The attached patch fixes a bug in sepgsql module.
Could you apply both v9.2 and master branch?
When post_create hook is invoked, sepgsql's handler checks
whether the current invocation context needs to have permission
checks according to the command-tag saved on ProcessUtility_hook.
But it overlooked T_CreateTableAs tag, thus, neither of security
label nor permission checks were applied, as if the routine did
on toast relation.
This patch adds this command tag as a context to check permissions.
Thanks,
--
KaiGai Kohei <kaigai@kaigai.gr.jp>