SET largeobject_compat_acl = on; <---- enables compatible mode SET (Only superuser can set it) postgres=# SET SESSION AUTHORIZATION ymj; SET postgres=> SELECT loread(lo_open(16453, x'40000'::int), 20); NOTICE: permission denied for largeobject 16453 <---- dose not prevent it loread -------------------------------------------- \x255044462d312e350d0a25b5b5b5b50d0a312030 (1 row) Thanks, $ diffstat sepgsql-02-blob-8.5devel-r2327.patch.gz doc/src/sgml/config.sgml | 25 + doc/src/sgml/ref/allfiles.sgml | 1 doc/src/sgml/ref/alter_large_object.sgml | 75 +++++ doc/src/sgml/ref/grant.sgml | 8 doc/src/sgml/ref/revoke.sgml | 6 doc/src/sgml/reference.sgml | 1 src/backend/catalog/Makefile | 6 src/backend/catalog/aclchk.c | 249 ++++++++++++++++++ src/backend/catalog/dependency.c | 14 + src/backend/catalog/pg_largeobject.c | 354 ++++++-!!!!!!!!!!!!!!!!! src/backend/catalog/pg_shdepend.c | 8 src/backend/commands/alter.c | 5 src/backend/commands/comment.c | 11 src/backend/commands/tablecmds.c | 1 src/backend/libpq/be-fsstubs.c | 49 +-- src/backend/parser/gram.y | 20 + src/backend/storage/large_object/inv_api.c | 115 ++---!!! src/backend/tcop/utility.c | 3 src/backend/utils/adt/acl.c | 5 src/backend/utils/cache/syscache.c | 13 src/backend/utils/misc/guc.c | 10 src/backend/utils/misc/postgresql.conf.sample | 1 src/bin/psql/large_obj.c | 10 src/include/catalog/dependency.h | 1 src/include/catalog/indexing.h | 3 src/include/catalog/pg_largeobject_metadata.h | 67 ++++ src/include/nodes/parsenodes.h | 1 src/include/utils/acl.h | 6 src/include/utils/syscache.h | 1 src/test/regress/expected/privileges.out | 204 ++++++++++++++ src/test/regress/expected/sanity_check.out | 3 src/test/regress/sql/privileges.sql | 83 ++++++ 32 files changed, 966 insertions(+), 73 deletions(-), 320 modifications(!) -- OSS Platform Development Division, NEC KaiGai Kohei <kaigai@ak.jp.nec.com>
Вложения
В списке pgsql-hackers по дате отправления: