From 57bb8a2fd83e23aab2bc9b08c55c8a3b462e50d6 Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Thu, 10 Mar 2016 20:56:09 -0500 Subject: [PATCH 1/5] Add new catalog called pg_init_privs This new catalog holds the privileges which the system was initialized with at initdb time, along with any permissions set by extensions at CREATE EXTENSION time. This allows pg_dump (and any other similar use-cases) to detect when the privileges set on initdb-created or extension-created objects have been changed from what they were set to at initdb/extension-creation time and handle those changes appropriately. --- doc/src/sgml/catalogs.sgml | 108 +++++++++++++++++++++ src/backend/catalog/Makefile | 2 +- src/backend/catalog/aclchk.c | 149 +++++++++++++++++++++++++++++ src/backend/catalog/dependency.c | 46 ++++++++- src/bin/initdb/initdb.c | 143 +++++++++++++++++++++++++++ src/include/catalog/indexing.h | 3 + src/include/catalog/pg_init_privs.h | 101 +++++++++++++++++++ src/test/regress/expected/sanity_check.out | 1 + 8 files changed, 549 insertions(+), 4 deletions(-) create mode 100644 src/include/catalog/pg_init_privs.h diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml index bb75229..c8897f4 100644 --- a/doc/src/sgml/catalogs.sgml +++ b/doc/src/sgml/catalogs.sgml @@ -179,6 +179,11 @@ + pg_init_privs + object initial privileges + + + pg_language languages for writing functions @@ -3772,6 +3777,109 @@ + + <structname>pg_init_privs</structname> + + + pg_init_privs + + + + The catalog pg_init_privs records information about + the initial privileges of objects in the system. There is one entry + for each object in the database which has a non-default (non-NULL) + initial set of privileges. + + + + Objects can have initial privileges either by having those privileges set + when the system is initialized (by initdb) or when the + object is created during a CREATE EXTENSION and the + extension script sets initial privileges using the GRANT + system. Note that the system will automatically handle recording of the + privileges during the extension script and that extension authors need + only use the GRANT and REVOKE + statements in their script to have the privileges recorded. The + privtype column indicates if the initial privilege was + set by initdb or during a + CREATE EXTENSION command. + + + + Objects which have initial privileges set by initdb will + have entries where privtype is + 'i', while objects which have initial privileges set + by CREATE EXTENSION will have entries where + privtype is 'e'. + + + + <structname>pg_inherits</> Columns + + + + + Name + Type + References + Description + + + + + + objoid + oid + any OID column + The OID of the specific object + + + + classoid + oid + pg_class.oid + The OID of the system catalog the object is in + + + + objsubid + int4 + + + For a table column, this is the column number (the + objoid and classoid refer to the + table itself). For all other object types, this column is + zero. + + + + + privtype + char + + + A code defining the type of initial privilege of this object; see text + + + + + initprivs + aclitem[] + + + The initial access privileges; see + and + + for details + + + + + +
+ + + <structname>pg_language</structname> diff --git a/src/backend/catalog/Makefile b/src/backend/catalog/Makefile index 25130ec..1ce7610 100644 --- a/src/backend/catalog/Makefile +++ b/src/backend/catalog/Makefile @@ -40,7 +40,7 @@ POSTGRES_BKI_SRCS = $(addprefix $(top_srcdir)/src/include/catalog/,\ pg_ts_parser.h pg_ts_template.h pg_extension.h \ pg_foreign_data_wrapper.h pg_foreign_server.h pg_user_mapping.h \ pg_foreign_table.h pg_policy.h pg_replication_origin.h \ - pg_default_acl.h pg_seclabel.h pg_shseclabel.h \ + pg_default_acl.h pg_init_privs.h pg_seclabel.h pg_shseclabel.h \ pg_collation.h pg_range.h pg_transform.h \ toasting.h indexing.h \ ) diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c index 0f3bc07..ffb6678 100644 --- a/src/backend/catalog/aclchk.c +++ b/src/backend/catalog/aclchk.c @@ -35,6 +35,7 @@ #include "catalog/pg_extension.h" #include "catalog/pg_foreign_data_wrapper.h" #include "catalog/pg_foreign_server.h" +#include "catalog/pg_init_privs.h" #include "catalog/pg_language.h" #include "catalog/pg_largeobject.h" #include "catalog/pg_largeobject_metadata.h" @@ -49,6 +50,7 @@ #include "catalog/pg_ts_dict.h" #include "commands/dbcommands.h" #include "commands/event_trigger.h" +#include "commands/extension.h" #include "commands/proclang.h" #include "commands/tablespace.h" #include "foreign/foreign.h" @@ -119,6 +121,8 @@ static AclMode restrict_and_check_grant(bool is_grant, AclMode avail_goptions, AttrNumber att_number, const char *colname); static AclMode pg_aclmask(AclObjectKind objkind, Oid table_oid, AttrNumber attnum, Oid roleid, AclMode mask, AclMaskHow how); +static void recordExtensionInitPriv(Oid objoid, Oid classoid, int objsubid, + Acl *new_acl); #ifdef ACLDEBUG @@ -1678,6 +1682,10 @@ ExecGrant_Attribute(InternalGrant *istmt, Oid relOid, const char *relname, /* keep the catalog indexes up to date */ CatalogUpdateIndexes(attRelation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(relOid, RelationRelationId, attnum, + ACL_NUM(new_acl) > 0 ? new_acl : NULL); + /* Update the shared dependency ACL info */ updateAclDependencies(RelationRelationId, relOid, attnum, ownerId, @@ -1939,6 +1947,9 @@ ExecGrant_Relation(InternalGrant *istmt) /* keep the catalog indexes up to date */ CatalogUpdateIndexes(relation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(relOid, RelationRelationId, 0, new_acl); + /* Update the shared dependency ACL info */ updateAclDependencies(RelationRelationId, relOid, 0, ownerId, @@ -2254,6 +2265,10 @@ ExecGrant_Fdw(InternalGrant *istmt) /* keep the catalog indexes up to date */ CatalogUpdateIndexes(relation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(fdwid, ForeignDataWrapperRelationId, 0, + new_acl); + /* Update the shared dependency ACL info */ updateAclDependencies(ForeignDataWrapperRelationId, HeapTupleGetOid(tuple), 0, @@ -2379,6 +2394,9 @@ ExecGrant_ForeignServer(InternalGrant *istmt) /* keep the catalog indexes up to date */ CatalogUpdateIndexes(relation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(srvid, ForeignServerRelationId, 0, new_acl); + /* Update the shared dependency ACL info */ updateAclDependencies(ForeignServerRelationId, HeapTupleGetOid(tuple), 0, @@ -2503,6 +2521,9 @@ ExecGrant_Function(InternalGrant *istmt) /* keep the catalog indexes up to date */ CatalogUpdateIndexes(relation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(funcId, ProcedureRelationId, 0, new_acl); + /* Update the shared dependency ACL info */ updateAclDependencies(ProcedureRelationId, funcId, 0, ownerId, @@ -2633,6 +2654,9 @@ ExecGrant_Language(InternalGrant *istmt) /* keep the catalog indexes up to date */ CatalogUpdateIndexes(relation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(langId, LanguageRelationId, 0, new_acl); + /* Update the shared dependency ACL info */ updateAclDependencies(LanguageRelationId, HeapTupleGetOid(tuple), 0, ownerId, @@ -2772,6 +2796,9 @@ ExecGrant_Largeobject(InternalGrant *istmt) /* keep the catalog indexes up to date */ CatalogUpdateIndexes(relation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(loid, LargeObjectRelationId, 0, new_acl); + /* Update the shared dependency ACL info */ updateAclDependencies(LargeObjectRelationId, HeapTupleGetOid(tuple), 0, @@ -2897,6 +2924,9 @@ ExecGrant_Namespace(InternalGrant *istmt) /* keep the catalog indexes up to date */ CatalogUpdateIndexes(relation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(nspid, NamespaceRelationId, 0, new_acl); + /* Update the shared dependency ACL info */ updateAclDependencies(NamespaceRelationId, HeapTupleGetOid(tuple), 0, ownerId, @@ -3158,6 +3188,9 @@ ExecGrant_Type(InternalGrant *istmt) /* keep the catalog indexes up to date */ CatalogUpdateIndexes(relation, newtuple); + /* Update initial privileges for extensions */ + recordExtensionInitPriv(typId, TypeRelationId, 0, new_acl); + /* Update the shared dependency ACL info */ updateAclDependencies(TypeRelationId, typId, 0, ownerId, @@ -5174,3 +5207,119 @@ get_user_default_acl(GrantObjectType objtype, Oid ownerId, Oid nsp_oid) return result; } + +/* + * Record initial ACL for an extension object + * + * This will perform a wholesale replacement of the entire ACL for the object + * passed in, therefore be sure to pass in the complete new ACL to use. + * + * Can be called at any time, we check if 'creating_extension' is set and, if + * not, exit immediately. + * + * Pass in the object OID, the OID of the class (the OID of the table which + * the object is defined in) and the 'sub' id of the object (objsubid), if + * any. If there is no 'sub' id (they are currently only used for columns of + * tables) then pass in '0'. Finally, pass in the complete ACL to store. + * + * If an ACL already exists for this object/sub-object then we will replace + * it with what is passed in. + * + * Passing in NULL for 'new_acl' will result in the entry for the object being + * removed, if one is found. + */ +static void +recordExtensionInitPriv(Oid objoid, Oid classoid, int objsubid, Acl *new_acl) +{ + Relation relation; + ScanKeyData key[3]; + SysScanDesc scan; + HeapTuple tuple; + HeapTuple oldtuple; + + if (!creating_extension) + return; + + relation = heap_open(InitPrivsRelationId, RowExclusiveLock); + + ScanKeyInit(&key[0], + Anum_pg_init_privs_objoid, + BTEqualStrategyNumber, F_OIDEQ, + ObjectIdGetDatum(objoid)); + ScanKeyInit(&key[1], + Anum_pg_init_privs_classoid, + BTEqualStrategyNumber, F_OIDEQ, + ObjectIdGetDatum(classoid)); + ScanKeyInit(&key[2], + Anum_pg_init_privs_objsubid, + BTEqualStrategyNumber, F_INT4EQ, + Int32GetDatum(objsubid)); + + scan = systable_beginscan(relation, InitPrivsObjIndexId, true, + NULL, 3, key); + + /* There should exist only one entry or none. */ + oldtuple = systable_getnext(scan); + + systable_endscan(scan); + + /* If we find an entry, update it with the latest ACL. */ + if (HeapTupleIsValid(oldtuple)) + { + Datum values[Natts_pg_init_privs]; + bool nulls[Natts_pg_init_privs]; + bool replace[Natts_pg_init_privs]; + + /* If we have a new ACL to set, then update the row with it. */ + if (new_acl) + { + MemSet(values, 0, sizeof(values)); + MemSet(nulls, false, sizeof(nulls)); + MemSet(replace, false, sizeof(replace)); + + values[Anum_pg_init_privs_privs - 1] = PointerGetDatum(new_acl); + replace[Anum_pg_init_privs_privs - 1] = true; + + oldtuple = heap_modify_tuple(oldtuple, RelationGetDescr(relation), + values, nulls, replace); + + simple_heap_update(relation, &oldtuple->t_self, oldtuple); + + /* keep the catalog indexes up to date */ + CatalogUpdateIndexes(relation, oldtuple); + } + else + /* new_acl is NULL, so delete the entry we found. */ + simple_heap_delete(relation, &oldtuple->t_self); + } + else + { + /* No entry found, so add it. */ + Datum values[Natts_pg_init_privs]; + bool nulls[Natts_pg_init_privs]; + + MemSet(nulls, false, sizeof(nulls)); + + values[Anum_pg_init_privs_objoid - 1] = ObjectIdGetDatum(objoid); + values[Anum_pg_init_privs_classoid - 1] = ObjectIdGetDatum(classoid); + values[Anum_pg_init_privs_objsubid - 1] = Int32GetDatum(objsubid); + + /* This function only handles initial privileges of extensions */ + values[Anum_pg_init_privs_privtype - 1] = + CharGetDatum(INITPRIVS_EXTENSION); + + values[Anum_pg_init_privs_privs - 1] = PointerGetDatum(new_acl); + + tuple = heap_form_tuple(RelationGetDescr(relation), values, nulls); + + simple_heap_insert(relation, tuple); + + /* keep the catalog indexes up to date */ + CatalogUpdateIndexes(relation, tuple); + } + + /* prevent error when processing objects multiple times */ + CommandCounterIncrement(); + + heap_close(relation, RowExclusiveLock); +} diff --git a/src/backend/catalog/dependency.c b/src/backend/catalog/dependency.c index 17f9de1..400cb9f 100644 --- a/src/backend/catalog/dependency.c +++ b/src/backend/catalog/dependency.c @@ -39,6 +39,7 @@ #include "catalog/pg_extension.h" #include "catalog/pg_foreign_data_wrapper.h" #include "catalog/pg_foreign_server.h" +#include "catalog/pg_init_privs.h" #include "catalog/pg_language.h" #include "catalog/pg_largeobject.h" #include "catalog/pg_namespace.h" @@ -196,6 +197,7 @@ static bool object_address_present_add_flags(const ObjectAddress *object, static bool stack_address_present_add_flags(const ObjectAddress *object, int flags, ObjectAddressStack *stack); +static void DeleteInitPrivs(const ObjectAddress *object); /* @@ -1104,12 +1106,13 @@ deleteOneObject(const ObjectAddress *object, Relation *depRel, int flags) /* - * Delete any comments or security labels associated with this object. - * (This is a convenient place to do these things, rather than having - * every object type know to do it.) + * Delete any comments, security labels, or initial privileges associated + * with this object. (This is a convenient place to do these things, + * rather than having every object type know to do it.) */ DeleteComments(object->objectId, object->classId, object->objectSubId); DeleteSecurityLabel(object); + DeleteInitPrivs(object); /* * CommandCounterIncrement here to ensure that preceding changes are all @@ -2430,3 +2433,40 @@ getObjectClass(const ObjectAddress *object) elog(ERROR, "unrecognized object class: %u", object->classId); return OCLASS_CLASS; /* keep compiler quiet */ } + +/* + * delete initial ACL for extension objects + */ +static void +DeleteInitPrivs(const ObjectAddress *object) +{ + Relation relation; + ScanKeyData key[3]; + SysScanDesc scan; + HeapTuple oldtuple; + + relation = heap_open(InitPrivsRelationId, RowExclusiveLock); + + ScanKeyInit(&key[0], + Anum_pg_init_privs_objoid, + BTEqualStrategyNumber, F_OIDEQ, + ObjectIdGetDatum(object->objectId)); + ScanKeyInit(&key[1], + Anum_pg_init_privs_classoid, + BTEqualStrategyNumber, F_OIDEQ, + ObjectIdGetDatum(object->classId)); + ScanKeyInit(&key[2], + Anum_pg_init_privs_objsubid, + BTEqualStrategyNumber, F_INT4EQ, + Int32GetDatum(object->objectSubId)); + + scan = systable_beginscan(relation, InitPrivsObjIndexId, true, + NULL, 3, key); + + while (HeapTupleIsValid(oldtuple = systable_getnext(scan))) + simple_heap_delete(relation, &oldtuple->t_self); + + systable_endscan(scan); + + heap_close(relation, RowExclusiveLock); +} diff --git a/src/bin/initdb/initdb.c b/src/bin/initdb/initdb.c index ed3ba7b..858667b 100644 --- a/src/bin/initdb/initdb.c +++ b/src/bin/initdb/initdb.c @@ -1989,6 +1989,11 @@ setup_dictionary(FILE *cmdfd) * Some objects may require different permissions by default, so we * make sure we don't overwrite privilege sets that have already been * set (NOT NULL). + * + * Also populate pg_init_privs to save what the privileges are at init + * time. This is used by pg_dump to allow users to change privileges + * on catalog objects and to have those privilege changes preserved + * across dump/reload and pg_upgrade. */ static void setup_privileges(FILE *cmdfd) @@ -2002,6 +2007,144 @@ setup_privileges(FILE *cmdfd) "GRANT USAGE ON SCHEMA pg_catalog TO PUBLIC;\n\n", "GRANT CREATE, USAGE ON SCHEMA public TO PUBLIC;\n\n", "REVOKE ALL ON pg_largeobject FROM PUBLIC;\n\n", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE relname = 'pg_class')," + " 0," + " relacl," + " 'i'" + " FROM" + " pg_class" + " WHERE" + " relacl IS NOT NULL" + " AND relkind IN ('r', 'v', 'm', 'S');", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " pg_class.oid," + " (SELECT oid FROM pg_class WHERE relname = 'pg_class')," + " pg_attribute.attnum," + " pg_attribute.attacl," + " 'i'" + " FROM" + " pg_class" + " JOIN pg_attribute ON (pg_class.oid = pg_attribute.attrelid)" + " WHERE" + " pg_attribute.attacl IS NOT NULL" + " AND pg_class.relkind IN ('r', 'v', 'm', 'S');", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE relname = 'pg_proc')," + " 0," + " proacl," + " 'i'" + " FROM" + " pg_proc" + " WHERE" + " proacl IS NOT NULL;", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE relname = 'pg_type')," + " 0," + " typacl," + " 'i'" + " FROM" + " pg_type" + " WHERE" + " typacl IS NOT NULL;", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE relname = 'pg_language')," + " 0," + " lanacl," + " 'i'" + " FROM" + " pg_language" + " WHERE" + " lanacl IS NOT NULL;", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE " + " relname = 'pg_largeobject_metadata')," + " 0," + " lomacl," + " 'i'" + " FROM" + " pg_largeobject_metadata" + " WHERE" + " lomacl IS NOT NULL;", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE relname = 'pg_namespace')," + " 0," + " nspacl," + " 'i'" + " FROM" + " pg_namespace" + " WHERE" + " nspacl IS NOT NULL;", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE relname = 'pg_database')," + " 0," + " datacl," + " 'i'" + " FROM" + " pg_database" + " WHERE" + " datacl IS NOT NULL;", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE relname = 'pg_tablespace')," + " 0," + " spcacl," + " 'i'" + " FROM" + " pg_tablespace" + " WHERE" + " spcacl IS NOT NULL;", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class WHERE " + " relname = 'pg_foreign_data_wrapper')," + " 0," + " fdwacl," + " 'i'" + " FROM" + " pg_foreign_data_wrapper" + " WHERE" + " fdwacl IS NOT NULL;", + "INSERT INTO pg_init_privs " + " (objoid, classoid, objsubid, initprivs, privtype)" + " SELECT" + " oid," + " (SELECT oid FROM pg_class " + " WHERE relname = 'pg_foreign_server')," + " 0," + " srvacl," + " 'i'" + " FROM" + " pg_foreign_server" + " WHERE" + " srvacl IS NOT NULL;", NULL }; diff --git a/src/include/catalog/indexing.h b/src/include/catalog/indexing.h index ab2c1a8..ca5eb3d 100644 --- a/src/include/catalog/indexing.h +++ b/src/include/catalog/indexing.h @@ -162,6 +162,9 @@ DECLARE_UNIQUE_INDEX(pg_inherits_relid_seqno_index, 2680, on pg_inherits using b DECLARE_INDEX(pg_inherits_parent_index, 2187, on pg_inherits using btree(inhparent oid_ops)); #define InheritsParentIndexId 2187 +DECLARE_UNIQUE_INDEX(pg_init_privs_o_c_o_index, 3395, on pg_init_privs using btree(objoid oid_ops, classoid oid_ops, objsubid int4_ops)); +#define InitPrivsObjIndexId 3395 + DECLARE_UNIQUE_INDEX(pg_language_name_index, 2681, on pg_language using btree(lanname name_ops)); #define LanguageNameIndexId 2681 DECLARE_UNIQUE_INDEX(pg_language_oid_index, 2682, on pg_language using btree(oid oid_ops)); diff --git a/src/include/catalog/pg_init_privs.h b/src/include/catalog/pg_init_privs.h new file mode 100644 index 0000000..e13edd3 --- /dev/null +++ b/src/include/catalog/pg_init_privs.h @@ -0,0 +1,101 @@ +/*------------------------------------------------------------------------- + * + * pg_init_privs.h + * definition of the system "initial privileges" relation (pg_init_privs) + * + * NOTE: an object is identified by the OID of the row that primarily + * defines the object, plus the OID of the table that that row appears in. + * For example, a function is identified by the OID of its pg_proc row + * plus the pg_class OID of table pg_proc. This allows unique identification + * of objects without assuming that OIDs are unique across tables. + * + * Since attributes don't have OIDs of their own, we identify an attribute + * privilege by the objoid+classoid of its parent table, plus an "objsubid" + * giving the attribute column number. "objsubid" must be zero in a privilege + * for a table itself, so that it is distinct from any column privilege. + * Currently, objsubid is unused and zero for all other kinds of objects. + * + * Portions Copyright (c) 1996-2016, PostgreSQL Global Development Group + * Portions Copyright (c) 1994, Regents of the University of California + * + * src/include/catalog/pg_init_privs.h + * + * NOTES + * the genbki.pl script reads this file and generates .bki + * information from the DATA() statements. + * + * XXX do NOT break up DATA() statements into multiple lines! + * the scripts are not as smart as you might think... + * + *------------------------------------------------------------------------- + */ +#ifndef PG_INIT_PRIVS_H +#define PG_INIT_PRIVS_H + +#include "catalog/genbki.h" + +/* ---------------- + * pg_init_privs definition. cpp turns this into + * typedef struct FormData_pg_init_privs + * ---------------- + */ +#define InitPrivsRelationId 3394 + +CATALOG(pg_init_privs,3394) BKI_WITHOUT_OIDS +{ + Oid objoid; /* OID of object itself */ + Oid classoid; /* OID of table containing object */ + int32 objsubid; /* column number, or 0 if not used */ + char privtype; /* from initdb or extension? */ + +#ifdef CATALOG_VARLEN /* variable-length fields start here */ + aclitem initprivs[1] BKI_FORCE_NOT_NULL; /* initial privs on + * object */ +#endif +} FormData_pg_init_privs; + +/* ---------------- + * Form_pg_init_privs corresponds to a pointer to a tuple with + * the format of pg_init_privs relation. + * ---------------- + */ +typedef FormData_pg_init_privs *Form_pg_init_privs; + +/* ---------------- + * compiler constants for pg_init_privs + * ---------------- + */ +#define Natts_pg_init_privs 5 +#define Anum_pg_init_privs_objoid 1 +#define Anum_pg_init_privs_classoid 2 +#define Anum_pg_init_privs_objsubid 3 +#define Anum_pg_init_privs_privtype 4 +#define Anum_pg_init_privs_privs 5 + +/* + * It is important to know if the initial privileges are from initdb or from an + * extension. This enum is used to provide that differentiation and the two + * places which populate this table (initdb and during CREATE EXTENSION, see + * recordExtensionInitPriv()) know to use the correct values. + */ + +typedef enum InitPrivsType +{ + INITPRIVS_INITDB = 'i', + INITPRIVS_EXTENSION = 'e' +} InitPrivsType; + +/* ---------------- + * initial contents of pg_init_privs + * ---------------- + */ + +/* + * Because the contents of this table depend on what is done with the other + * objects in the system (and, in particular, may change due to changes is + * system_views.sql), there is no initialization here. + * + * The initial contents are loaded near the end of initdb. + */ + +#endif /* PG_INIT_PRIVS_H */ diff --git a/src/test/regress/expected/sanity_check.out b/src/test/regress/expected/sanity_check.out index 2c5be4b..4d81ba7 100644 --- a/src/test/regress/expected/sanity_check.out +++ b/src/test/regress/expected/sanity_check.out @@ -110,6 +110,7 @@ pg_foreign_server|t pg_foreign_table|t pg_index|t pg_inherits|t +pg_init_privs|t pg_language|t pg_largeobject|t pg_largeobject_metadata|t -- 2.5.0 From 545460654892d153a16b59ccb9d0665d9024f7e1 Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Sun, 13 Mar 2016 11:31:03 -0400 Subject: [PATCH 2/5] In pg_dump, use a bitmap to represent what to include pg_dump has historically used a simple boolean 'dump' value to indicate if a given object should be included in the dump or not. Instead, use a bitmap which breaks down the components of an object into their distinct pieces and use that bitmap to only include the components requested. This does not include any behavioral change, but is in preperation for the change to dump out just ACLs for objects in pg_catalog. --- src/bin/pg_dump/common.c | 2 +- src/bin/pg_dump/pg_dump.c | 1502 ++++++++++++++++++++++++--------------------- src/bin/pg_dump/pg_dump.h | 14 +- 3 files changed, 833 insertions(+), 685 deletions(-) diff --git a/src/bin/pg_dump/common.c b/src/bin/pg_dump/common.c index 373d3bc..1cbb987 100644 --- a/src/bin/pg_dump/common.c +++ b/src/bin/pg_dump/common.c @@ -443,7 +443,7 @@ AssignDumpId(DumpableObject *dobj) dobj->dumpId = ++lastDumpId; dobj->name = NULL; /* must be set later */ dobj->namespace = NULL; /* may be set later */ - dobj->dump = true; /* default assumption */ + dobj->dump = DUMP_COMPONENT_ALL; /* default assumption */ dobj->ext_member = false; /* default assumption */ dobj->dependencies = NULL; dobj->nDeps = 0; diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c index 454225d..5fa9992 100644 --- a/src/bin/pg_dump/pg_dump.c +++ b/src/bin/pg_dump/pg_dump.c @@ -1287,7 +1287,7 @@ checkExtensionMembership(DumpableObject *dobj, DumpOptions *dopt) * extension contents with something different. */ if (!dopt->binary_upgrade) - dobj->dump = false; + dobj->dump = DUMP_COMPONENT_NONE; else dobj->dump = ext->dobj.dump; @@ -1309,16 +1309,18 @@ selectDumpableNamespace(NamespaceInfo *nsinfo, DumpOptions *dopt) * namespaces. If specific namespaces are being dumped, dump just those * namespaces. Otherwise, dump all non-system namespaces. */ + if (table_include_oids.head != NULL) - nsinfo->dobj.dump = false; + nsinfo->dobj.dump = DUMP_COMPONENT_NONE; else if (schema_include_oids.head != NULL) nsinfo->dobj.dump = simple_oid_list_member(&schema_include_oids, - nsinfo->dobj.catId.oid); + nsinfo->dobj.catId.oid) ? + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; else if (strncmp(nsinfo->dobj.name, "pg_", 3) == 0 || strcmp(nsinfo->dobj.name, "information_schema") == 0) - nsinfo->dobj.dump = false; + nsinfo->dobj.dump = DUMP_COMPONENT_NONE; else - nsinfo->dobj.dump = true; + nsinfo->dobj.dump = DUMP_COMPONENT_ALL; /* * In any case, a namespace can be excluded by an exclusion switch @@ -1326,7 +1328,7 @@ selectDumpableNamespace(NamespaceInfo *nsinfo, DumpOptions *dopt) if (nsinfo->dobj.dump && simple_oid_list_member(&schema_exclude_oids, nsinfo->dobj.catId.oid)) - nsinfo->dobj.dump = false; + nsinfo->dobj.dump = DUMP_COMPONENT_NONE; } /* @@ -1345,7 +1347,8 @@ selectDumpableTable(TableInfo *tbinfo, DumpOptions *dopt) */ if (table_include_oids.head != NULL) tbinfo->dobj.dump = simple_oid_list_member(&table_include_oids, - tbinfo->dobj.catId.oid); + tbinfo->dobj.catId.oid) ? + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; else tbinfo->dobj.dump = tbinfo->dobj.namespace->dobj.dump; @@ -1355,7 +1358,7 @@ selectDumpableTable(TableInfo *tbinfo, DumpOptions *dopt) if (tbinfo->dobj.dump && simple_oid_list_member(&table_exclude_oids, tbinfo->dobj.catId.oid)) - tbinfo->dobj.dump = false; + tbinfo->dobj.dump = DUMP_COMPONENT_NONE; } /* @@ -1384,7 +1387,7 @@ selectDumpableType(TypeInfo *tyinfo, DumpOptions *dopt) if (tytable != NULL) tyinfo->dobj.dump = tytable->dobj.dump; else - tyinfo->dobj.dump = false; + tyinfo->dobj.dump = DUMP_COMPONENT_NONE; return; } @@ -1404,11 +1407,7 @@ selectDumpableType(TypeInfo *tyinfo, DumpOptions *dopt) if (checkExtensionMembership(&tyinfo->dobj, dopt)) return; /* extension membership overrides all else */ - /* dump only types in dumpable namespaces */ - if (!tyinfo->dobj.namespace->dobj.dump) - tyinfo->dobj.dump = false; - else - tyinfo->dobj.dump = true; + tyinfo->dobj.dump = tyinfo->dobj.namespace->dobj.dump; } /* @@ -1427,7 +1426,8 @@ selectDumpableDefaultACL(DefaultACLInfo *dinfo, DumpOptions *dopt) if (dinfo->dobj.namespace) dinfo->dobj.dump = dinfo->dobj.namespace->dobj.dump; else - dinfo->dobj.dump = dopt->include_everything; + dinfo->dobj.dump = dopt->include_everything ? + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } /* @@ -1446,9 +1446,10 @@ selectDumpableCast(CastInfo *cast, DumpOptions *dopt) return; /* extension membership overrides all else */ if (cast->dobj.catId.oid < (Oid) FirstNormalObjectId) - cast->dobj.dump = false; + cast->dobj.dump = DUMP_COMPONENT_NONE; else - cast->dobj.dump = dopt->include_everything; + cast->dobj.dump = dopt->include_everything ? + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } /* @@ -1466,9 +1467,10 @@ selectDumpableProcLang(ProcLangInfo *plang, DumpOptions *dopt) return; /* extension membership overrides all else */ if (plang->dobj.catId.oid < (Oid) FirstNormalObjectId) - plang->dobj.dump = false; + plang->dobj.dump = DUMP_COMPONENT_NONE; else - plang->dobj.dump = dopt->include_everything; + plang->dobj.dump = dopt->include_everything ? + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } /* @@ -1505,9 +1507,10 @@ static void selectDumpableExtension(ExtensionInfo *extinfo, DumpOptions *dopt) { if (dopt->binary_upgrade && extinfo->dobj.catId.oid < (Oid) FirstNormalObjectId) - extinfo->dobj.dump = false; + extinfo->dobj.dump = DUMP_COMPONENT_NONE; else - extinfo->dobj.dump = dopt->include_everything; + extinfo->dobj.dump = dopt->include_everything ? + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } /* @@ -1529,7 +1532,8 @@ selectDumpableObject(DumpableObject *dobj, DumpOptions *dopt) if (dobj->namespace) dobj->dump = dobj->namespace->dobj.dump; else - dobj->dump = dopt->include_everything; + dobj->dump = dopt->include_everything ? + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } /* @@ -1934,13 +1938,14 @@ dumpTableData(Archive *fout, TableDataInfo *tdinfo) * dependency on its table as "special" and pass it to ArchiveEntry now. * See comments for BuildArchiveDependencies. */ - ArchiveEntry(fout, tdinfo->dobj.catId, tdinfo->dobj.dumpId, - tbinfo->dobj.name, tbinfo->dobj.namespace->dobj.name, - NULL, tbinfo->rolname, - false, "TABLE DATA", SECTION_DATA, - "", "", copyStmt, - &(tbinfo->dobj.dumpId), 1, - dumpFn, tdinfo); + if (tdinfo->dobj.dump & DUMP_COMPONENT_DATA) + ArchiveEntry(fout, tdinfo->dobj.catId, tdinfo->dobj.dumpId, + tbinfo->dobj.name, tbinfo->dobj.namespace->dobj.name, + NULL, tbinfo->rolname, + false, "TABLE DATA", SECTION_DATA, + "", "", copyStmt, + &(tbinfo->dobj.dumpId), 1, + dumpFn, tdinfo); destroyPQExpBuffer(copyBuf); destroyPQExpBuffer(clistBuf); @@ -1968,23 +1973,24 @@ refreshMatViewData(Archive *fout, TableDataInfo *tdinfo) appendPQExpBuffer(q, "REFRESH MATERIALIZED VIEW %s;\n", fmtId(tbinfo->dobj.name)); - ArchiveEntry(fout, - tdinfo->dobj.catId, /* catalog ID */ - tdinfo->dobj.dumpId, /* dump ID */ - tbinfo->dobj.name, /* Name */ - tbinfo->dobj.namespace->dobj.name, /* Namespace */ - NULL, /* Tablespace */ - tbinfo->rolname, /* Owner */ - false, /* with oids */ - "MATERIALIZED VIEW DATA", /* Desc */ - SECTION_POST_DATA, /* Section */ - q->data, /* Create */ - "", /* Del */ - NULL, /* Copy */ - tdinfo->dobj.dependencies, /* Deps */ - tdinfo->dobj.nDeps, /* # Deps */ - NULL, /* Dumper */ - NULL); /* Dumper Arg */ + if (tdinfo->dobj.dump & DUMP_COMPONENT_DATA) + ArchiveEntry(fout, + tdinfo->dobj.catId, /* catalog ID */ + tdinfo->dobj.dumpId, /* dump ID */ + tbinfo->dobj.name, /* Name */ + tbinfo->dobj.namespace->dobj.name, /* Namespace */ + NULL, /* Tablespace */ + tbinfo->rolname, /* Owner */ + false, /* with oids */ + "MATERIALIZED VIEW DATA", /* Desc */ + SECTION_POST_DATA, /* Section */ + q->data, /* Create */ + "", /* Del */ + NULL, /* Copy */ + tdinfo->dobj.dependencies, /* Deps */ + tdinfo->dobj.nDeps, /* # Deps */ + NULL, /* Dumper */ + NULL); /* Dumper Arg */ destroyPQExpBuffer(q); } @@ -2000,7 +2006,7 @@ getTableData(DumpOptions *dopt, TableInfo *tblinfo, int numTables, bool oids) for (i = 0; i < numTables; i++) { - if (tblinfo[i].dobj.dump) + if (tblinfo[i].dobj.dump & DUMP_COMPONENT_DATA) makeTableDataInfo(dopt, &(tblinfo[i]), oids); } } @@ -2261,7 +2267,7 @@ guessConstraintInheritance(TableInfo *tblinfo, int numTables) continue; /* Don't bother computing anything for non-target tables, either */ - if (!tbinfo->dobj.dump) + if (!(tbinfo->dobj.dump & DUMP_COMPONENT_DEFINITION)) continue; numParents = tbinfo->numParents; @@ -2811,31 +2817,34 @@ dumpBlob(Archive *fout, BlobInfo *binfo) "SELECT pg_catalog.lo_unlink('%s');\n", binfo->dobj.name); - ArchiveEntry(fout, binfo->dobj.catId, binfo->dobj.dumpId, - binfo->dobj.name, - NULL, NULL, - binfo->rolname, false, - "BLOB", SECTION_PRE_DATA, - cquery->data, dquery->data, NULL, - NULL, 0, - NULL, NULL); + if (binfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, binfo->dobj.catId, binfo->dobj.dumpId, + binfo->dobj.name, + NULL, NULL, + binfo->rolname, false, + "BLOB", SECTION_PRE_DATA, + cquery->data, dquery->data, NULL, + NULL, 0, + NULL, NULL); /* set up tag for comment and/or ACL */ resetPQExpBuffer(cquery); appendPQExpBuffer(cquery, "LARGE OBJECT %s", binfo->dobj.name); /* Dump comment if any */ - dumpComment(fout, cquery->data, - NULL, binfo->rolname, - binfo->dobj.catId, 0, binfo->dobj.dumpId); + if (binfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, cquery->data, + NULL, binfo->rolname, + binfo->dobj.catId, 0, binfo->dobj.dumpId); /* Dump security label if any */ - dumpSecLabel(fout, cquery->data, - NULL, binfo->rolname, - binfo->dobj.catId, 0, binfo->dobj.dumpId); + if (binfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, cquery->data, + NULL, binfo->rolname, + binfo->dobj.catId, 0, binfo->dobj.dumpId); /* Dump ACL if any */ - if (binfo->blobacl) + if (binfo->blobacl && (binfo->dobj.dump & DUMP_COMPONENT_ACL)) dumpACL(fout, binfo->dobj.catId, binfo->dobj.dumpId, "LARGE OBJECT", binfo->dobj.name, NULL, cquery->data, NULL, binfo->rolname, binfo->blobacl); @@ -2956,7 +2965,7 @@ getPolicies(Archive *fout, TableInfo tblinfo[], int numTables) TableInfo *tbinfo = &tblinfo[i]; /* Ignore row security on tables not to be dumped */ - if (!tbinfo->dobj.dump) + if (!(tbinfo->dobj.dump & DUMP_COMPONENT_POLICY)) continue; if (g_verbose) @@ -3096,15 +3105,16 @@ dumpPolicy(Archive *fout, PolicyInfo *polinfo) appendPQExpBuffer(query, "ALTER TABLE %s ENABLE ROW LEVEL SECURITY;", fmtId(polinfo->dobj.name)); - ArchiveEntry(fout, polinfo->dobj.catId, polinfo->dobj.dumpId, - polinfo->dobj.name, - polinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, false, - "ROW SECURITY", SECTION_POST_DATA, - query->data, "", NULL, - NULL, 0, - NULL, NULL); + if (polinfo->dobj.dump & DUMP_COMPONENT_POLICY) + ArchiveEntry(fout, polinfo->dobj.catId, polinfo->dobj.dumpId, + polinfo->dobj.name, + polinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, false, + "ROW SECURITY", SECTION_POST_DATA, + query->data, "", NULL, + NULL, 0, + NULL, NULL); destroyPQExpBuffer(query); return; @@ -3147,15 +3157,16 @@ dumpPolicy(Archive *fout, PolicyInfo *polinfo) appendPQExpBuffer(delqry, "DROP POLICY %s", fmtId(polinfo->polname)); appendPQExpBuffer(delqry, " ON %s;\n", fmtId(tbinfo->dobj.name)); - ArchiveEntry(fout, polinfo->dobj.catId, polinfo->dobj.dumpId, - polinfo->dobj.name, - polinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, false, - "POLICY", SECTION_POST_DATA, - query->data, delqry->data, NULL, - NULL, 0, - NULL, NULL); + if (polinfo->dobj.dump & DUMP_COMPONENT_POLICY) + ArchiveEntry(fout, polinfo->dobj.catId, polinfo->dobj.dumpId, + polinfo->dobj.name, + polinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, false, + "POLICY", SECTION_POST_DATA, + query->data, delqry->data, NULL, + NULL, 0, + NULL, NULL); destroyPQExpBuffer(query); destroyPQExpBuffer(delqry); @@ -3760,7 +3771,8 @@ getTypes(Archive *fout, int *numTypes) */ tyinfo[i].nDomChecks = 0; tyinfo[i].domChecks = NULL; - if (tyinfo[i].dobj.dump && tyinfo[i].typtype == TYPTYPE_DOMAIN) + if ((tyinfo[i].dobj.dump & DUMP_COMPONENT_DEFINITION) && + tyinfo[i].typtype == TYPTYPE_DOMAIN) getDomainConstraints(fout, &(tyinfo[i])); /* @@ -3773,8 +3785,9 @@ getTypes(Archive *fout, int *numTypes) * should copy the base type's catId, but then it might capture the * pg_depend entries for the type, which we don't want. */ - if (tyinfo[i].dobj.dump && (tyinfo[i].typtype == TYPTYPE_BASE || - tyinfo[i].typtype == TYPTYPE_RANGE)) + if ((tyinfo[i].dobj.dump & DUMP_COMPONENT_DEFINITION) && + (tyinfo[i].typtype == TYPTYPE_BASE || + tyinfo[i].typtype == TYPTYPE_RANGE)) { stinfo = (ShellTypeInfo *) pg_malloc(sizeof(ShellTypeInfo)); stinfo->dobj.objType = DO_SHELL_TYPE; @@ -3790,7 +3803,7 @@ getTypes(Archive *fout, int *numTypes) * dump it if the I/O or canonicalize functions need to be dumped; * this is taken care of while sorting dependencies. */ - stinfo->dobj.dump = false; + stinfo->dobj.dump = DUMP_COMPONENT_NONE; /* * However, if dumping from pre-7.3, there will be no dependency @@ -3808,7 +3821,7 @@ getTypes(Archive *fout, int *numTypes) typoutput = atooid(PQgetvalue(res, i, i_typoutput)); funcInfo = findFuncByOid(typinput); - if (funcInfo && funcInfo->dobj.dump) + if (funcInfo && funcInfo->dobj.dump & DUMP_COMPONENT_DEFINITION) { /* base type depends on function */ addObjectDependency(&tyinfo[i].dobj, @@ -3817,11 +3830,11 @@ getTypes(Archive *fout, int *numTypes) addObjectDependency(&funcInfo->dobj, stinfo->dobj.dumpId); /* mark shell type as to be dumped */ - stinfo->dobj.dump = true; + stinfo->dobj.dump = DUMP_COMPONENT_ALL; } funcInfo = findFuncByOid(typoutput); - if (funcInfo && funcInfo->dobj.dump) + if (funcInfo && funcInfo->dobj.dump & DUMP_COMPONENT_DEFINITION) { /* base type depends on function */ addObjectDependency(&tyinfo[i].dobj, @@ -3830,7 +3843,7 @@ getTypes(Archive *fout, int *numTypes) addObjectDependency(&funcInfo->dobj, stinfo->dobj.dumpId); /* mark shell type as to be dumped */ - stinfo->dobj.dump = true; + stinfo->dobj.dump = DUMP_COMPONENT_ALL; } } } @@ -5353,10 +5366,11 @@ getTables(Archive *fout, int *numTables) * Decide whether we want to dump this table. */ if (tblinfo[i].relkind == RELKIND_COMPOSITE_TYPE) - tblinfo[i].dobj.dump = false; + tblinfo[i].dobj.dump = DUMP_COMPONENT_NONE; else selectDumpableTable(&tblinfo[i], dopt); - tblinfo[i].interesting = tblinfo[i].dobj.dump; + + tblinfo[i].interesting = tblinfo[i].dobj.dump ? true : false; tblinfo[i].postponed_def = false; /* might get set during sort */ @@ -5423,13 +5437,13 @@ getOwnedSeqs(Archive *fout, TableInfo tblinfo[], int numTables) if (!OidIsValid(seqinfo->owning_tab)) continue; /* not an owned sequence */ - if (seqinfo->dobj.dump) + if (seqinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) continue; /* no need to search */ owning_tab = findTableByOid(seqinfo->owning_tab); if (owning_tab && owning_tab->dobj.dump) { seqinfo->interesting = true; - seqinfo->dobj.dump = true; + seqinfo->dobj.dump = DUMP_COMPONENT_ALL; } } } @@ -5531,8 +5545,8 @@ getIndexes(Archive *fout, TableInfo tblinfo[], int numTables) if (!tbinfo->hasindex) continue; - /* Ignore indexes of tables not to be dumped */ - if (!tbinfo->dobj.dump) + /* Ignore indexes of tables whose definitions are not to be dumped */ + if (!(tbinfo->dobj.dump & DUMP_COMPONENT_DEFINITION)) continue; if (g_verbose) @@ -5899,7 +5913,8 @@ getConstraints(Archive *fout, TableInfo tblinfo[], int numTables) { TableInfo *tbinfo = &tblinfo[i]; - if (!tbinfo->hastriggers || !tbinfo->dobj.dump) + if (!tbinfo->hastriggers || + !(tbinfo->dobj.dump & DUMP_COMPONENT_DEFINITION)) continue; if (g_verbose) @@ -6238,7 +6253,8 @@ getTriggers(Archive *fout, TableInfo tblinfo[], int numTables) { TableInfo *tbinfo = &tblinfo[i]; - if (!tbinfo->hastriggers || !tbinfo->dobj.dump) + if (!tbinfo->hastriggers || + !(tbinfo->dobj.dump & DUMP_COMPONENT_DEFINITION)) continue; if (g_verbose) @@ -8591,12 +8607,13 @@ dumpDumpableObject(Archive *fout, DumpableObject *dobj) dumpBlob(fout, (BlobInfo *) dobj); break; case DO_BLOB_DATA: - ArchiveEntry(fout, dobj->catId, dobj->dumpId, - dobj->name, NULL, NULL, "", - false, "BLOBS", SECTION_DATA, - "", "", NULL, - NULL, 0, - dumpBlobs, NULL); + if (dobj->dump & DUMP_COMPONENT_DATA) + ArchiveEntry(fout, dobj->catId, dobj->dumpId, + dobj->name, NULL, NULL, "", + false, "BLOBS", SECTION_DATA, + "", "", NULL, + NULL, 0, + dumpBlobs, NULL); break; case DO_POLICY: dumpPolicy(fout, (PolicyInfo *) dobj); @@ -8644,26 +8661,31 @@ dumpNamespace(Archive *fout, NamespaceInfo *nspinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &nspinfo->dobj, labelq->data); - ArchiveEntry(fout, nspinfo->dobj.catId, nspinfo->dobj.dumpId, - nspinfo->dobj.name, - NULL, NULL, - nspinfo->rolname, - false, "SCHEMA", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (nspinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, nspinfo->dobj.catId, nspinfo->dobj.dumpId, + nspinfo->dobj.name, + NULL, NULL, + nspinfo->rolname, + false, "SCHEMA", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Schema Comments and Security Labels */ - dumpComment(fout, labelq->data, - NULL, nspinfo->rolname, - nspinfo->dobj.catId, 0, nspinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - NULL, nspinfo->rolname, - nspinfo->dobj.catId, 0, nspinfo->dobj.dumpId); + if (nspinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, nspinfo->rolname, + nspinfo->dobj.catId, 0, nspinfo->dobj.dumpId); - dumpACL(fout, nspinfo->dobj.catId, nspinfo->dobj.dumpId, "SCHEMA", - qnspname, NULL, nspinfo->dobj.name, NULL, - nspinfo->rolname, nspinfo->nspacl); + if (nspinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + NULL, nspinfo->rolname, + nspinfo->dobj.catId, 0, nspinfo->dobj.dumpId); + + if (nspinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, nspinfo->dobj.catId, nspinfo->dobj.dumpId, "SCHEMA", + qnspname, NULL, nspinfo->dobj.name, NULL, + nspinfo->rolname, nspinfo->nspacl); free(qnspname); @@ -8773,22 +8795,26 @@ dumpExtension(Archive *fout, ExtensionInfo *extinfo) appendPQExpBuffer(labelq, "EXTENSION %s", qextname); - ArchiveEntry(fout, extinfo->dobj.catId, extinfo->dobj.dumpId, - extinfo->dobj.name, - NULL, NULL, - "", - false, "EXTENSION", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (extinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, extinfo->dobj.catId, extinfo->dobj.dumpId, + extinfo->dobj.name, + NULL, NULL, + "", + false, "EXTENSION", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Extension Comments and Security Labels */ - dumpComment(fout, labelq->data, - NULL, "", - extinfo->dobj.catId, 0, extinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - NULL, "", - extinfo->dobj.catId, 0, extinfo->dobj.dumpId); + if (extinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, "", + extinfo->dobj.catId, 0, extinfo->dobj.dumpId); + + if (extinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + NULL, "", + extinfo->dobj.catId, 0, extinfo->dobj.dumpId); free(qextname); @@ -8928,28 +8954,33 @@ dumpEnumType(Archive *fout, TypeInfo *tyinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &tyinfo->dobj, labelq->data); - ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, - tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - NULL, - tyinfo->rolname, false, - "TYPE", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (tyinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, + tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + NULL, + tyinfo->rolname, false, + "TYPE", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Type Comments and Security Labels */ - dumpComment(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + if (tyinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", - qtypname, NULL, tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + if (tyinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + + if (tyinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", + qtypname, NULL, tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + tyinfo->rolname, tyinfo->typacl); PQclear(res); destroyPQExpBuffer(q); @@ -9061,28 +9092,33 @@ dumpRangeType(Archive *fout, TypeInfo *tyinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &tyinfo->dobj, labelq->data); - ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, - tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - NULL, - tyinfo->rolname, false, - "TYPE", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (tyinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, + tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + NULL, + tyinfo->rolname, false, + "TYPE", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Type Comments and Security Labels */ - dumpComment(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + if (tyinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + + if (tyinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", - qtypname, NULL, tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + if (tyinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", + qtypname, NULL, tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + tyinfo->rolname, tyinfo->typacl); PQclear(res); destroyPQExpBuffer(q); @@ -9131,28 +9167,33 @@ dumpUndefinedType(Archive *fout, TypeInfo *tyinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &tyinfo->dobj, labelq->data); - ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, - tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - NULL, - tyinfo->rolname, false, - "TYPE", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (tyinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, + tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + NULL, + tyinfo->rolname, false, + "TYPE", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Type Comments and Security Labels */ - dumpComment(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + if (tyinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + + if (tyinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", - qtypname, NULL, tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + if (tyinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", + qtypname, NULL, tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + tyinfo->rolname, tyinfo->typacl); destroyPQExpBuffer(q); destroyPQExpBuffer(delq); @@ -9520,28 +9561,33 @@ dumpBaseType(Archive *fout, TypeInfo *tyinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &tyinfo->dobj, labelq->data); - ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, - tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - NULL, - tyinfo->rolname, false, - "TYPE", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (tyinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, + tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + NULL, + tyinfo->rolname, false, + "TYPE", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Type Comments and Security Labels */ - dumpComment(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + if (tyinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", - qtypname, NULL, tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + if (tyinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + + if (tyinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", + qtypname, NULL, tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + tyinfo->rolname, tyinfo->typacl); PQclear(res); destroyPQExpBuffer(q); @@ -9683,28 +9729,33 @@ dumpDomain(Archive *fout, TypeInfo *tyinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &tyinfo->dobj, labelq->data); - ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, - tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - NULL, - tyinfo->rolname, false, - "DOMAIN", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (tyinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, + tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + NULL, + tyinfo->rolname, false, + "DOMAIN", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Domain Comments and Security Labels */ - dumpComment(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + if (tyinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + + if (tyinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", - qtypname, NULL, tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + if (tyinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", + qtypname, NULL, tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + tyinfo->rolname, tyinfo->typacl); /* Dump any per-constraint comments */ for (i = 0; i < tyinfo->nDomChecks; i++) @@ -9716,10 +9767,13 @@ dumpDomain(Archive *fout, TypeInfo *tyinfo) fmtId(domcheck->dobj.name)); appendPQExpBuffer(labelq, "ON DOMAIN %s", qtypname); - dumpComment(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, - domcheck->dobj.catId, 0, tyinfo->dobj.dumpId); + + if (tyinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, + tyinfo->rolname, + domcheck->dobj.catId, 0, tyinfo->dobj.dumpId); + destroyPQExpBuffer(labelq); } @@ -9909,29 +9963,34 @@ dumpCompositeType(Archive *fout, TypeInfo *tyinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &tyinfo->dobj, labelq->data); - ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, - tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - NULL, - tyinfo->rolname, false, - "TYPE", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (tyinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, + tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + NULL, + tyinfo->rolname, false, + "TYPE", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Type Comments and Security Labels */ - dumpComment(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, - tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + if (tyinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); + + if (tyinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + tyinfo->dobj.namespace->dobj.name, tyinfo->rolname, + tyinfo->dobj.catId, 0, tyinfo->dobj.dumpId); - dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", - qtypname, NULL, tyinfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + if (tyinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", + qtypname, NULL, tyinfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + tyinfo->rolname, tyinfo->typacl); PQclear(res); destroyPQExpBuffer(q); @@ -9941,7 +10000,8 @@ dumpCompositeType(Archive *fout, TypeInfo *tyinfo) destroyPQExpBuffer(query); /* Dump any per-column comments */ - dumpCompositeTypeColComments(fout, tyinfo); + if (tyinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpCompositeTypeColComments(fout, tyinfo); } /* @@ -10086,15 +10146,16 @@ dumpShellType(Archive *fout, ShellTypeInfo *stinfo) appendPQExpBuffer(q, "CREATE TYPE %s;\n", fmtId(stinfo->dobj.name)); - ArchiveEntry(fout, stinfo->dobj.catId, stinfo->dobj.dumpId, - stinfo->dobj.name, - stinfo->dobj.namespace->dobj.name, - NULL, - stinfo->baseType->rolname, false, - "SHELL TYPE", SECTION_PRE_DATA, - q->data, "", NULL, - NULL, 0, - NULL, NULL); + if (stinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, stinfo->dobj.catId, stinfo->dobj.dumpId, + stinfo->dobj.name, + stinfo->dobj.namespace->dobj.name, + NULL, + stinfo->baseType->rolname, false, + "SHELL TYPE", SECTION_PRE_DATA, + q->data, "", NULL, + NULL, 0, + NULL, NULL); destroyPQExpBuffer(q); } @@ -10223,23 +10284,27 @@ dumpProcLang(Archive *fout, ProcLangInfo *plang) if (dopt->binary_upgrade) binary_upgrade_extension_member(defqry, &plang->dobj, labelq->data); - ArchiveEntry(fout, plang->dobj.catId, plang->dobj.dumpId, - plang->dobj.name, - lanschema, NULL, plang->lanowner, - false, "PROCEDURAL LANGUAGE", SECTION_PRE_DATA, - defqry->data, delqry->data, NULL, - NULL, 0, - NULL, NULL); + if (plang->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, plang->dobj.catId, plang->dobj.dumpId, + plang->dobj.name, + lanschema, NULL, plang->lanowner, + false, "PROCEDURAL LANGUAGE", SECTION_PRE_DATA, + defqry->data, delqry->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Proc Lang Comments and Security Labels */ - dumpComment(fout, labelq->data, - NULL, "", - plang->dobj.catId, 0, plang->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - NULL, "", - plang->dobj.catId, 0, plang->dobj.dumpId); + if (plang->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, "", + plang->dobj.catId, 0, plang->dobj.dumpId); + + if (plang->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + NULL, "", + plang->dobj.catId, 0, plang->dobj.dumpId); - if (plang->lanpltrusted) + if (plang->lanpltrusted && plang->dobj.dump & DUMP_COMPONENT_ACL) dumpACL(fout, plang->dobj.catId, plang->dobj.dumpId, "LANGUAGE", qlanname, NULL, plang->dobj.name, lanschema, @@ -10888,28 +10953,33 @@ dumpFunc(Archive *fout, FuncInfo *finfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &finfo->dobj, labelq->data); - ArchiveEntry(fout, finfo->dobj.catId, finfo->dobj.dumpId, - funcsig_tag, - finfo->dobj.namespace->dobj.name, - NULL, - finfo->rolname, false, - "FUNCTION", SECTION_PRE_DATA, - q->data, delqry->data, NULL, - NULL, 0, - NULL, NULL); + if (finfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, finfo->dobj.catId, finfo->dobj.dumpId, + funcsig_tag, + finfo->dobj.namespace->dobj.name, + NULL, + finfo->rolname, false, + "FUNCTION", SECTION_PRE_DATA, + q->data, delqry->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Function Comments and Security Labels */ - dumpComment(fout, labelq->data, - finfo->dobj.namespace->dobj.name, finfo->rolname, - finfo->dobj.catId, 0, finfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - finfo->dobj.namespace->dobj.name, finfo->rolname, - finfo->dobj.catId, 0, finfo->dobj.dumpId); + if (finfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + finfo->dobj.namespace->dobj.name, finfo->rolname, + finfo->dobj.catId, 0, finfo->dobj.dumpId); - dumpACL(fout, finfo->dobj.catId, finfo->dobj.dumpId, "FUNCTION", - funcsig, NULL, funcsig_tag, - finfo->dobj.namespace->dobj.name, - finfo->rolname, finfo->proacl); + if (finfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + finfo->dobj.namespace->dobj.name, finfo->rolname, + finfo->dobj.catId, 0, finfo->dobj.dumpId); + + if (finfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, finfo->dobj.catId, finfo->dobj.dumpId, "FUNCTION", + funcsig, NULL, funcsig_tag, + finfo->dobj.namespace->dobj.name, + finfo->rolname, finfo->proacl); PQclear(res); @@ -11018,18 +11088,20 @@ dumpCast(Archive *fout, CastInfo *cast) if (dopt->binary_upgrade) binary_upgrade_extension_member(defqry, &cast->dobj, labelq->data); - ArchiveEntry(fout, cast->dobj.catId, cast->dobj.dumpId, - labelq->data, - "pg_catalog", NULL, "", - false, "CAST", SECTION_PRE_DATA, - defqry->data, delqry->data, NULL, - NULL, 0, - NULL, NULL); + if (cast->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, cast->dobj.catId, cast->dobj.dumpId, + labelq->data, + "pg_catalog", NULL, "", + false, "CAST", SECTION_PRE_DATA, + defqry->data, delqry->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Cast Comments */ - dumpComment(fout, labelq->data, - NULL, "", - cast->dobj.catId, 0, cast->dobj.dumpId); + if (cast->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, "", + cast->dobj.catId, 0, cast->dobj.dumpId); free(sourceType); free(targetType); @@ -11138,18 +11210,20 @@ dumpTransform(Archive *fout, TransformInfo *transform) if (dopt->binary_upgrade) binary_upgrade_extension_member(defqry, &transform->dobj, labelq->data); - ArchiveEntry(fout, transform->dobj.catId, transform->dobj.dumpId, - labelq->data, - "pg_catalog", NULL, "", - false, "TRANSFORM", SECTION_PRE_DATA, - defqry->data, delqry->data, NULL, - transform->dobj.dependencies, transform->dobj.nDeps, - NULL, NULL); + if (transform->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, transform->dobj.catId, transform->dobj.dumpId, + labelq->data, + "pg_catalog", NULL, "", + false, "TRANSFORM", SECTION_PRE_DATA, + defqry->data, delqry->data, NULL, + transform->dobj.dependencies, transform->dobj.nDeps, + NULL, NULL); /* Dump Transform Comments */ - dumpComment(fout, labelq->data, - NULL, "", - transform->dobj.catId, 0, transform->dobj.dumpId); + if (transform->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, "", + transform->dobj.catId, 0, transform->dobj.dumpId); free(lanname); free(transformType); @@ -11392,20 +11466,22 @@ dumpOpr(Archive *fout, OprInfo *oprinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &oprinfo->dobj, labelq->data); - ArchiveEntry(fout, oprinfo->dobj.catId, oprinfo->dobj.dumpId, - oprinfo->dobj.name, - oprinfo->dobj.namespace->dobj.name, - NULL, - oprinfo->rolname, - false, "OPERATOR", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (oprinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, oprinfo->dobj.catId, oprinfo->dobj.dumpId, + oprinfo->dobj.name, + oprinfo->dobj.namespace->dobj.name, + NULL, + oprinfo->rolname, + false, "OPERATOR", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Operator Comments */ - dumpComment(fout, labelq->data, - oprinfo->dobj.namespace->dobj.name, oprinfo->rolname, - oprinfo->dobj.catId, 0, oprinfo->dobj.dumpId); + if (oprinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + oprinfo->dobj.namespace->dobj.name, oprinfo->rolname, + oprinfo->dobj.catId, 0, oprinfo->dobj.dumpId); PQclear(res); @@ -11970,20 +12046,22 @@ dumpOpclass(Archive *fout, OpclassInfo *opcinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &opcinfo->dobj, labelq->data); - ArchiveEntry(fout, opcinfo->dobj.catId, opcinfo->dobj.dumpId, - opcinfo->dobj.name, - opcinfo->dobj.namespace->dobj.name, - NULL, - opcinfo->rolname, - false, "OPERATOR CLASS", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (opcinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, opcinfo->dobj.catId, opcinfo->dobj.dumpId, + opcinfo->dobj.name, + opcinfo->dobj.namespace->dobj.name, + NULL, + opcinfo->rolname, + false, "OPERATOR CLASS", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Operator Class Comments */ - dumpComment(fout, labelq->data, - NULL, opcinfo->rolname, - opcinfo->dobj.catId, 0, opcinfo->dobj.dumpId); + if (opcinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, opcinfo->rolname, + opcinfo->dobj.catId, 0, opcinfo->dobj.dumpId); free(amname); destroyPQExpBuffer(query); @@ -12284,20 +12362,22 @@ dumpOpfamily(Archive *fout, OpfamilyInfo *opfinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &opfinfo->dobj, labelq->data); - ArchiveEntry(fout, opfinfo->dobj.catId, opfinfo->dobj.dumpId, - opfinfo->dobj.name, - opfinfo->dobj.namespace->dobj.name, - NULL, - opfinfo->rolname, - false, "OPERATOR FAMILY", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (opfinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, opfinfo->dobj.catId, opfinfo->dobj.dumpId, + opfinfo->dobj.name, + opfinfo->dobj.namespace->dobj.name, + NULL, + opfinfo->rolname, + false, "OPERATOR FAMILY", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Operator Family Comments */ - dumpComment(fout, labelq->data, - NULL, opfinfo->rolname, - opfinfo->dobj.catId, 0, opfinfo->dobj.dumpId); + if (opfinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, opfinfo->rolname, + opfinfo->dobj.catId, 0, opfinfo->dobj.dumpId); free(amname); PQclear(res_ops); @@ -12374,20 +12454,22 @@ dumpCollation(Archive *fout, CollInfo *collinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &collinfo->dobj, labelq->data); - ArchiveEntry(fout, collinfo->dobj.catId, collinfo->dobj.dumpId, - collinfo->dobj.name, - collinfo->dobj.namespace->dobj.name, - NULL, - collinfo->rolname, - false, "COLLATION", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (collinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, collinfo->dobj.catId, collinfo->dobj.dumpId, + collinfo->dobj.name, + collinfo->dobj.namespace->dobj.name, + NULL, + collinfo->rolname, + false, "COLLATION", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Collation Comments */ - dumpComment(fout, labelq->data, - collinfo->dobj.namespace->dobj.name, collinfo->rolname, - collinfo->dobj.catId, 0, collinfo->dobj.dumpId); + if (collinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + collinfo->dobj.namespace->dobj.name, collinfo->rolname, + collinfo->dobj.catId, 0, collinfo->dobj.dumpId); PQclear(res); @@ -12474,20 +12556,22 @@ dumpConversion(Archive *fout, ConvInfo *convinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &convinfo->dobj, labelq->data); - ArchiveEntry(fout, convinfo->dobj.catId, convinfo->dobj.dumpId, - convinfo->dobj.name, - convinfo->dobj.namespace->dobj.name, - NULL, - convinfo->rolname, - false, "CONVERSION", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (convinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, convinfo->dobj.catId, convinfo->dobj.dumpId, + convinfo->dobj.name, + convinfo->dobj.namespace->dobj.name, + NULL, + convinfo->rolname, + false, "CONVERSION", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Conversion Comments */ - dumpComment(fout, labelq->data, - convinfo->dobj.namespace->dobj.name, convinfo->rolname, - convinfo->dobj.catId, 0, convinfo->dobj.dumpId); + if (convinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + convinfo->dobj.namespace->dobj.name, convinfo->rolname, + convinfo->dobj.catId, 0, convinfo->dobj.dumpId); PQclear(res); @@ -12937,23 +13021,30 @@ dumpAgg(Archive *fout, AggInfo *agginfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &agginfo->aggfn.dobj, labelq->data); - ArchiveEntry(fout, agginfo->aggfn.dobj.catId, agginfo->aggfn.dobj.dumpId, - aggsig_tag, - agginfo->aggfn.dobj.namespace->dobj.name, - NULL, - agginfo->aggfn.rolname, - false, "AGGREGATE", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (agginfo->aggfn.dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, agginfo->aggfn.dobj.catId, + agginfo->aggfn.dobj.dumpId, + aggsig_tag, + agginfo->aggfn.dobj.namespace->dobj.name, + NULL, + agginfo->aggfn.rolname, + false, "AGGREGATE", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Aggregate Comments */ - dumpComment(fout, labelq->data, - agginfo->aggfn.dobj.namespace->dobj.name, agginfo->aggfn.rolname, - agginfo->aggfn.dobj.catId, 0, agginfo->aggfn.dobj.dumpId); - dumpSecLabel(fout, labelq->data, - agginfo->aggfn.dobj.namespace->dobj.name, agginfo->aggfn.rolname, - agginfo->aggfn.dobj.catId, 0, agginfo->aggfn.dobj.dumpId); + if (agginfo->aggfn.dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + agginfo->aggfn.dobj.namespace->dobj.name, + agginfo->aggfn.rolname, + agginfo->aggfn.dobj.catId, 0, agginfo->aggfn.dobj.dumpId); + + if (agginfo->aggfn.dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + agginfo->aggfn.dobj.namespace->dobj.name, + agginfo->aggfn.rolname, + agginfo->aggfn.dobj.catId, 0, agginfo->aggfn.dobj.dumpId); /* * Since there is no GRANT ON AGGREGATE syntax, we have to make the ACL @@ -12966,11 +13057,12 @@ dumpAgg(Archive *fout, AggInfo *agginfo) aggsig = format_function_signature(fout, &agginfo->aggfn, true); aggsig_tag = format_function_signature(fout, &agginfo->aggfn, false); - dumpACL(fout, agginfo->aggfn.dobj.catId, agginfo->aggfn.dobj.dumpId, - "FUNCTION", - aggsig, NULL, aggsig_tag, - agginfo->aggfn.dobj.namespace->dobj.name, - agginfo->aggfn.rolname, agginfo->aggfn.proacl); + if (agginfo->aggfn.dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, agginfo->aggfn.dobj.catId, agginfo->aggfn.dobj.dumpId, + "FUNCTION", + aggsig, NULL, aggsig_tag, + agginfo->aggfn.dobj.namespace->dobj.name, + agginfo->aggfn.rolname, agginfo->aggfn.proacl); free(aggsig); if (aggfullsig) @@ -13038,20 +13130,22 @@ dumpTSParser(Archive *fout, TSParserInfo *prsinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &prsinfo->dobj, labelq->data); - ArchiveEntry(fout, prsinfo->dobj.catId, prsinfo->dobj.dumpId, - prsinfo->dobj.name, - prsinfo->dobj.namespace->dobj.name, - NULL, - "", - false, "TEXT SEARCH PARSER", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (prsinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, prsinfo->dobj.catId, prsinfo->dobj.dumpId, + prsinfo->dobj.name, + prsinfo->dobj.namespace->dobj.name, + NULL, + "", + false, "TEXT SEARCH PARSER", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Parser Comments */ - dumpComment(fout, labelq->data, - NULL, "", - prsinfo->dobj.catId, 0, prsinfo->dobj.dumpId); + if (prsinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, "", + prsinfo->dobj.catId, 0, prsinfo->dobj.dumpId); destroyPQExpBuffer(q); destroyPQExpBuffer(delq); @@ -13126,20 +13220,22 @@ dumpTSDictionary(Archive *fout, TSDictInfo *dictinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &dictinfo->dobj, labelq->data); - ArchiveEntry(fout, dictinfo->dobj.catId, dictinfo->dobj.dumpId, - dictinfo->dobj.name, - dictinfo->dobj.namespace->dobj.name, - NULL, - dictinfo->rolname, - false, "TEXT SEARCH DICTIONARY", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (dictinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, dictinfo->dobj.catId, dictinfo->dobj.dumpId, + dictinfo->dobj.name, + dictinfo->dobj.namespace->dobj.name, + NULL, + dictinfo->rolname, + false, "TEXT SEARCH DICTIONARY", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Dictionary Comments */ - dumpComment(fout, labelq->data, - NULL, dictinfo->rolname, - dictinfo->dobj.catId, 0, dictinfo->dobj.dumpId); + if (dictinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, dictinfo->rolname, + dictinfo->dobj.catId, 0, dictinfo->dobj.dumpId); destroyPQExpBuffer(q); destroyPQExpBuffer(delq); @@ -13193,20 +13289,22 @@ dumpTSTemplate(Archive *fout, TSTemplateInfo *tmplinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &tmplinfo->dobj, labelq->data); - ArchiveEntry(fout, tmplinfo->dobj.catId, tmplinfo->dobj.dumpId, - tmplinfo->dobj.name, - tmplinfo->dobj.namespace->dobj.name, - NULL, - "", - false, "TEXT SEARCH TEMPLATE", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (tmplinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tmplinfo->dobj.catId, tmplinfo->dobj.dumpId, + tmplinfo->dobj.name, + tmplinfo->dobj.namespace->dobj.name, + NULL, + "", + false, "TEXT SEARCH TEMPLATE", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Template Comments */ - dumpComment(fout, labelq->data, - NULL, "", - tmplinfo->dobj.catId, 0, tmplinfo->dobj.dumpId); + if (tmplinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, "", + tmplinfo->dobj.catId, 0, tmplinfo->dobj.dumpId); destroyPQExpBuffer(q); destroyPQExpBuffer(delq); @@ -13322,20 +13420,22 @@ dumpTSConfig(Archive *fout, TSConfigInfo *cfginfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &cfginfo->dobj, labelq->data); - ArchiveEntry(fout, cfginfo->dobj.catId, cfginfo->dobj.dumpId, - cfginfo->dobj.name, - cfginfo->dobj.namespace->dobj.name, - NULL, - cfginfo->rolname, - false, "TEXT SEARCH CONFIGURATION", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (cfginfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, cfginfo->dobj.catId, cfginfo->dobj.dumpId, + cfginfo->dobj.name, + cfginfo->dobj.namespace->dobj.name, + NULL, + cfginfo->rolname, + false, "TEXT SEARCH CONFIGURATION", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Configuration Comments */ - dumpComment(fout, labelq->data, - NULL, cfginfo->rolname, - cfginfo->dobj.catId, 0, cfginfo->dobj.dumpId); + if (cfginfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, cfginfo->rolname, + cfginfo->dobj.catId, 0, cfginfo->dobj.dumpId); destroyPQExpBuffer(q); destroyPQExpBuffer(delq); @@ -13389,27 +13489,30 @@ dumpForeignDataWrapper(Archive *fout, FdwInfo *fdwinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &fdwinfo->dobj, labelq->data); - ArchiveEntry(fout, fdwinfo->dobj.catId, fdwinfo->dobj.dumpId, - fdwinfo->dobj.name, - NULL, - NULL, - fdwinfo->rolname, - false, "FOREIGN DATA WRAPPER", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (fdwinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, fdwinfo->dobj.catId, fdwinfo->dobj.dumpId, + fdwinfo->dobj.name, + NULL, + NULL, + fdwinfo->rolname, + false, "FOREIGN DATA WRAPPER", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Handle the ACL */ - dumpACL(fout, fdwinfo->dobj.catId, fdwinfo->dobj.dumpId, - "FOREIGN DATA WRAPPER", - qfdwname, NULL, fdwinfo->dobj.name, - NULL, fdwinfo->rolname, - fdwinfo->fdwacl); + if (fdwinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, fdwinfo->dobj.catId, fdwinfo->dobj.dumpId, + "FOREIGN DATA WRAPPER", + qfdwname, NULL, fdwinfo->dobj.name, + NULL, fdwinfo->rolname, + fdwinfo->fdwacl); /* Dump Foreign Data Wrapper Comments */ - dumpComment(fout, labelq->data, - NULL, fdwinfo->rolname, - fdwinfo->dobj.catId, 0, fdwinfo->dobj.dumpId); + if (fdwinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, fdwinfo->rolname, + fdwinfo->dobj.catId, 0, fdwinfo->dobj.dumpId); free(qfdwname); @@ -13482,33 +13585,37 @@ dumpForeignServer(Archive *fout, ForeignServerInfo *srvinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &srvinfo->dobj, labelq->data); - ArchiveEntry(fout, srvinfo->dobj.catId, srvinfo->dobj.dumpId, - srvinfo->dobj.name, - NULL, - NULL, - srvinfo->rolname, - false, "SERVER", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (srvinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, srvinfo->dobj.catId, srvinfo->dobj.dumpId, + srvinfo->dobj.name, + NULL, + NULL, + srvinfo->rolname, + false, "SERVER", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Handle the ACL */ - dumpACL(fout, srvinfo->dobj.catId, srvinfo->dobj.dumpId, - "FOREIGN SERVER", - qsrvname, NULL, srvinfo->dobj.name, - NULL, srvinfo->rolname, - srvinfo->srvacl); + if (srvinfo->dobj.dump & DUMP_COMPONENT_ACL) + dumpACL(fout, srvinfo->dobj.catId, srvinfo->dobj.dumpId, + "FOREIGN SERVER", + qsrvname, NULL, srvinfo->dobj.name, + NULL, srvinfo->rolname, + srvinfo->srvacl); /* Dump user mappings */ - dumpUserMappings(fout, - srvinfo->dobj.name, NULL, - srvinfo->rolname, - srvinfo->dobj.catId, srvinfo->dobj.dumpId); + if (srvinfo->dobj.dump & DUMP_COMPONENT_USERMAP) + dumpUserMappings(fout, + srvinfo->dobj.name, NULL, + srvinfo->rolname, + srvinfo->dobj.catId, srvinfo->dobj.dumpId); /* Dump Foreign Server Comments */ - dumpComment(fout, labelq->data, - NULL, srvinfo->rolname, - srvinfo->dobj.catId, 0, srvinfo->dobj.dumpId); + if (srvinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, srvinfo->rolname, + srvinfo->dobj.catId, 0, srvinfo->dobj.dumpId); free(qsrvname); @@ -13671,15 +13778,16 @@ dumpDefaultACL(Archive *fout, DefaultACLInfo *daclinfo) exit_horribly(NULL, "could not parse default ACL list (%s)\n", daclinfo->defaclacl); - ArchiveEntry(fout, daclinfo->dobj.catId, daclinfo->dobj.dumpId, - tag->data, + if (daclinfo->dobj.dump & DUMP_COMPONENT_ACL) + ArchiveEntry(fout, daclinfo->dobj.catId, daclinfo->dobj.dumpId, + tag->data, daclinfo->dobj.namespace ? daclinfo->dobj.namespace->dobj.name : NULL, - NULL, - daclinfo->defaclrole, - false, "DEFAULT ACL", SECTION_POST_DATA, - q->data, "", NULL, - NULL, 0, - NULL, NULL); + NULL, + daclinfo->defaclrole, + false, "DEFAULT ACL", SECTION_POST_DATA, + q->data, "", NULL, + NULL, 0, + NULL, NULL); destroyPQExpBuffer(tag); destroyPQExpBuffer(q); @@ -14048,19 +14156,16 @@ collectSecLabels(Archive *fout, SecLabelItem **items) static void dumpTable(Archive *fout, TableInfo *tbinfo) { - DumpOptions *dopt = fout->dopt; - - if (tbinfo->dobj.dump && !dopt->dataOnly) - { - char *namecopy; + char *namecopy; - if (tbinfo->relkind == RELKIND_SEQUENCE) - dumpSequence(fout, tbinfo); - else - dumpTableSchema(fout, tbinfo); + if (tbinfo->relkind == RELKIND_SEQUENCE) + dumpSequence(fout, tbinfo); + else + dumpTableSchema(fout, tbinfo); - /* Handle the ACL here */ - namecopy = pg_strdup(fmtId(tbinfo->dobj.name)); + /* Handle the ACL here */ + namecopy = pg_strdup(fmtId(tbinfo->dobj.name)); + if (tbinfo->dobj.dump & DUMP_COMPONENT_ACL) dumpACL(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId, (tbinfo->relkind == RELKIND_SEQUENCE) ? "SEQUENCE" : "TABLE", @@ -14068,47 +14173,49 @@ dumpTable(Archive *fout, TableInfo *tbinfo) tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, tbinfo->relacl); - /* - * Handle column ACLs, if any. Note: we pull these with a separate - * query rather than trying to fetch them during getTableAttrs, so - * that we won't miss ACLs on system columns. - */ - if (fout->remoteVersion >= 80400) - { - PQExpBuffer query = createPQExpBuffer(); - PGresult *res; - int i; + /* + * Handle column ACLs, if any. Note: we pull these with a separate + * query rather than trying to fetch them during getTableAttrs, so + * that we won't miss ACLs on system columns. + */ + if (fout->remoteVersion >= 80400 && tbinfo->dobj.dump & DUMP_COMPONENT_ACL) + { + PQExpBuffer query = createPQExpBuffer(); + PGresult *res; + int i; - appendPQExpBuffer(query, - "SELECT attname, attacl FROM pg_catalog.pg_attribute " - "WHERE attrelid = '%u' AND NOT attisdropped AND attacl IS NOT NULL " - "ORDER BY attnum", - tbinfo->dobj.catId.oid); - res = ExecuteSqlQuery(fout, query->data, PGRES_TUPLES_OK); + appendPQExpBuffer(query, + "SELECT attname, attacl FROM pg_catalog.pg_attribute " + "WHERE attrelid = '%u' AND NOT attisdropped " + "AND attacl IS NOT NULL " + "ORDER BY attnum", + tbinfo->dobj.catId.oid); + res = ExecuteSqlQuery(fout, query->data, PGRES_TUPLES_OK); - for (i = 0; i < PQntuples(res); i++) - { - char *attname = PQgetvalue(res, i, 0); - char *attacl = PQgetvalue(res, i, 1); - char *attnamecopy; - char *acltag; - - attnamecopy = pg_strdup(fmtId(attname)); - acltag = psprintf("%s.%s", tbinfo->dobj.name, attname); - /* Column's GRANT type is always TABLE */ - dumpACL(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId, "TABLE", - namecopy, attnamecopy, acltag, - tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, - attacl); - free(attnamecopy); - free(acltag); - } - PQclear(res); - destroyPQExpBuffer(query); + for (i = 0; i < PQntuples(res); i++) + { + char *attname = PQgetvalue(res, i, 0); + char *attacl = PQgetvalue(res, i, 1); + char *attnamecopy; + char *acltag; + + attnamecopy = pg_strdup(fmtId(attname)); + acltag = psprintf("%s.%s", tbinfo->dobj.name, attname); + /* Column's GRANT type is always TABLE */ + dumpACL(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId, "TABLE", + namecopy, attnamecopy, acltag, + tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, + attacl); + free(attnamecopy); + free(acltag); } - - free(namecopy); + PQclear(res); + destroyPQExpBuffer(query); } + + free(namecopy); + + return; } /* @@ -14786,24 +14893,28 @@ dumpTableSchema(Archive *fout, TableInfo *tbinfo) if (dopt->binary_upgrade) binary_upgrade_extension_member(q, &tbinfo->dobj, labelq->data); - ArchiveEntry(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId, - tbinfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, + if (tbinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId, + tbinfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, (tbinfo->relkind == RELKIND_VIEW) ? NULL : tbinfo->reltablespace, - tbinfo->rolname, + tbinfo->rolname, (strcmp(reltypename, "TABLE") == 0) ? tbinfo->hasoids : false, - reltypename, - tbinfo->postponed_def ? SECTION_POST_DATA : SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + reltypename, + tbinfo->postponed_def ? + SECTION_POST_DATA : SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); /* Dump Table Comments */ - dumpTableComment(fout, tbinfo, reltypename); + if (tbinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpTableComment(fout, tbinfo, reltypename); /* Dump Table Security Labels */ - dumpTableSecLabel(fout, tbinfo, reltypename); + if (tbinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpTableSecLabel(fout, tbinfo, reltypename); /* Dump comments on inlined table constraints */ for (j = 0; j < tbinfo->ncheck; j++) @@ -14813,7 +14924,8 @@ dumpTableSchema(Archive *fout, TableInfo *tbinfo) if (constr->separate || !constr->conislocal) continue; - dumpTableConstraintComment(fout, constr); + if (tbinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpTableConstraintComment(fout, constr); } destroyPQExpBuffer(q); @@ -14860,15 +14972,16 @@ dumpAttrDef(Archive *fout, AttrDefInfo *adinfo) appendPQExpBuffer(delq, "ALTER COLUMN %s DROP DEFAULT;\n", fmtId(tbinfo->attnames[adnum - 1])); - ArchiveEntry(fout, adinfo->dobj.catId, adinfo->dobj.dumpId, - tbinfo->attnames[adnum - 1], - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, - false, "DEFAULT", SECTION_PRE_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (adinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, adinfo->dobj.catId, adinfo->dobj.dumpId, + tbinfo->attnames[adnum - 1], + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, + false, "DEFAULT", SECTION_PRE_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); destroyPQExpBuffer(q); destroyPQExpBuffer(delq); @@ -14975,24 +15088,26 @@ dumpIndex(Archive *fout, IndxInfo *indxinfo) appendPQExpBuffer(delq, "%s;\n", fmtId(indxinfo->dobj.name)); - ArchiveEntry(fout, indxinfo->dobj.catId, indxinfo->dobj.dumpId, - indxinfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - indxinfo->tablespace, - tbinfo->rolname, false, - "INDEX", SECTION_POST_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (indxinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, indxinfo->dobj.catId, indxinfo->dobj.dumpId, + indxinfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + indxinfo->tablespace, + tbinfo->rolname, false, + "INDEX", SECTION_POST_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); } /* Dump Index Comments */ - dumpComment(fout, labelq->data, - tbinfo->dobj.namespace->dobj.name, - tbinfo->rolname, - indxinfo->dobj.catId, 0, - is_constraint ? indxinfo->indexconstraint : - indxinfo->dobj.dumpId); + if (indxinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tbinfo->dobj.namespace->dobj.name, + tbinfo->rolname, + indxinfo->dobj.catId, 0, + is_constraint ? indxinfo->indexconstraint : + indxinfo->dobj.dumpId); destroyPQExpBuffer(q); destroyPQExpBuffer(delq); @@ -15103,15 +15218,16 @@ dumpConstraint(Archive *fout, ConstraintInfo *coninfo) appendPQExpBuffer(delq, "DROP CONSTRAINT %s;\n", fmtId(coninfo->dobj.name)); - ArchiveEntry(fout, coninfo->dobj.catId, coninfo->dobj.dumpId, - coninfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - indxinfo->tablespace, - tbinfo->rolname, false, - "CONSTRAINT", SECTION_POST_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (coninfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, coninfo->dobj.catId, coninfo->dobj.dumpId, + coninfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + indxinfo->tablespace, + tbinfo->rolname, false, + "CONSTRAINT", SECTION_POST_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); } else if (coninfo->contype == 'f') { @@ -15136,15 +15252,16 @@ dumpConstraint(Archive *fout, ConstraintInfo *coninfo) appendPQExpBuffer(delq, "DROP CONSTRAINT %s;\n", fmtId(coninfo->dobj.name)); - ArchiveEntry(fout, coninfo->dobj.catId, coninfo->dobj.dumpId, - coninfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, false, - "FK CONSTRAINT", SECTION_POST_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (coninfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, coninfo->dobj.catId, coninfo->dobj.dumpId, + coninfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, false, + "FK CONSTRAINT", SECTION_POST_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); } else if (coninfo->contype == 'c' && tbinfo) { @@ -15171,15 +15288,16 @@ dumpConstraint(Archive *fout, ConstraintInfo *coninfo) appendPQExpBuffer(delq, "DROP CONSTRAINT %s;\n", fmtId(coninfo->dobj.name)); - ArchiveEntry(fout, coninfo->dobj.catId, coninfo->dobj.dumpId, - coninfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, false, - "CHECK CONSTRAINT", SECTION_POST_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (coninfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, coninfo->dobj.catId, coninfo->dobj.dumpId, + coninfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, false, + "CHECK CONSTRAINT", SECTION_POST_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); } } else if (coninfo->contype == 'c' && tbinfo == NULL) @@ -15207,15 +15325,16 @@ dumpConstraint(Archive *fout, ConstraintInfo *coninfo) appendPQExpBuffer(delq, "DROP CONSTRAINT %s;\n", fmtId(coninfo->dobj.name)); - ArchiveEntry(fout, coninfo->dobj.catId, coninfo->dobj.dumpId, - coninfo->dobj.name, - tyinfo->dobj.namespace->dobj.name, - NULL, - tyinfo->rolname, false, - "CHECK CONSTRAINT", SECTION_POST_DATA, - q->data, delq->data, NULL, - NULL, 0, - NULL, NULL); + if (coninfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, coninfo->dobj.catId, coninfo->dobj.dumpId, + coninfo->dobj.name, + tyinfo->dobj.namespace->dobj.name, + NULL, + tyinfo->rolname, false, + "CHECK CONSTRAINT", SECTION_POST_DATA, + q->data, delq->data, NULL, + NULL, 0, + NULL, NULL); } } else @@ -15225,7 +15344,8 @@ dumpConstraint(Archive *fout, ConstraintInfo *coninfo) } /* Dump Constraint Comments --- only works for table constraints */ - if (tbinfo && coninfo->separate) + if (tbinfo && coninfo->separate && + coninfo->dobj.dump & DUMP_COMPONENT_COMMENT) dumpTableConstraintComment(fout, coninfo); destroyPQExpBuffer(q); @@ -15249,10 +15369,12 @@ dumpTableConstraintComment(Archive *fout, ConstraintInfo *coninfo) fmtId(coninfo->dobj.name)); appendPQExpBuffer(labelq, "ON %s", fmtId(tbinfo->dobj.name)); - dumpComment(fout, labelq->data, - tbinfo->dobj.namespace->dobj.name, - tbinfo->rolname, - coninfo->dobj.catId, 0, + + if (coninfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tbinfo->dobj.namespace->dobj.name, + tbinfo->rolname, + coninfo->dobj.catId, 0, coninfo->separate ? coninfo->dobj.dumpId : tbinfo->dobj.dumpId); destroyPQExpBuffer(labelq); @@ -15447,15 +15569,16 @@ dumpSequence(Archive *fout, TableInfo *tbinfo) binary_upgrade_extension_member(query, &tbinfo->dobj, labelq->data); - ArchiveEntry(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId, - tbinfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, - false, "SEQUENCE", SECTION_PRE_DATA, - query->data, delqry->data, NULL, - NULL, 0, - NULL, NULL); + if (tbinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId, + tbinfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, + false, "SEQUENCE", SECTION_PRE_DATA, + query->data, delqry->data, NULL, + NULL, 0, + NULL, NULL); /* * If the sequence is owned by a table column, emit the ALTER for it as a @@ -15483,25 +15606,29 @@ dumpSequence(Archive *fout, TableInfo *tbinfo) appendPQExpBuffer(query, ".%s;\n", fmtId(owning_tab->attnames[tbinfo->owning_col - 1])); - ArchiveEntry(fout, nilCatalogId, createDumpId(), - tbinfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, - false, "SEQUENCE OWNED BY", SECTION_PRE_DATA, - query->data, "", NULL, - &(tbinfo->dobj.dumpId), 1, - NULL, NULL); + if (tbinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, nilCatalogId, createDumpId(), + tbinfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, + false, "SEQUENCE OWNED BY", SECTION_PRE_DATA, + query->data, "", NULL, + &(tbinfo->dobj.dumpId), 1, + NULL, NULL); } } /* Dump Sequence Comments and Security Labels */ - dumpComment(fout, labelq->data, - tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, - tbinfo->dobj.catId, 0, tbinfo->dobj.dumpId); - dumpSecLabel(fout, labelq->data, - tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, - tbinfo->dobj.catId, 0, tbinfo->dobj.dumpId); + if (tbinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, + tbinfo->dobj.catId, 0, tbinfo->dobj.dumpId); + + if (tbinfo->dobj.dump & DUMP_COMPONENT_SECLABEL) + dumpSecLabel(fout, labelq->data, + tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, + tbinfo->dobj.catId, 0, tbinfo->dobj.dumpId); PQclear(res); @@ -15550,15 +15677,16 @@ dumpSequenceData(Archive *fout, TableDataInfo *tdinfo) appendPQExpBuffer(query, ", %s, %s);\n", last, (called ? "true" : "false")); - ArchiveEntry(fout, nilCatalogId, createDumpId(), - tbinfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, - false, "SEQUENCE SET", SECTION_DATA, - query->data, "", NULL, - &(tbinfo->dobj.dumpId), 1, - NULL, NULL); + if (tbinfo->dobj.dump & DUMP_COMPONENT_DATA) + ArchiveEntry(fout, nilCatalogId, createDumpId(), + tbinfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, + false, "SEQUENCE SET", SECTION_DATA, + query->data, "", NULL, + &(tbinfo->dobj.dumpId), 1, + NULL, NULL); PQclear(res); @@ -15757,19 +15885,21 @@ dumpTrigger(Archive *fout, TriggerInfo *tginfo) appendPQExpBuffer(labelq, "ON %s", fmtId(tbinfo->dobj.name)); - ArchiveEntry(fout, tginfo->dobj.catId, tginfo->dobj.dumpId, - tginfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, false, - "TRIGGER", SECTION_POST_DATA, - query->data, delqry->data, NULL, - NULL, 0, - NULL, NULL); + if (tginfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, tginfo->dobj.catId, tginfo->dobj.dumpId, + tginfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, false, + "TRIGGER", SECTION_POST_DATA, + query->data, delqry->data, NULL, + NULL, 0, + NULL, NULL); - dumpComment(fout, labelq->data, - tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, - tginfo->dobj.catId, 0, tginfo->dobj.dumpId); + if (tginfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, + tginfo->dobj.catId, 0, tginfo->dobj.dumpId); destroyPQExpBuffer(query); destroyPQExpBuffer(delqry); @@ -15834,14 +15964,16 @@ dumpEventTrigger(Archive *fout, EventTriggerInfo *evtinfo) appendPQExpBuffer(labelq, "EVENT TRIGGER %s", fmtId(evtinfo->dobj.name)); - ArchiveEntry(fout, evtinfo->dobj.catId, evtinfo->dobj.dumpId, - evtinfo->dobj.name, NULL, NULL, evtinfo->evtowner, false, - "EVENT TRIGGER", SECTION_POST_DATA, - query->data, "", NULL, NULL, 0, NULL, NULL); + if (evtinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, evtinfo->dobj.catId, evtinfo->dobj.dumpId, + evtinfo->dobj.name, NULL, NULL, evtinfo->evtowner, false, + "EVENT TRIGGER", SECTION_POST_DATA, + query->data, "", NULL, NULL, 0, NULL, NULL); - dumpComment(fout, labelq->data, - NULL, evtinfo->evtowner, - evtinfo->dobj.catId, 0, evtinfo->dobj.dumpId); + if (evtinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + NULL, evtinfo->evtowner, + evtinfo->dobj.catId, 0, evtinfo->dobj.dumpId); destroyPQExpBuffer(query); destroyPQExpBuffer(labelq); @@ -15958,21 +16090,23 @@ dumpRule(Archive *fout, RuleInfo *rinfo) appendPQExpBuffer(labelq, " ON %s", fmtId(tbinfo->dobj.name)); - ArchiveEntry(fout, rinfo->dobj.catId, rinfo->dobj.dumpId, - rinfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, false, - "RULE", SECTION_POST_DATA, - cmd->data, delcmd->data, NULL, - NULL, 0, - NULL, NULL); + if (rinfo->dobj.dump & DUMP_COMPONENT_DEFINITION) + ArchiveEntry(fout, rinfo->dobj.catId, rinfo->dobj.dumpId, + rinfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, false, + "RULE", SECTION_POST_DATA, + cmd->data, delcmd->data, NULL, + NULL, 0, + NULL, NULL); /* Dump rule comments */ - dumpComment(fout, labelq->data, - tbinfo->dobj.namespace->dobj.name, - tbinfo->rolname, - rinfo->dobj.catId, 0, rinfo->dobj.dumpId); + if (rinfo->dobj.dump & DUMP_COMPONENT_COMMENT) + dumpComment(fout, labelq->data, + tbinfo->dobj.namespace->dobj.name, + tbinfo->rolname, + rinfo->dobj.catId, 0, rinfo->dobj.dumpId); PQclear(res); @@ -16146,7 +16280,8 @@ processExtensionTables(Archive *fout, ExtensionInfo extinfo[], { TableInfo *configtbl; Oid configtbloid = atooid(extconfigarray[j]); - bool dumpobj = curext->dobj.dump; + bool dumpobj = + curext->dobj.dump & DUMP_COMPONENT_DEFINITION; configtbl = findTableByOid(configtbloid); if (configtbl == NULL) @@ -16156,7 +16291,7 @@ processExtensionTables(Archive *fout, ExtensionInfo extinfo[], * Tables of not-to-be-dumped extensions shouldn't be dumped * unless the table or its schema is explicitly included */ - if (!curext->dobj.dump) + if (!(curext->dobj.dump & DUMP_COMPONENT_DEFINITION)) { /* check table explicitly requested */ if (table_include_oids.head != NULL && @@ -16165,7 +16300,8 @@ processExtensionTables(Archive *fout, ExtensionInfo extinfo[], dumpobj = true; /* check table's schema explicitly requested */ - if (configtbl->dobj.namespace->dobj.dump) + if (configtbl->dobj.namespace->dobj.dump & + DUMP_COMPONENT_DATA) dumpobj = true; } diff --git a/src/bin/pg_dump/pg_dump.h b/src/bin/pg_dump/pg_dump.h index c02c536..f479c06 100644 --- a/src/bin/pg_dump/pg_dump.h +++ b/src/bin/pg_dump/pg_dump.h @@ -81,6 +81,18 @@ typedef enum DO_POLICY } DumpableObjectType; +/* component types of an object which can be selected for dumping */ +typedef uint32 DumpComponents; /* a bitmask of dump object components */ +#define DUMP_COMPONENT_NONE (0) +#define DUMP_COMPONENT_DEFINITION (1 << 0) +#define DUMP_COMPONENT_DATA (1 << 1) +#define DUMP_COMPONENT_COMMENT (1 << 2) +#define DUMP_COMPONENT_SECLABEL (1 << 3) +#define DUMP_COMPONENT_ACL (1 << 4) +#define DUMP_COMPONENT_POLICY (1 << 5) +#define DUMP_COMPONENT_USERMAP (1 << 6) +#define DUMP_COMPONENT_ALL (0xFFFF) + typedef struct _dumpableObject { DumpableObjectType objType; @@ -88,7 +100,7 @@ typedef struct _dumpableObject DumpId dumpId; /* assigned by AssignDumpId() */ char *name; /* object name (should never be NULL) */ struct _namespaceInfo *namespace; /* containing namespace, or NULL */ - bool dump; /* true if we want to dump this object */ + DumpComponents dump; /* bitmask of components to dump */ bool ext_member; /* true if object is member of extension */ DumpId *dependencies; /* dumpIds of objects this one depends on */ int nDeps; /* number of valid dependencies */ -- 2.5.0 From 1968c2c7dd3950c824453ac9dac0049382aab30f Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Sun, 13 Mar 2016 11:44:21 -0400 Subject: [PATCH 3/5] In pg_dump, split "dump" into "dump" and "dump_contains" Historically, the "dump" component of the namespace has been used to decide if the objects inside of the namespace should be dumped also. Given that "dump" is now a bitmask and may be partial, and we may want to dump out all components of the namespace object but only some of the components of objects contained in the namespace, create a "dump_contains" bitmask which will represent what components of the objects inside of a namespace should be dumped out. No behavior change here, but in preparation for a change where we will dump out just the ACLs of objects in pg_catalog, but we might not dump out the ACL of the pg_catalog namespace itself (for instance, when it hasn't been changed from the value set at initdb time). --- src/bin/pg_dump/pg_dump.c | 21 ++++++++++++--------- src/bin/pg_dump/pg_dump.h | 3 ++- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c index 5fa9992..650c17a 100644 --- a/src/bin/pg_dump/pg_dump.c +++ b/src/bin/pg_dump/pg_dump.c @@ -1311,24 +1311,25 @@ selectDumpableNamespace(NamespaceInfo *nsinfo, DumpOptions *dopt) */ if (table_include_oids.head != NULL) - nsinfo->dobj.dump = DUMP_COMPONENT_NONE; + nsinfo->dobj.dump_contains = nsinfo->dobj.dump = DUMP_COMPONENT_NONE; else if (schema_include_oids.head != NULL) - nsinfo->dobj.dump = simple_oid_list_member(&schema_include_oids, + nsinfo->dobj.dump_contains = nsinfo->dobj.dump = + simple_oid_list_member(&schema_include_oids, nsinfo->dobj.catId.oid) ? DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; else if (strncmp(nsinfo->dobj.name, "pg_", 3) == 0 || strcmp(nsinfo->dobj.name, "information_schema") == 0) - nsinfo->dobj.dump = DUMP_COMPONENT_NONE; + nsinfo->dobj.dump_contains = nsinfo->dobj.dump = DUMP_COMPONENT_NONE; else - nsinfo->dobj.dump = DUMP_COMPONENT_ALL; + nsinfo->dobj.dump_contains = nsinfo->dobj.dump = DUMP_COMPONENT_ALL; /* * In any case, a namespace can be excluded by an exclusion switch */ - if (nsinfo->dobj.dump && + if (nsinfo->dobj.dump_contains && simple_oid_list_member(&schema_exclude_oids, nsinfo->dobj.catId.oid)) - nsinfo->dobj.dump = DUMP_COMPONENT_NONE; + nsinfo->dobj.dump_contains = nsinfo->dobj.dump = DUMP_COMPONENT_NONE; } /* @@ -1350,7 +1351,7 @@ selectDumpableTable(TableInfo *tbinfo, DumpOptions *dopt) tbinfo->dobj.catId.oid) ? DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; else - tbinfo->dobj.dump = tbinfo->dobj.namespace->dobj.dump; + tbinfo->dobj.dump = tbinfo->dobj.namespace->dobj.dump_contains; /* * In any case, a table can be excluded by an exclusion switch @@ -1407,7 +1408,8 @@ selectDumpableType(TypeInfo *tyinfo, DumpOptions *dopt) if (checkExtensionMembership(&tyinfo->dobj, dopt)) return; /* extension membership overrides all else */ - tyinfo->dobj.dump = tyinfo->dobj.namespace->dobj.dump; + /* Dump based on if the contents of the namespace are being dumped */ + tyinfo->dobj.dump = tyinfo->dobj.namespace->dobj.dump_contains; } /* @@ -1424,6 +1426,7 @@ selectDumpableDefaultACL(DefaultACLInfo *dinfo, DumpOptions *dopt) /* Default ACLs can't be extension members */ if (dinfo->dobj.namespace) + /* default ACLs are considered part of the namespace */ dinfo->dobj.dump = dinfo->dobj.namespace->dobj.dump; else dinfo->dobj.dump = dopt->include_everything ? @@ -1530,7 +1533,7 @@ selectDumpableObject(DumpableObject *dobj, DumpOptions *dopt) * non-namespace-associated items, dump if we're dumping "everything". */ if (dobj->namespace) - dobj->dump = dobj->namespace->dobj.dump; + dobj->dump = dobj->namespace->dobj.dump_contains; else dobj->dump = dopt->include_everything ? DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; diff --git a/src/bin/pg_dump/pg_dump.h b/src/bin/pg_dump/pg_dump.h index f479c06..85f9f48 100644 --- a/src/bin/pg_dump/pg_dump.h +++ b/src/bin/pg_dump/pg_dump.h @@ -100,7 +100,8 @@ typedef struct _dumpableObject DumpId dumpId; /* assigned by AssignDumpId() */ char *name; /* object name (should never be NULL) */ struct _namespaceInfo *namespace; /* containing namespace, or NULL */ - DumpComponents dump; /* bitmask of components to dump */ + DumpComponents dump; /* bitmask of components to dump */ + DumpComponents dump_contains; /* as above, but for contained objects */ bool ext_member; /* true if object is member of extension */ DumpId *dependencies; /* dumpIds of objects this one depends on */ int nDeps; /* number of valid dependencies */ -- 2.5.0 From 0add15144a5d5f8ca451423332d2d1b0c4545e70 Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Sun, 13 Mar 2016 12:43:24 -0400 Subject: [PATCH 4/5] In pg_dump, include pg_catalog and extension ACLs, if changed Now that all of the infrastructure exists, add in the ability to dump out the ACLs of the objects inside of pg_catalog or the ACLs for objects which are members of extensions, but only if they have been changed from their original values. The original values are tracked in pg_init_privs. When pg_dump'ing 9.6-and-above databases, we will dump out the ACLs for all objects in pg_catalog and the ACLs for all extension members, where the ACL has been changed from the original value which was set during either initdb or CREATE EXTENSION. This should not change dumps against pre-9.6 databases. --- doc/src/sgml/extend.sgml | 21 + src/backend/catalog/aclchk.c | 17 +- src/backend/utils/adt/pg_upgrade_support.c | 12 + src/bin/initdb/initdb.c | 6 +- src/bin/pg_dump/dumputils.c | 274 ++++++- src/bin/pg_dump/dumputils.h | 9 +- src/bin/pg_dump/pg_dump.c | 1179 ++++++++++++++++++++++------ src/bin/pg_dump/pg_dump.h | 24 + src/bin/pg_dump/pg_dumpall.c | 6 +- src/include/catalog/binary_upgrade.h | 2 + src/include/catalog/pg_proc.h | 2 + src/test/regress/expected/init_privs.out | 13 + src/test/regress/parallel_schedule | 2 +- src/test/regress/serial_schedule | 1 + src/test/regress/sql/init_privs.sql | 11 + 15 files changed, 1319 insertions(+), 260 deletions(-) create mode 100644 src/test/regress/expected/init_privs.out create mode 100644 src/test/regress/sql/init_privs.sql diff --git a/doc/src/sgml/extend.sgml b/doc/src/sgml/extend.sgml index 4a88381..df3b9d9 100644 --- a/doc/src/sgml/extend.sgml +++ b/doc/src/sgml/extend.sgml @@ -339,6 +339,27 @@ + The extension script may set privileges on objects which are part of the + extension via GRANT and REVOKE + statements. The final set of privileges for each object (if any are set) + will be stored in the + pg_init_privs + system catalog. When pg_dump is used, the + CREATE EXTENSION command will be included in the dump, followed + by the set of GRANT and REVOKE + statements necessary to set the privileges on the objects to what they were + at the time the dump was taken. + + + + PostgreSQL does not currently support extension scripts + issuing CREATE POLICY or SECURITY LABEL + statements. These are expected to be set after the extension has been + created. All RLS policies and security labels on extension objects will be + included in dumps created by pg_dump. + + + The extension mechanism also has provisions for packaging modification scripts that adjust the definitions of the SQL objects contained in an extension. For example, if version 1.1 of an extension adds one function diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c index ffb6678..975fe13 100644 --- a/src/backend/catalog/aclchk.c +++ b/src/backend/catalog/aclchk.c @@ -22,6 +22,7 @@ #include "access/htup_details.h" #include "access/sysattr.h" #include "access/xact.h" +#include "catalog/binary_upgrade.h" #include "catalog/catalog.h" #include "catalog/dependency.h" #include "catalog/indexing.h" @@ -85,6 +86,12 @@ typedef struct DropBehavior behavior; } InternalDefaultACL; +/* + * When performing a binary-upgrade, pg_dump will call a function to set + * this variable to let us know that we need to populate the pg_init_privs + * table for the GRANT/REVOKE commands while this variable is set to true. + */ +bool binary_upgrade_record_init_privs = false; static void ExecGrantStmt_oids(InternalGrant *istmt); static void ExecGrant_Relation(InternalGrant *grantStmt); @@ -5237,7 +5244,15 @@ recordExtensionInitPriv(Oid objoid, Oid classoid, int objsubid, Acl *new_acl) HeapTuple tuple; HeapTuple oldtuple; - if (!creating_extension) + /* + * Generally, we only record the initial privileges when an extension is + * being created, but because we don't actually use CREATE EXTENSION + * during binary upgrades with pg_upgrade, there is a variable to let us + * know that the GRANT and REVOKE statements being issued, while this + * variable is true, are for the initial privileges of the extension + * object and therefore we need to record them. + */ + if (!creating_extension && !binary_upgrade_record_init_privs) return; relation = heap_open(InitPrivsRelationId, RowExclusiveLock); diff --git a/src/backend/utils/adt/pg_upgrade_support.c b/src/backend/utils/adt/pg_upgrade_support.c index 912eada..6ff035a 100644 --- a/src/backend/utils/adt/pg_upgrade_support.c +++ b/src/backend/utils/adt/pg_upgrade_support.c @@ -29,6 +29,7 @@ Datum binary_upgrade_set_next_toast_pg_class_oid(PG_FUNCTION_ARGS); Datum binary_upgrade_set_next_pg_enum_oid(PG_FUNCTION_ARGS); Datum binary_upgrade_set_next_pg_authid_oid(PG_FUNCTION_ARGS); Datum binary_upgrade_create_empty_extension(PG_FUNCTION_ARGS); +Datum binary_upgrade_set_record_init_privs(PG_FUNCTION_ARGS); #define CHECK_IS_BINARY_UPGRADE \ @@ -193,3 +194,14 @@ binary_upgrade_create_empty_extension(PG_FUNCTION_ARGS) PG_RETURN_VOID(); } + +Datum +binary_upgrade_set_record_init_privs(PG_FUNCTION_ARGS) +{ + bool record_init_privs = PG_GETARG_BOOL(0); + + CHECK_IS_BINARY_UPGRADE; + binary_upgrade_record_init_privs = record_init_privs; + + PG_RETURN_VOID(); +} diff --git a/src/bin/initdb/initdb.c b/src/bin/initdb/initdb.c index 858667b..18a3826 100644 --- a/src/bin/initdb/initdb.c +++ b/src/bin/initdb/initdb.c @@ -2002,7 +2002,11 @@ setup_privileges(FILE *cmdfd) char **priv_lines; static char *privileges_setup[] = { "UPDATE pg_class " - " SET relacl = E'{\"=r/\\\\\"$POSTGRES_SUPERUSERNAME\\\\\"\"}' " + " SET relacl = (SELECT array_agg(a.acl) FROM " + " (SELECT E'=r/\"$POSTGRES_SUPERUSERNAME\"' as acl " + " UNION SELECT unnest(pg_catalog.acldefault(" + " CASE WHEN relkind = 'S' THEN 's' ELSE 'r' END::\"char\",10::oid))" + " ) as a) " " WHERE relkind IN ('r', 'v', 'm', 'S') AND relacl IS NULL;\n\n", "GRANT USAGE ON SCHEMA pg_catalog TO PUBLIC;\n\n", "GRANT CREATE, USAGE ON SCHEMA public TO PUBLIC;\n\n", diff --git a/src/bin/pg_dump/dumputils.c b/src/bin/pg_dump/dumputils.c index 5301d3f..c55a2fa 100644 --- a/src/bin/pg_dump/dumputils.c +++ b/src/bin/pg_dump/dumputils.c @@ -38,6 +38,7 @@ static void AddAcl(PQExpBuffer aclbuf, const char *keyword, * TABLE, SEQUENCE, FUNCTION, LANGUAGE, SCHEMA, DATABASE, TABLESPACE, * FOREIGN DATA WRAPPER, SERVER, or LARGE OBJECT) * acls: the ACL string fetched from the database + * racls: the ACL string of any initial-but-now-revoked privileges * owner: username of object owner (will be passed through fmtId); can be * NULL or empty string to indicate "no owner known" * prefix: string to prefix to each generated command; typically empty @@ -54,13 +55,15 @@ static void AddAcl(PQExpBuffer aclbuf, const char *keyword, */ bool buildACLCommands(const char *name, const char *subname, - const char *type, const char *acls, const char *owner, - const char *prefix, int remoteVersion, + const char *type, const char *acls, const char *racls, + const char *owner, const char *prefix, int remoteVersion, PQExpBuffer sql) { bool ok = true; - char **aclitems; - int naclitems; + char **aclitems = NULL; + char **raclitems = NULL; + int naclitems = 0; + int nraclitems = 0; int i; PQExpBuffer grantee, grantor, @@ -70,18 +73,31 @@ buildACLCommands(const char *name, const char *subname, secondsql; bool found_owner_privs = false; - if (strlen(acls) == 0) + if (strlen(acls) == 0 && strlen(racls) == 0) return true; /* object has default permissions */ /* treat empty-string owner same as NULL */ if (owner && *owner == '\0') owner = NULL; - if (!parsePGArray(acls, &aclitems, &naclitems)) + if (strlen(acls) != 0) { - if (aclitems) - free(aclitems); - return false; + if (!parsePGArray(acls, &aclitems, &naclitems)) + { + if (aclitems) + free(aclitems); + return false; + } + } + + if (strlen(racls) != 0) + { + if (!parsePGArray(racls, &raclitems, &nraclitems)) + { + if (raclitems) + free(raclitems); + return false; + } } grantee = createPQExpBuffer(); @@ -90,24 +106,101 @@ buildACLCommands(const char *name, const char *subname, privswgo = createPQExpBuffer(); /* - * At the end, these two will be pasted together to form the result. But - * the owner privileges need to go before the other ones to keep the - * dependencies valid. In recent versions this is normally the case, but - * in old versions they come after the PUBLIC privileges and that results - * in problems if we need to run REVOKE on the owner privileges. + * At the end, these two will be pasted together to form the result. + * + * For older systems we use these to ensure that the owner privileges go + * before the other ones, as a GRANT could create the default entry for + * the object, which generally includes all rights for the owner. In more + * recent versions we normally handle this because the owner rights come + * first in the ACLs, but older versions might have them after the PUBLIC + * privileges. + * + * For 9.6 and later systems, much of this changes. With 9.6, we check + * the default privileges for the objects at dump time and create two sets + * of ACLs- "racls" which are the ACLs to REVOKE from the object (as the + * object may have initial privileges on it, along with any default ACLs + * which are not part of the current set of privileges), and regular + * "acls", which are the ACLs to GRANT to the object. We handle the + * REVOKEs first, followed by the GRANTs. */ firstsql = createPQExpBuffer(); secondsql = createPQExpBuffer(); /* - * Always start with REVOKE ALL FROM PUBLIC, so that we don't have to - * wire-in knowledge about the default public privileges for different - * kinds of objects. + * For pre-9.6 systems, we always start with REVOKE ALL FROM PUBLIC, as we + * don't wish to make any assumptions about what the default ACLs are, and + * we do not collect them during the dump phase (and racls will always be + * the empty set, see above). + * + * For 9.6 and later, if any revoke ACLs have been provided, then include + * them in 'firstsql'. + * + * Revoke ACLs happen when an object starts out life with a set of + * privileges (eg: GRANT SELECT ON pg_class TO PUBLIC;) and the user has + * decided to revoke those rights. Since those objects come into being + * with those default privileges, we have to revoke them to match what the + * current state of affairs is. Note that we only started explicitly + * tracking such initial rights in 9.6, and prior to that all initial + * rights are actually handled by the simple 'REVOKE ALL .. FROM PUBLIC' + * case, for initdb-created objects. Prior to 9.6, we didn't handle + * extensions correctly, but we do now by tracking their initial + * privileges, in the same way we track initdb initial privileges, see + * pg_init_privs. */ - appendPQExpBuffer(firstsql, "%sREVOKE ALL", prefix); - if (subname) - appendPQExpBuffer(firstsql, "(%s)", subname); - appendPQExpBuffer(firstsql, " ON %s %s FROM PUBLIC;\n", type, name); + if (remoteVersion < 90600) + { + Assert(nraclitems == 0); + + appendPQExpBuffer(firstsql, "%sREVOKE ALL", prefix); + if (subname) + appendPQExpBuffer(firstsql, "(%s)", subname); + appendPQExpBuffer(firstsql, " ON %s %s FROM PUBLIC;\n", type, name); + } + else + { + /* Scan individual REVOKE ACL items */ + for (i = 0; i < nraclitems; i++) + { + if (!parseAclItem(raclitems[i], type, name, subname, remoteVersion, + grantee, grantor, privs, privswgo)) + { + ok = false; + break; + } + + if (privs->len > 0 || privswgo->len > 0) + { + if (privs->len > 0) + { + appendPQExpBuffer(firstsql, "%sREVOKE %s ON %s %s FROM ", + prefix, privs->data, type, name); + if (grantee->len == 0) + appendPQExpBufferStr(firstsql, "PUBLIC;\n"); + else if (strncmp(grantee->data, "group ", + strlen("group ")) == 0) + appendPQExpBuffer(firstsql, "GROUP %s;\n", + fmtId(grantee->data + strlen("group "))); + else + appendPQExpBuffer(firstsql, "%s;\n", + fmtId(grantee->data)); + } + if (privswgo->len > 0) + { + appendPQExpBuffer(firstsql, + "%sREVOKE GRANT OPTION FOR %s ON %s %s FROM ", + prefix, privswgo->data, type, name); + if (grantee->len == 0) + appendPQExpBufferStr(firstsql, "PUBLIC"); + else if (strncmp(grantee->data, "group ", + strlen("group ")) == 0) + appendPQExpBuffer(firstsql, "GROUP %s", + fmtId(grantee->data + strlen("group "))); + else + appendPQExpBufferStr(firstsql, fmtId(grantee->data)); + } + } + } + } /* * We still need some hacking though to cover the case where new default @@ -138,7 +231,14 @@ buildACLCommands(const char *name, const char *subname, if (privs->len > 0 || privswgo->len > 0) { - if (owner + /* + * Prior to 9.6, we had to handle owner privileges in a special + * manner by first REVOKE'ing the rights and then GRANT'ing them + * after. With 9.6 and above, what we need to REVOKE and what we + * need to GRANT is figured out when we dump and stashed into + * "racls" and "acls", respectivly. See above. + */ + if (remoteVersion < 90600 && owner && strcmp(grantee->data, owner) == 0 && strcmp(grantor->data, owner) == 0) { @@ -172,7 +272,14 @@ buildACLCommands(const char *name, const char *subname, else { /* - * Otherwise can assume we are starting from no privs. + * For systems prior to 9.6, we can assume we are starting + * from no privs at this point. + * + * For 9.6 and above, at this point we have issued REVOKE + * statements for all initial and default privileges which are + * no longer present on the object (as they were passed in as + * 'racls') and we can simply GRANT the rights which are in + * 'acls'. */ if (grantor->len > 0 && (!owner || strcmp(owner, grantor->data) != 0)) @@ -215,9 +322,12 @@ buildACLCommands(const char *name, const char *subname, } /* - * If we didn't find any owner privs, the owner must have revoked 'em all + * For systems prior to 9.6, if we didn't find any owner privs, the owner + * must have revoked 'em all. + * + * For 9.6 and above, we handle this through the 'racls'. See above. */ - if (!found_owner_privs && owner) + if (remoteVersion < 90600 && !found_owner_privs && owner) { appendPQExpBuffer(firstsql, "%sREVOKE ALL", prefix); if (subname) @@ -235,7 +345,11 @@ buildACLCommands(const char *name, const char *subname, destroyPQExpBuffer(firstsql); destroyPQExpBuffer(secondsql); - free(aclitems); + if (aclitems) + free(aclitems); + + if (raclitems) + free(raclitems); return ok; } @@ -275,7 +389,7 @@ buildDefaultACLCommands(const char *type, const char *nspname, appendPQExpBuffer(prefix, "IN SCHEMA %s ", fmtId(nspname)); result = buildACLCommands("", NULL, - type, acls, owner, + type, acls, "", owner, prefix->data, remoteVersion, sql); @@ -555,3 +669,109 @@ emitShSecLabels(PGconn *conn, PGresult *res, PQExpBuffer buffer, appendPQExpBufferStr(buffer, ";\n"); } } + +/* + * buildACLQueries + * + * Build the subqueries to extract out the correct set of ACLs to be + * GRANT'd and REVOKE'd for the specific kind of object, accounting for any + * initial privileges (from pg_init_privs) and based on if we are in binary + * upgrade mode or not. + * + * Also builds subqueries to extract out the set of ACLs to go from the object + * default privileges to the privileges in pg_init_privs, if we are in binary + * upgrade mode, so that those privileges can be set up and recorded in the new + * cluster before the regular privileges are added on top of those. + */ +void +buildACLQueries(PQExpBuffer acl_subquery, PQExpBuffer racl_subquery, + PQExpBuffer init_acl_subquery, PQExpBuffer init_racl_subquery, + const char *acl_column, const char *acl_owner, + const char *obj_kind, bool binary_upgrade) +{ + /* + * To get the delta from what the permissions were at creation time + * (either initdb or CREATE EXTENSION) vs. what they are now, we have to + * look at two things: + * + * What privileges have been added, which we calculate by extracting all + * the current privileges (using the set of default privileges for the + * object type if current privileges are NULL) and then removing those + * which existed at creation time (again, using the set of default + * privileges for the object type if there were no creation time + * privileges). + * + * What privileges have been removed, which we calculate by extracting the + * privileges as they were at creation time (or the default privileges, as + * above), and then removing the current privileges (or the default + * privileges, if current privileges are NULL). + * + * As a good cross-check, both directions of these checks should result in + * the empty set if both the current ACL and the initial privs are NULL + * (meaning, in practice, that the default ACLs were there at init time + * and is what the current privileges are). + * + * We always perform this delta on all ACLs and expect that by the time + * these are run the initial privileges will be in place, even in a + * binary upgrade situation (see below). + */ + printfPQExpBuffer(acl_subquery, "(SELECT array_agg(acl) FROM " + "(SELECT unnest(coalesce(%s,acldefault(%s,%s))) AS acl " + "EXCEPT " + "SELECT unnest(coalesce(pip.initprivs,acldefault(%s,%s)))) as foo)", + acl_column, + obj_kind, + acl_owner, + obj_kind, + acl_owner); + + printfPQExpBuffer(racl_subquery, "(SELECT array_agg(acl) FROM " + "(SELECT unnest(coalesce(pip.initprivs,acldefault(%s,%s))) AS acl " + "EXCEPT " + "SELECT unnest(coalesce(%s,acldefault(%s,%s)))) as foo)", + obj_kind, + acl_owner, + acl_column, + obj_kind, + acl_owner); + + /* + * In binary upgrade mode we don't run the extension script but instead + * dump out the objects independently and then recreate them. To preserve + * the initial privileges which were set on extension objects, we need to + * grab the set of GRANT and REVOKE commands necessary to get from the + * default privileges of an object to the initial privileges as recorded + * in pg_init_privs. + * + * These will then be run ahead of the regular ACL commands, which were + * calculated using the queries above, inside of a block which sets a flag + * to indicate that the backend should record the results of these GRANT + * and REVOKE statements into pg_init_privs. This is how we preserve the + * contents of that catalog across binary upgrades. + */ + if (binary_upgrade) + { + printfPQExpBuffer(init_acl_subquery, + "CASE WHEN privtype = 'e' THEN " + "(SELECT array_agg(acl) FROM " + "(SELECT unnest(pip.initprivs) AS acl " + "EXCEPT " + "SELECT unnest(acldefault(%s,%s))) as foo) END", + obj_kind, + acl_owner); + + printfPQExpBuffer(init_racl_subquery, + "CASE WHEN privtype = 'e' THEN " + "(SELECT array_agg(acl) FROM " + "(SELECT unnest(acldefault(%s,%s)) AS acl " + "EXCEPT " + "SELECT unnest(pip.initprivs)) as foo) END", + obj_kind, + acl_owner); + } + else + { + printfPQExpBuffer(init_acl_subquery, "NULL"); + printfPQExpBuffer(init_racl_subquery, "NULL"); + } +} diff --git a/src/bin/pg_dump/dumputils.h b/src/bin/pg_dump/dumputils.h index 4b404be..b2fd7d3 100644 --- a/src/bin/pg_dump/dumputils.h +++ b/src/bin/pg_dump/dumputils.h @@ -37,8 +37,8 @@ extern bool buildACLCommands(const char *name, const char *subname, - const char *type, const char *acls, const char *owner, - const char *prefix, int remoteVersion, + const char *type, const char *acls, const char *racls, + const char *owner, const char *prefix, int remoteVersion, PQExpBuffer sql); extern bool