Skip to content

Commit de01777

Browse files
MasaoFujiiMasaoFujii
committed
Make inherited TRUNCATE perform access permission checks on parent table only.
Previously, TRUNCATE command through a parent table checked the permissions on not only the parent table but also the children tables inherited from it. This was a bug and inherited queries should perform access permission checks on the parent table only. This commit fixes that bug. Back-patch to all supported branches. Author: Amit Langote Reviewed-by: Fujii Masao Discussion: https://postgr.es/m/CAHGQGwFHdSvifhJE+-GSNqUHSfbiKxaeQQ7HGcYz6SC2n_oDcg@mail.gmail.com
1 parent 3228512 commit de01777

File tree

3 files changed

+60
-7
lines changed

3 files changed

+60
-7
lines changed

‎src/backend/commands/tablecmds.c

Lines changed: 25 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -302,6 +302,7 @@ struct DropRelationCallbackState
302302
((child_is_partition) ? DEPENDENCY_AUTO : DEPENDENCY_NORMAL)
303303

304304
static void truncate_check_rel(Oid relid, Form_pg_class reltuple);
305+
static void truncate_check_perms(Oid relid, Form_pg_class reltuple);
305306
static void truncate_check_activity(Relation rel);
306307
static void RangeVarCallbackForTruncate(const RangeVar *relation,
307308
Oid relId, Oid oldRelId, void *arg);
@@ -1590,6 +1591,12 @@ ExecuteTruncate(TruncateStmt *stmt)
15901591
continue;
15911592
}
15921593

1594+
/*
1595+
* Inherited TRUNCATE commands perform access
1596+
* permission checks on the parent table only.
1597+
* So we skip checking the children's permissions
1598+
* and don't call truncate_check_perms() here.
1599+
*/
15931600
truncate_check_rel(RelationGetRelid(rel), rel->rd_rel);
15941601
truncate_check_activity(rel);
15951602

@@ -1676,6 +1683,7 @@ ExecuteTruncateGuts(List *explicit_rels, List *relids, List *relids_logged,
16761683
(errmsg("truncate cascades to table \"%s\"",
16771684
RelationGetRelationName(rel))));
16781685
truncate_check_rel(relid, rel->rd_rel);
1686+
truncate_check_perms(relid, rel->rd_rel);
16791687
truncate_check_activity(rel);
16801688
rels = lappend(rels, rel);
16811689
relids = lappend_oid(relids, relid);
@@ -1926,7 +1934,6 @@ ExecuteTruncateGuts(List *explicit_rels, List *relids, List *relids_logged,
19261934
static void
19271935
truncate_check_rel(Oid relid, Form_pg_class reltuple)
19281936
{
1929-
AclResult aclresult;
19301937
char *relname = NameStr(reltuple->relname);
19311938

19321939
/*
@@ -1940,19 +1947,29 @@ truncate_check_rel(Oid relid, Form_pg_class reltuple)
19401947
(errcode(ERRCODE_WRONG_OBJECT_TYPE),
19411948
errmsg("\"%s\" is not a table", relname)));
19421949

1943-
/* Permissions checks */
1944-
aclresult = pg_class_aclcheck(relid, GetUserId(), ACL_TRUNCATE);
1945-
if (aclresult != ACLCHECK_OK)
1946-
aclcheck_error(aclresult, get_relkind_objtype(reltuple->relkind),
1947-
relname);
1948-
19491950
if (!allowSystemTableMods && IsSystemClass(relid, reltuple))
19501951
ereport(ERROR,
19511952
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
19521953
errmsg("permission denied: \"%s\" is a system catalog",
19531954
relname)));
19541955
}
19551956

1957+
/*
1958+
* Check that current user has the permission to truncate given relation.
1959+
*/
1960+
static void
1961+
truncate_check_perms(Oid relid, Form_pg_class reltuple)
1962+
{
1963+
char *relname = NameStr(reltuple->relname);
1964+
AclResult aclresult;
1965+
1966+
/* Permissions checks */
1967+
aclresult = pg_class_aclcheck(relid, GetUserId(), ACL_TRUNCATE);
1968+
if (aclresult != ACLCHECK_OK)
1969+
aclcheck_error(aclresult, get_relkind_objtype(reltuple->relkind),
1970+
relname);
1971+
}
1972+
19561973
/*
19571974
* Set of extra sanity checks to check if a given relation is safe to
19581975
* truncate. This is split with truncate_check_rel() as
@@ -14886,6 +14903,7 @@ RangeVarCallbackForTruncate(const RangeVar *relation,
1488614903
elog(ERROR, "cache lookup failed for relation %u", relId);
1488714904

1488814905
truncate_check_rel(relId, (Form_pg_class) GETSTRUCT(tuple));
14906+
truncate_check_perms(relId, (Form_pg_class) GETSTRUCT(tuple));
1488914907

1489014908
ReleaseSysCache(tuple);
1489114909
}

‎src/test/regress/expected/privileges.out

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -695,6 +695,27 @@ SELECT tableoid FROM atestp2; -- ok
695695
----------
696696
(0 rows)
697697

698+
-- child's permissions do not apply when operating on parent
699+
SET SESSION AUTHORIZATION regress_priv_user1;
700+
REVOKE ALL ON atestc FROM regress_priv_user2;
701+
GRANT ALL ON atestp1 TO regress_priv_user2;
702+
SET SESSION AUTHORIZATION regress_priv_user2;
703+
SELECT f2 FROM atestp1; -- ok
704+
f2
705+
----
706+
(0 rows)
707+
708+
SELECT f2 FROM atestc; -- fail
709+
ERROR: permission denied for table atestc
710+
DELETE FROM atestp1; -- ok
711+
DELETE FROM atestc; -- fail
712+
ERROR: permission denied for table atestc
713+
UPDATE atestp1 SET f1 = 1; -- ok
714+
UPDATE atestc SET f1 = 1; -- fail
715+
ERROR: permission denied for table atestc
716+
TRUNCATE atestp1; -- ok
717+
TRUNCATE atestc; -- fail
718+
ERROR: permission denied for table atestc
698719
-- privileges on functions, languages
699720
-- switch to superuser
700721
\c -

‎src/test/regress/sql/privileges.sql

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -446,6 +446,20 @@ SELECT fy FROM atestp2; -- ok
446446
SELECT atestp2 FROM atestp2; -- ok
447447
SELECT tableoid FROM atestp2; -- ok
448448

449+
-- child's permissions do not apply when operating on parent
450+
SET SESSION AUTHORIZATION regress_priv_user1;
451+
REVOKE ALL ON atestc FROM regress_priv_user2;
452+
GRANT ALL ON atestp1 TO regress_priv_user2;
453+
SET SESSION AUTHORIZATION regress_priv_user2;
454+
SELECT f2 FROM atestp1; -- ok
455+
SELECT f2 FROM atestc; -- fail
456+
DELETE FROM atestp1; -- ok
457+
DELETE FROM atestc; -- fail
458+
UPDATE atestp1 SET f1 = 1; -- ok
459+
UPDATE atestc SET f1 = 1; -- fail
460+
TRUNCATE atestp1; -- ok
461+
TRUNCATE atestc; -- fail
462+
449463
-- privileges on functions, languages
450464

451465
-- switch to superuser

0 commit comments

Comments
 (0)