Skip to content

Commit bb8582a

Browse files
peterepetere
committed
Remove rolcatupdate
This role attribute is an ancient PostgreSQL feature, but could only be set by directly updating the system catalogs, and it doesn't have any clearly defined use. Author: Adam Brightwell <adam.brightwell@crunchydatasolutions.com>
1 parent 6510c83 commit bb8582a

File tree

8 files changed

+17
-90
lines changed

8 files changed

+17
-90
lines changed

‎doc/src/sgml/catalogs.sgml

Lines changed: 0 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1415,15 +1415,6 @@
14151415
<entry>Role can create databases</entry>
14161416
</row>
14171417

1418-
<row>
1419-
<entry><structfield>rolcatupdate</structfield></entry>
1420-
<entry><type>bool</type></entry>
1421-
<entry>
1422-
Role can update system catalogs directly. (Even a superuser cannot do
1423-
this unless this column is true)
1424-
</entry>
1425-
</row>
1426-
14271418
<row>
14281419
<entry><structfield>rolcanlogin</structfield></entry>
14291420
<entry><type>bool</type></entry>
@@ -8491,16 +8482,6 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
84918482
<entry>Role can create databases</entry>
84928483
</row>
84938484

8494-
<row>
8495-
<entry><structfield>rolcatupdate</structfield></entry>
8496-
<entry><type>bool</type></entry>
8497-
<entry></entry>
8498-
<entry>
8499-
Role can update system catalogs directly. (Even a superuser cannot do
8500-
this unless this column is true)
8501-
</entry>
8502-
</row>
8503-
85048485
<row>
85058486
<entry><structfield>rolcanlogin</structfield></entry>
85068487
<entry><type>bool</type></entry>
@@ -9019,16 +9000,6 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
90199000
<entry>User is a superuser</entry>
90209001
</row>
90219002

9022-
<row>
9023-
<entry><structfield>usecatupd</structfield></entry>
9024-
<entry><type>bool</type></entry>
9025-
<entry></entry>
9026-
<entry>
9027-
User can update system catalogs. (Even a superuser cannot do
9028-
this unless this column is true.)
9029-
</entry>
9030-
</row>
9031-
90329003
<row>
90339004
<entry><structfield>userepl</structfield></entry>
90349005
<entry><type>bool</type></entry>
@@ -9506,15 +9477,6 @@ SELECT * FROM pg_locks pl LEFT JOIN pg_prepared_xacts ppx
95069477
<entry>User is a superuser</entry>
95079478
</row>
95089479

9509-
<row>
9510-
<entry><structfield>usecatupd</structfield></entry>
9511-
<entry><type>bool</type></entry>
9512-
<entry>
9513-
User can update system catalogs. (Even a superuser cannot do
9514-
this unless this column is true.)
9515-
</entry>
9516-
</row>
9517-
95189480
<row>
95199481
<entry><structfield>userepl</structfield></entry>
95209482
<entry><type>bool</type></entry>

‎src/backend/catalog/aclchk.c

Lines changed: 2 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -3423,26 +3423,6 @@ aclcheck_error_type(AclResult aclerr, Oid typeOid)
34233423
}
34243424

34253425

3426-
/* Check if given user has rolcatupdate privilege according to pg_authid */
3427-
static bool
3428-
has_rolcatupdate(Oid roleid)
3429-
{
3430-
bool rolcatupdate;
3431-
HeapTuple tuple;
3432-
3433-
tuple = SearchSysCache1(AUTHOID, ObjectIdGetDatum(roleid));
3434-
if (!HeapTupleIsValid(tuple))
3435-
ereport(ERROR,
3436-
(errcode(ERRCODE_UNDEFINED_OBJECT),
3437-
errmsg("role with OID %u does not exist", roleid)));
3438-
3439-
rolcatupdate = ((Form_pg_authid) GETSTRUCT(tuple))->rolcatupdate;
3440-
3441-
ReleaseSysCache(tuple);
3442-
3443-
return rolcatupdate;
3444-
}
3445-
34463426
/*
34473427
* Relay for the various pg_*_mask routines depending on object kind
34483428
*/
@@ -3620,8 +3600,7 @@ pg_class_aclmask(Oid table_oid, Oid roleid,
36203600

