Skip to content

Commit c9c41c7

Browse files
sfrostsfrost
committed
Rename Default Roles to Predefined Roles
The term 'default roles' wasn't quite apt as these roles aren't able to be modified or removed after installation, so rename them to be 'Predefined Roles' instead, adding an entry into the newly added Obsolete Appendix to help users of current releases find the new documentation. Bruce Momjian and Stephen Frost Discussion: https://postgr.es/m/157742545062.1149.11052653770497832538%40wrigleys.postgresql.org and https://www.postgresql.org/message-id/20201120211304.GG16415@tamriel.snowman.net
1 parent a68a894 commit c9c41c7

File tree

23 files changed

+82
-52
lines changed

23 files changed

+82
-52
lines changed

‎contrib/adminpack/adminpack.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,10 +79,13 @@ convert_and_check_filename(text *arg)
7979
* files on the server as the PG user, so no need to do any further checks
8080
* here.
8181
*/
82-
if (is_member_of_role(GetUserId(), DEFAULT_ROLE_WRITE_SERVER_FILES))
82+
if (is_member_of_role(GetUserId(), ROLE_PG_WRITE_SERVER_FILES))
8383
return filename;
8484

85-
/* User isn't a member of the default role, so check if it's allowable */
85+
/*
86+
* User isn't a member of the pg_write_server_files role, so check if it's
87+
* allowable
88+
*/
8689
if (is_absolute_path(filename))
8790
{
8891
/* Disallow '/a/b/data/..' */

‎contrib/file_fdw/file_fdw.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -269,13 +269,13 @@ file_fdw_validator(PG_FUNCTION_ARGS)
269269
* otherwise there'd still be a security hole.
270270
*/
271271
if (strcmp(def->defname, "filename") == 0 &&
272-
!is_member_of_role(GetUserId(), DEFAULT_ROLE_READ_SERVER_FILES))
272+
!is_member_of_role(GetUserId(), ROLE_PG_READ_SERVER_FILES))
273273
ereport(ERROR,
274274
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
275275
errmsg("only superuser or a member of the pg_read_server_files role may specify the filename option of a file_fdw foreign table")));
276276

277277
if (strcmp(def->defname, "program") == 0 &&
278-
!is_member_of_role(GetUserId(), DEFAULT_ROLE_EXECUTE_SERVER_PROGRAM))
278+
!is_member_of_role(GetUserId(), ROLE_PG_EXECUTE_SERVER_PROGRAM))
279279
ereport(ERROR,
280280
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
281281
errmsg("only superuser or a member of the pg_execute_server_program role may specify the program option of a file_fdw foreign table")));

‎contrib/pg_stat_statements/pg_stat_statements.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1587,7 +1587,7 @@ pg_stat_statements_internal(FunctionCallInfo fcinfo,
15871587
pgssEntry *entry;
15881588

15891589
/* Superusers or members of pg_read_all_stats members are allowed */
1590-
is_allowed_role = is_member_of_role(GetUserId(), DEFAULT_ROLE_READ_ALL_STATS);
1590+
is_allowed_role = is_member_of_role(GetUserId(), ROLE_PG_READ_ALL_STATS);
15911591

15921592
/* hash table must exist already */
15931593
if (!pgss || !pgss_hash)

‎contrib/pgrowlocks/pgrowlocks.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,7 +130,7 @@ pgrowlocks(PG_FUNCTION_ARGS)
130130
aclresult = pg_class_aclcheck(RelationGetRelid(rel), GetUserId(),
131131
ACL_SELECT);
132132
if (aclresult != ACLCHECK_OK)
133-
aclresult = is_member_of_role(GetUserId(), DEFAULT_ROLE_STAT_SCAN_TABLES) ? ACLCHECK_OK : ACLCHECK_NO_PRIV;
133+
aclresult = is_member_of_role(GetUserId(), ROLE_PG_STAT_SCAN_TABLES) ? ACLCHECK_OK : ACLCHECK_NO_PRIV;
134134

135135
if (aclresult != ACLCHECK_OK)
136136
aclcheck_error(aclresult, get_relkind_objtype(rel->rd_rel->relkind),

‎doc/src/sgml/appendix-obsolete-default-roles.sgml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<!-- doc/src/sgml/obsolete-default-roles.sgml -->
2+
<!--
3+
See doc/src/sgml/obsolete.sgml for why this file exists. Do not change the id attribute.
4+
-->
5+
6+
<sect1 id="default-roles" xreflabel="default-roles">
7+
<title>Default Roles renamed to Predefined Roles</title>
8+
9+
<indexterm>
10+
<primary>default-roles</primary>
11+
</indexterm>
12+
13+
<para>
14+
PostgreSQL 13 and below used the term 'Default Roles', however, as these
15+
roles are not able to actually be changed and are installed as part of the
16+
system at initialization time, the more appropriate term to use is "Predefined Roles".
17+
See <xref linkend="predefined-roles"/> for current documentation regarding
18+
Predefined Roles, and <link linkend="release-prior">the release notes for
19+
PostgreSQL 14</link> for details on this change.
20+
</para>
21+
22+
</sect1>

‎doc/src/sgml/appendix-obsolete.sgml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
-->
3535

3636
&obsolete-recovery-config;
37+
&obsolete-default-roles;
3738
&obsolete-pgxlogdump;
3839
&obsolete-pgresetxlog;
3940
&obsolete-pgreceivexlog;

‎doc/src/sgml/file-fdw.sgml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -187,8 +187,8 @@
187187

188188
<para>
189189
Changing table-level options requires being a superuser or having the privileges
190-
of the default role <literal>pg_read_server_files</literal> (to use a filename) or
191-
the default role <literal>pg_execute_server_program</literal> (to use a program),
190+
of the role <literal>pg_read_server_files</literal> (to use a filename) or
191+
the role <literal>pg_execute_server_program</literal> (to use a program),
192192
for security reasons: only certain users should be able to control which file is
193193
read or which program is run. In principle regular users could be allowed to
194194
change the other options, but that's not supported at present.

‎doc/src/sgml/filelist.sgml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -188,6 +188,7 @@
188188
<!-- Stubs for removed entries to preserve public links -->
189189
<!ENTITY obsolete SYSTEM "appendix-obsolete.sgml">
190190
<!ENTITY obsolete-recovery-config SYSTEM "appendix-obsolete-recovery-config.sgml">
191+
<!ENTITY obsolete-default-roles SYSTEM "appendix-obsolete-default-roles.sgml">
191192
<!ENTITY obsolete-pgxlogdump SYSTEM "appendix-obsolete-pgxlogdump.sgml">
192193
<!ENTITY obsolete-pgresetxlog SYSTEM "appendix-obsolete-pgresetxlog.sgml">
193194
<!ENTITY obsolete-pgreceivexlog SYSTEM "appendix-obsolete-pgreceivexlog.sgml">

‎doc/src/sgml/monitoring.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,7 @@ postgres 27093 0.0 0.0 30096 2752 ? Ss 11:34 0:00 postgres: ser
282282
existence of a session and its general properties such as its sessions user
283283
and database are visible to all users. Superusers and members of the
284284
built-in role <literal>pg_read_all_stats</literal> (see also <xref
285-
linkend="default-roles"/>) can see all the information about all sessions.
285+
linkend="predefined-roles"/>) can see all the information about all sessions.
286286
</para>
287287

288288
<table id="monitoring-stats-dynamic-views-table">

‎doc/src/sgml/ref/copy.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -465,7 +465,7 @@ COPY <replaceable class="parameter">count</replaceable>
465465
by the server, not by the client application, must be executable by the
466466
<productname>PostgreSQL</productname> user.
467467
<command>COPY</command> naming a file or command is only allowed to
468-
database superusers or users who are granted one of the default roles
468+
database superusers or users who are granted one of the roles
469469
<literal>pg_read_server_files</literal>,
470470
<literal>pg_write_server_files</literal>,
471471
or <literal>pg_execute_server_program</literal>, since it allows reading

0 commit comments

Comments
 (0)