Integrate superuser check into has_rolreplication()

petere · petere · commit 442f8700656b · 2023-03-16T15:43:33.000+01:00
This makes it consistent with similar functions like has_createrole_privilege() and allows removing some explicit superuser checks. Author: Nathan Bossart <nathandbossart@gmail.com> Discussion: https://www.postgresql.org/message-id/20230310000313.GA3992372%40nathanxps13
diff --git a/src/backend/replication/slot.c b/src/backend/replication/slot.c
@@ -1140,7 +1140,7 @@ CheckSlotRequirements(void)
 void
 CheckSlotPermissions(void)
 {
-	if (!superuser() && !has_rolreplication(GetUserId()))
+	if (!has_rolreplication(GetUserId()))
 		ereport(ERROR,
 				(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
 				 errmsg("must be superuser or replication role to use replication slots")));
diff --git a/src/backend/utils/init/miscinit.c b/src/backend/utils/init/miscinit.c
@@ -709,6 +709,10 @@ has_rolreplication(Oid roleid)
 	bool		result = false;
 	HeapTuple	utup;
 
+	/* Superusers bypass all permission checking. */
+	if (superuser_arg(roleid))
+		return true;
+
 	utup = SearchSysCache1(AUTHOID, ObjectIdGetDatum(roleid));
 	if (HeapTupleIsValid(utup))
 	{
diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c
@@ -962,7 +962,7 @@ InitPostgres(const char *in_dbname, Oid dboid,
 	{
 		Assert(!bootstrap);
 
-		if (!superuser() && !has_rolreplication(GetUserId()))
+		if (!has_rolreplication(GetUserId()))
 			ereport(FATAL,
 					(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
 					 errmsg("must be superuser or replication role to start walsender")));

Original file line number	Diff line number	Diff line change
`@@ -1140,7 +1140,7 @@ CheckSlotRequirements(void)`
`1140`	`1140`	`void`
`1141`	`1141`	`CheckSlotPermissions(void)`
`1142`	`1142`	`{`
`1143`		`- if (!superuser() && !has_rolreplication(GetUserId()))`
	`1143`	`+ if (!has_rolreplication(GetUserId()))`
`1144`	`1144`	`ereport(ERROR,`
`1145`	`1145`	`(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),`
`1146`	`1146`	`errmsg("must be superuser or replication role to use replication slots")));`
Original file line number	Diff line number	Diff line change
`@@ -962,7 +962,7 @@ InitPostgres(const char *in_dbname, Oid dboid,`
`962`	`962`	`{`
`963`	`963`	`Assert(!bootstrap);`
`964`	`964`
`965`		`- if (!superuser() && !has_rolreplication(GetUserId()))`
	`965`	`+ if (!has_rolreplication(GetUserId()))`
`966`	`966`	`ereport(FATAL,`
`967`	`967`	`(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),`
`968`	`968`	`errmsg("must be superuser or replication role to start walsender")));`