36213601
/*
36223602
* Deny anyone permission to update a system catalog unless
3623-
* pg_authid.rolcatupdate is set. (This is to let superusers protect
3624-
* themselves from themselves.) Also allow it if allowSystemTableMods.
3603+
* pg_authid.rolsuper is set. Also allow it if allowSystemTableMods.
36253604
*
36263605
* As of 7.4 we have some updatable system views; those shouldn't be
36273606
* protected in this way. Assume the view rules can take care of
@@ -3630,7 +3609,7 @@ pg_class_aclmask(Oid table_oid, Oid roleid,
36303609
if ((mask & (ACL_INSERT | ACL_UPDATE | ACL_DELETE | ACL_TRUNCATE | ACL_USAGE)) &&
36313610
IsSystemClass(table_oid, classForm) &&
36323611
classForm->relkind != RELKIND_VIEW &&
3633-
!has_rolcatupdate(roleid) &&
3612+
!superuser_arg(roleid) &&
36343613
!allowSystemTableMods)
36353614
{
36363615
#ifdef ACLDEBUG

‎src/backend/catalog/system_views.sql

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ CREATE VIEW pg_roles AS
1313
rolinherit,
1414
rolcreaterole,
1515
rolcreatedb,
16-
rolcatupdate,
1716
rolcanlogin,
1817
rolreplication,
1918
rolconnlimit,
@@ -31,7 +30,6 @@ CREATE VIEW pg_shadow AS
3130
pg_authid.oid AS usesysid,
3231
rolcreatedb AS usecreatedb,
3332
rolsuper AS usesuper,
34-
rolcatupdate AS usecatupd,
3533
rolreplication AS userepl,
3634
rolbypassrls AS usebypassrls,
3735
rolpassword AS passwd,
@@ -57,7 +55,6 @@ CREATE VIEW pg_user AS
5755
usesysid,
5856
usecreatedb,
5957
usesuper,
60-
usecatupd,
6158
userepl,
6259
usebypassrls,
6360
'********'::text as passwd,

‎src/backend/commands/user.c

Lines changed: 1 addition & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -368,8 +368,6 @@ CreateRole(CreateRoleStmt *stmt)
368368
new_record[Anum_pg_authid_rolinherit - 1] = BoolGetDatum(inherit);
369369
new_record[Anum_pg_authid_rolcreaterole - 1] = BoolGetDatum(createrole);
370370
new_record[Anum_pg_authid_rolcreatedb - 1] = BoolGetDatum(createdb);
371-
/* superuser gets catupdate right by default */
372-
new_record[Anum_pg_authid_rolcatupdate - 1] = BoolGetDatum(issuper);
373371
new_record[Anum_pg_authid_rolcanlogin - 1] = BoolGetDatum(canlogin);
374372
new_record[Anum_pg_authid_rolreplication - 1] = BoolGetDatum(isreplication);
375373
new_record[Anum_pg_authid_rolconnlimit - 1] = Int32GetDatum(connlimit);
@@ -734,20 +732,12 @@ AlterRole(AlterRoleStmt *stmt)
734732
MemSet(new_record_repl, false, sizeof(new_record_repl));
735733

736734
/*
737-
* issuper/createrole/catupdate/etc
738-
*
739-
* XXX It's rather unclear how to handle catupdate. It's probably best to
740-
* keep it equal to the superuser status, otherwise you could end up with
741-
* a situation where no existing superuser can alter the catalogs,
742-
* including pg_authid!
735+
* issuper/createrole/etc
743736
*/
744737
if (issuper >= 0)
745738
{
746739
new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(issuper > 0);
747740
new_record_repl[Anum_pg_authid_rolsuper - 1] = true;
748-
749-
new_record[Anum_pg_authid_rolcatupdate - 1] = BoolGetDatum(issuper > 0);
750-
new_record_repl[Anum_pg_authid_rolcatupdate - 1] = true;
751741
}
752742

753743
if (inherit >= 0)

‎src/include/catalog/catversion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/* yyyymmddN */
56-
#define CATALOG_VERSION_NO 201503031
56+
#define CATALOG_VERSION_NO 201503061
5757

5858
#endif

‎src/include/catalog/pg_authid.h

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,6 @@ CATALOG(pg_authid,1260) BKI_SHARED_RELATION BKI_ROWTYPE_OID(2842) BKI_SCHEMA_MAC
4949
bool rolinherit; /* inherit privileges from other roles? */
5050
bool rolcreaterole; /* allowed to create more roles? */
5151
bool rolcreatedb; /* allowed to create databases? */
52-
bool rolcatupdate; /* allowed to alter catalogs manually? */
5352
bool rolcanlogin; /* allowed to log in as session user? */
5453
bool rolreplication; /* role used for streaming replication */
5554
bool rolbypassrls; /* allowed to bypass row level security? */
@@ -76,19 +75,18 @@ typedef FormData_pg_authid *Form_pg_authid;
7675
* compiler constants for pg_authid
7776
* ----------------
7877
*/
79-
#define Natts_pg_authid 12
78+
#define Natts_pg_authid 11
8079
#define Anum_pg_authid_rolname 1
8180
#define Anum_pg_authid_rolsuper 2
8281
#define Anum_pg_authid_rolinherit 3
8382
#define Anum_pg_authid_rolcreaterole 4
8483
#define Anum_pg_authid_rolcreatedb 5
85-
#define Anum_pg_authid_rolcatupdate 6
86-
#define Anum_pg_authid_rolcanlogin 7
87-
#define Anum_pg_authid_rolreplication 8
88-
#define Anum_pg_authid_rolbypassrls 9
89-
#define Anum_pg_authid_rolconnlimit 10
90-
#define Anum_pg_authid_rolpassword 11
91-
#define Anum_pg_authid_rolvaliduntil 12
84+
#define Anum_pg_authid_rolcanlogin 6
85+
#define Anum_pg_authid_rolreplication 7
86+
#define Anum_pg_authid_rolbypassrls 8
87+
#define Anum_pg_authid_rolconnlimit 9
88+
#define Anum_pg_authid_rolpassword 10
89+
#define Anum_pg_authid_rolvaliduntil 11
9290

9391
/* ----------------
9492
* initial contents of pg_authid
@@ -97,7 +95,7 @@ typedef FormData_pg_authid *Form_pg_authid;
9795
* user choices.
9896
* ----------------
9997
*/
100-
DATA(insert OID = 10 ( "POSTGRES" t t t t t t t t -1 _null_ _null_));
98+
DATA(insert OID = 10 ( "POSTGRES" t t t t t t t -1 _null_ _null_));
10199

102100
#define BOOTSTRAP_SUPERUSERID 10
103101

‎src/test/regress/expected/privileges.out

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -676,7 +676,11 @@ ERROR: role "nosuchuser" does not exist
676676
select has_table_privilege('pg_authid','sel');
677677
ERROR: unrecognized privilege type: "sel"
678678
select has_table_privilege(-999999,'pg_authid','update');
679-
ERROR: role with OID 4293967297 does not exist
679+
has_table_privilege
680+
---------------------
681+
f
682+
(1 row)
683+
680684
select has_table_privilege(1,'select');
681685
has_table_privilege
682686
---------------------

‎src/test/regress/expected/rules.out

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1406,7 +1406,6 @@ pg_roles| SELECT pg_authid.rolname,
14061406
pg_authid.rolinherit,
14071407
pg_authid.rolcreaterole,
14081408
pg_authid.rolcreatedb,
1409-
pg_authid.rolcatupdate,
14101409
pg_authid.rolcanlogin,
14111410
pg_authid.rolreplication,
14121411
pg_authid.rolconnlimit,
@@ -1607,7 +1606,6 @@ pg_shadow| SELECT pg_authid.rolname AS usename,
16071606
pg_authid.oid AS usesysid,
16081607
pg_authid.rolcreatedb AS usecreatedb,
16091608
pg_authid.rolsuper AS usesuper,
1610-
pg_authid.rolcatupdate AS usecatupd,
16111609
pg_authid.rolreplication AS userepl,
16121610
pg_authid.rolbypassrls AS usebypassrls,
16131611
pg_authid.rolpassword AS passwd,
@@ -2062,7 +2060,6 @@ pg_user| SELECT pg_shadow.usename,
20622060
pg_shadow.usesysid,
20632061
pg_shadow.usecreatedb,
20642062
pg_shadow.usesuper,
2065-
pg_shadow.usecatupd,
20662063
pg_shadow.userepl,
20672064
pg_shadow.usebypassrls,
20682065
'********'::text AS passwd,

0 commit comments

Comments
 (0)