buildDefaultACLCommands(const char *type, const char *nspname, const char *acls, const char *owner, @@ -49,4 +49,9 @@ extern void buildShSecLabelQuery(PGconn *conn, const char *catalog_name, extern void emitShSecLabels(PGconn *conn, PGresult *res, PQExpBuffer buffer, const char *target, const char *objname); +extern void buildACLQueries(PQExpBuffer acl_subquery, PQExpBuffer racl_subquery, + PQExpBuffer init_acl_subquery, PQExpBuffer init_racl_subquery, + const char *acl_column, const char *acl_owner, + const char *obj_kind, bool binary_upgrade); + #endif /* DUMPUTILS_H */ diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c index 650c17a..7e94b0e 100644 --- a/src/bin/pg_dump/pg_dump.c +++ b/src/bin/pg_dump/pg_dump.c @@ -206,7 +206,8 @@ static void dumpDefaultACL(Archive *fout, DefaultACLInfo *daclinfo); static void dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId, const char *type, const char *name, const char *subname, const char *tag, const char *nspname, const char *owner, - const char *acls); + const char *acls, const char *racls, + const char *initacls, const char *initracls); static void getDependencies(Archive *fout); static void BuildArchiveDependencies(Archive *fout); @@ -1268,7 +1269,7 @@ expand_table_name_patterns(Archive *fout, * Returns true if object is an extension member, else false. */ static bool -checkExtensionMembership(DumpableObject *dobj, DumpOptions *dopt) +checkExtensionMembership(DumpableObject *dobj, Archive *fout) { ExtensionInfo *ext = findOwningExtension(dobj->catId); @@ -1281,12 +1282,26 @@ checkExtensionMembership(DumpableObject *dobj, DumpOptions *dopt) addObjectDependency(dobj, ext->dobj.dumpId); /* - * Normally, mark the member object as not to be dumped. But in binary - * upgrades, we still dump the members individually, since the idea is to - * exactly reproduce the database contents rather than replace the - * extension contents with something different. + * In 9.6 and above, mark the member object to have any non-initial ACL, + * policies, and security lables dumped. + * + * Note that any initial ACLs (see pg_init_privs) will be removed when we + * extract the information about the object. We don't provide support for + * initial policies and security labels and it seems unlikely for those to + * ever exist, but we may have to revisit this later. + * + * Prior to 9.6, we do not include any extension member components. + * + * In binary upgrades, we still dump all components of the members + * individually, since the idea is to exactly reproduce the database + * contents rather than replace the extension contents with something + * different. */ - if (!dopt->binary_upgrade) + if (!fout->dopt->binary_upgrade && fout->remoteVersion >= 90600) + dobj->dump = DUMP_COMPONENT_ACL | + DUMP_COMPONENT_SECLABEL | + DUMP_COMPONENT_POLICY; + else if (!fout->dopt->binary_upgrade) dobj->dump = DUMP_COMPONENT_NONE; else dobj->dump = ext->dobj.dump; @@ -1299,9 +1314,9 @@ checkExtensionMembership(DumpableObject *dobj, DumpOptions *dopt) * Mark a namespace as to be dumped or not */ static void -selectDumpableNamespace(NamespaceInfo *nsinfo, DumpOptions *dopt) +selectDumpableNamespace(NamespaceInfo *nsinfo, Archive *fout) { - if (checkExtensionMembership(&nsinfo->dobj, dopt)) + if (checkExtensionMembership(&nsinfo->dobj, fout)) return; /* extension membership overrides all else */ /* @@ -1316,7 +1331,17 @@ selectDumpableNamespace(NamespaceInfo *nsinfo, DumpOptions *dopt) nsinfo->dobj.dump_contains = nsinfo->dobj.dump = simple_oid_list_member(&schema_include_oids, nsinfo->dobj.catId.oid) ? - DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; + else if (fout->remoteVersion >= 90600 && + strncmp(nsinfo->dobj.name, "pg_catalog", + strlen("pg_catalog")) == 0) + + /* + * In 9.6 and above, we dump out any ACLs defined in pg_catalog, if + * they are interesting (and not the original ACLs which were set at + * initdb time, see pg_init_privs). + */ + nsinfo->dobj.dump_contains = nsinfo->dobj.dump = DUMP_COMPONENT_ACL; else if (strncmp(nsinfo->dobj.name, "pg_", 3) == 0 || strcmp(nsinfo->dobj.name, "information_schema") == 0) nsinfo->dobj.dump_contains = nsinfo->dobj.dump = DUMP_COMPONENT_NONE; @@ -1337,9 +1362,9 @@ selectDumpableNamespace(NamespaceInfo *nsinfo, DumpOptions *dopt) * Mark a table as to be dumped or not */ static void -selectDumpableTable(TableInfo *tbinfo, DumpOptions *dopt) +selectDumpableTable(TableInfo *tbinfo, Archive *fout) { - if (checkExtensionMembership(&tbinfo->dobj, dopt)) + if (checkExtensionMembership(&tbinfo->dobj, fout)) return; /* extension membership overrides all else */ /* @@ -1349,7 +1374,7 @@ selectDumpableTable(TableInfo *tbinfo, DumpOptions *dopt) if (table_include_oids.head != NULL) tbinfo->dobj.dump = simple_oid_list_member(&table_include_oids, tbinfo->dobj.catId.oid) ? - DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; else tbinfo->dobj.dump = tbinfo->dobj.namespace->dobj.dump_contains; @@ -1376,7 +1401,7 @@ selectDumpableTable(TableInfo *tbinfo, DumpOptions *dopt) * object (the table or base type). */ static void -selectDumpableType(TypeInfo *tyinfo, DumpOptions *dopt) +selectDumpableType(TypeInfo *tyinfo, Archive *fout) { /* skip complex types, except for standalone composite types */ if (OidIsValid(tyinfo->typrelid) && @@ -1405,7 +1430,7 @@ selectDumpableType(TypeInfo *tyinfo, DumpOptions *dopt) */ } - if (checkExtensionMembership(&tyinfo->dobj, dopt)) + if (checkExtensionMembership(&tyinfo->dobj, fout)) return; /* extension membership overrides all else */ /* Dump based on if the contents of the namespace are being dumped */ @@ -1443,15 +1468,15 @@ selectDumpableDefaultACL(DefaultACLInfo *dinfo, DumpOptions *dopt) * OID is in the range reserved for initdb. */ static void -selectDumpableCast(CastInfo *cast, DumpOptions *dopt) +selectDumpableCast(CastInfo *cast, Archive *fout) { - if (checkExtensionMembership(&cast->dobj, dopt)) + if (checkExtensionMembership(&cast->dobj, fout)) return; /* extension membership overrides all else */ if (cast->dobj.catId.oid < (Oid) FirstNormalObjectId) cast->dobj.dump = DUMP_COMPONENT_NONE; else - cast->dobj.dump = dopt->include_everything ? + cast->dobj.dump = fout->dopt->include_everything ? DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } @@ -1464,15 +1489,15 @@ selectDumpableCast(CastInfo *cast, DumpOptions *dopt) * language's OID is in the range reserved for initdb. */ static void -selectDumpableProcLang(ProcLangInfo *plang, DumpOptions *dopt) +selectDumpableProcLang(ProcLangInfo *plang, Archive *fout) { - if (checkExtensionMembership(&plang->dobj, dopt)) + if (checkExtensionMembership(&plang->dobj, fout)) return; /* extension membership overrides all else */ if (plang->dobj.catId.oid < (Oid) FirstNormalObjectId) plang->dobj.dump = DUMP_COMPONENT_NONE; else - plang->dobj.dump = dopt->include_everything ? + plang->dobj.dump = fout->dopt->include_everything ? DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } @@ -1485,15 +1510,16 @@ selectDumpableProcLang(ProcLangInfo *plang, DumpOptions *dopt) * method's OID is in the range reserved for initdb. */ static void -selectDumpableAccessMethod(AccessMethodInfo *method, DumpOptions *dopt) +selectDumpableAccessMethod(AccessMethodInfo *method, Archive *fout) { - if (checkExtensionMembership(&method->dobj, dopt)) + if (checkExtensionMembership(&method->dobj, fout)) return; /* extension membership overrides all else */ if (method->dobj.catId.oid < (Oid) FirstNormalObjectId) - method->dobj.dump = false; + method->dobj.dump = DUMP_COMPONENT_NONE; else - method->dobj.dump = dopt->include_everything; + method->dobj.dump = fout->dopt->include_everything ? + DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } /* @@ -1523,9 +1549,9 @@ selectDumpableExtension(ExtensionInfo *extinfo, DumpOptions *dopt) * Use this only for object types without a special-case routine above. */ static void -selectDumpableObject(DumpableObject *dobj, DumpOptions *dopt) +selectDumpableObject(DumpableObject *dobj, Archive *fout) { - if (checkExtensionMembership(dobj, dopt)) + if (checkExtensionMembership(dobj, fout)) return; /* extension membership overrides all else */ /* @@ -1535,7 +1561,7 @@ selectDumpableObject(DumpableObject *dobj, DumpOptions *dopt) if (dobj->namespace) dobj->dump = dobj->namespace->dobj.dump_contains; else - dobj->dump = dopt->include_everything ? + dobj->dump = fout->dopt->include_everything ? DUMP_COMPONENT_ALL : DUMP_COMPONENT_NONE; } @@ -1978,22 +2004,22 @@ refreshMatViewData(Archive *fout, TableDataInfo *tdinfo) if (tdinfo->dobj.dump & DUMP_COMPONENT_DATA) ArchiveEntry(fout, - tdinfo->dobj.catId, /* catalog ID */ - tdinfo->dobj.dumpId, /* dump ID */ - tbinfo->dobj.name, /* Name */ - tbinfo->dobj.namespace->dobj.name, /* Namespace */ - NULL, /* Tablespace */ - tbinfo->rolname, /* Owner */ - false, /* with oids */ - "MATERIALIZED VIEW DATA", /* Desc */ - SECTION_POST_DATA, /* Section */ - q->data, /* Create */ - "", /* Del */ - NULL, /* Copy */ - tdinfo->dobj.dependencies, /* Deps */ - tdinfo->dobj.nDeps, /* # Deps */ - NULL, /* Dumper */ - NULL); /* Dumper Arg */ + tdinfo->dobj.catId, /* catalog ID */ + tdinfo->dobj.dumpId, /* dump ID */ + tbinfo->dobj.name, /* Name */ + tbinfo->dobj.namespace->dobj.name, /* Namespace */ + NULL, /* Tablespace */ + tbinfo->rolname, /* Owner */ + false, /* with oids */ + "MATERIALIZED VIEW DATA", /* Desc */ + SECTION_POST_DATA, /* Section */ + q->data, /* Create */ + "", /* Del */ + NULL, /* Copy */ + tdinfo->dobj.dependencies, /* Deps */ + tdinfo->dobj.nDeps, /* # Deps */ + NULL, /* Dumper */ + NULL); /* Dumper Arg */ destroyPQExpBuffer(q); } @@ -2729,12 +2755,19 @@ dumpStdStrings(Archive *AH) static void getBlobs(Archive *fout) { + DumpOptions *dopt = fout->dopt; PQExpBuffer blobQry = createPQExpBuffer(); BlobInfo *binfo; DumpableObject *bdata; PGresult *res; int ntups; int i; + int i_oid; + int i_lomowner; + int i_lomacl; + int i_rlomacl; + int i_initlomacl; + int i_initrlomacl; /* Verbose message */ if (g_verbose) @@ -2744,52 +2777,102 @@ getBlobs(Archive *fout) selectSourceSchema(fout, "pg_catalog"); /* Fetch BLOB OIDs, and owner/ACL data if >= 9.0 */ - if (fout->remoteVersion >= 90000) + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer init_acl_subquery = createPQExpBuffer(); + PQExpBuffer init_racl_subquery = createPQExpBuffer(); + + buildACLQueries(acl_subquery, racl_subquery, init_acl_subquery, + init_racl_subquery, "l.lomacl", "l.lomowner", "'L'", + dopt->binary_upgrade); + appendPQExpBuffer(blobQry, - "SELECT oid, (%s lomowner) AS rolname, lomacl" + "SELECT l.oid, (%s l.lomowner) AS rolname, " + "%s AS lomacl, " + "%s AS rlomacl, " + "%s AS initlomacl, " + "%s AS initrlomacl " + "FROM pg_largeobject_metadata l " + "LEFT JOIN pg_init_privs pip ON " + "(l.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_largeobject')" + "AND pip.objsubid = 0) ", + username_subquery, + acl_subquery->data, + racl_subquery->data, + init_acl_subquery->data, + init_racl_subquery->data); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(init_acl_subquery); + destroyPQExpBuffer(init_racl_subquery); + } + else if (fout->remoteVersion >= 90000) + appendPQExpBuffer(blobQry, + "SELECT oid, (%s lomowner) AS rolname, lomacl, " + "NULL AS rlomacl, NULL as initlomacl, " + "NULL as initrlomacl " " FROM pg_largeobject_metadata", username_subquery); else if (fout->remoteVersion >= 70100) appendPQExpBufferStr(blobQry, - "SELECT DISTINCT loid, NULL::oid, NULL::oid" + "SELECT DISTINCT loid, NULL::oid, NULL, " + "NULL AS rlomacl, NULL AS initlomacl, " + "NULL AS initrlomacl " " FROM pg_largeobject"); else appendPQExpBufferStr(blobQry, - "SELECT oid, NULL::oid, NULL::oid" + "SELECT oid, NULL::oid, NULL, " + "NULL AS rlomacl, NULL AS initlomacl, " + "NULL AS initrlomacl " " FROM pg_class WHERE relkind = 'l'"); res = ExecuteSqlQuery(fout, blobQry->data, PGRES_TUPLES_OK); + i_oid = PQfnumber(res, "oid"); + i_lomowner = PQfnumber(res, "rolname"); + i_lomacl = PQfnumber(res, "lomacl"); + i_rlomacl = PQfnumber(res, "rlomacl"); + i_initlomacl = PQfnumber(res, "initlomacl"); + i_initrlomacl = PQfnumber(res, "initrlomacl"); + ntups = PQntuples(res); - if (ntups > 0) + + /* + * Each large object has its own BLOB archive entry. + */ + binfo = (BlobInfo *) pg_malloc(ntups * sizeof(BlobInfo)); + + for (i = 0; i < ntups; i++) { - /* - * Each large object has its own BLOB archive entry. - */ - binfo = (BlobInfo *) pg_malloc(ntups * sizeof(BlobInfo)); + binfo[i].dobj.objType = DO_BLOB; + binfo[i].dobj.catId.tableoid = LargeObjectRelationId; + binfo[i].dobj.catId.oid = atooid(PQgetvalue(res, i, i_oid)); + AssignDumpId(&binfo[i].dobj); - for (i = 0; i < ntups; i++) - { - binfo[i].dobj.objType = DO_BLOB; - binfo[i].dobj.catId.tableoid = LargeObjectRelationId; - binfo[i].dobj.catId.oid = atooid(PQgetvalue(res, i, 0)); - AssignDumpId(&binfo[i].dobj); - - binfo[i].dobj.name = pg_strdup(PQgetvalue(res, i, 0)); - if (!PQgetisnull(res, i, 1)) - binfo[i].rolname = pg_strdup(PQgetvalue(res, i, 1)); - else - binfo[i].rolname = ""; - if (!PQgetisnull(res, i, 2)) - binfo[i].blobacl = pg_strdup(PQgetvalue(res, i, 2)); - else - binfo[i].blobacl = NULL; - } + binfo[i].dobj.name = pg_strdup(PQgetvalue(res, i, i_oid)); + binfo[i].rolname = pg_strdup(PQgetvalue(res, i, i_lomowner)); + binfo[i].blobacl = pg_strdup(PQgetvalue(res, i, i_lomacl)); + binfo[i].rblobacl = pg_strdup(PQgetvalue(res, i, i_rlomacl)); + binfo[i].initblobacl = pg_strdup(PQgetvalue(res, i, i_initlomacl)); + binfo[i].initrblobacl = pg_strdup(PQgetvalue(res, i, i_initrlomacl)); - /* - * If we have any large objects, a "BLOBS" archive entry is needed. - * This is just a placeholder for sorting; it carries no data now. - */ + if (PQgetisnull(res, i, i_lomacl) && PQgetisnull(res, i, i_rlomacl) && + PQgetisnull(res, i, i_initlomacl) && + PQgetisnull(res, i, i_initrlomacl)) + binfo[i].dobj.dump &= ~DUMP_COMPONENT_ACL; + + } + + /* + * If we have any large objects, a "BLOBS" archive entry is needed. This + * is just a placeholder for sorting; it carries no data now. + */ + if (ntups > 0) + { bdata = (DumpableObject *) pg_malloc(sizeof(DumpableObject)); bdata->objType = DO_BLOB_DATA; bdata->catId = nilCatalogId; @@ -2850,7 +2933,8 @@ dumpBlob(Archive *fout, BlobInfo *binfo) if (binfo->blobacl && (binfo->dobj.dump & DUMP_COMPONENT_ACL)) dumpACL(fout, binfo->dobj.catId, binfo->dobj.dumpId, "LARGE OBJECT", binfo->dobj.name, NULL, cquery->data, - NULL, binfo->rolname, binfo->blobacl); + NULL, binfo->rolname, binfo->blobacl, binfo->rblobacl, + binfo->initblobacl, binfo->initrblobacl); destroyPQExpBuffer(cquery); destroyPQExpBuffer(dquery); @@ -3381,6 +3465,9 @@ getNamespaces(Archive *fout, int *numNamespaces) int i_nspname; int i_rolname; int i_nspacl; + int i_rnspacl; + int i_initnspacl; + int i_initrnspacl; /* * Before 7.3, there are no real namespaces; create two dummy entries, one @@ -3397,8 +3484,11 @@ getNamespaces(Archive *fout, int *numNamespaces) nsinfo[0].dobj.name = pg_strdup("public"); nsinfo[0].rolname = pg_strdup(""); nsinfo[0].nspacl = pg_strdup(""); + nsinfo[0].rnspacl = pg_strdup(""); + nsinfo[0].initnspacl = pg_strdup(""); + nsinfo[0].initrnspacl = pg_strdup(""); - selectDumpableNamespace(&nsinfo[0], dopt); + selectDumpableNamespace(&nsinfo[0], fout); nsinfo[1].dobj.objType = DO_NAMESPACE; nsinfo[1].dobj.catId.tableoid = 0; @@ -3407,8 +3497,11 @@ getNamespaces(Archive *fout, int *numNamespaces) nsinfo[1].dobj.name = pg_strdup("pg_catalog"); nsinfo[1].rolname = pg_strdup(""); nsinfo[1].nspacl = pg_strdup(""); + nsinfo[1].rnspacl = pg_strdup(""); + nsinfo[1].initnspacl = pg_strdup(""); + nsinfo[1].initrnspacl = pg_strdup(""); - selectDumpableNamespace(&nsinfo[1], dopt); + selectDumpableNamespace(&nsinfo[1], fout); *numNamespaces = 2; @@ -3424,10 +3517,46 @@ getNamespaces(Archive *fout, int *numNamespaces) * we fetch all namespaces including system ones, so that every object we * read in can be linked to a containing namespace. */ - appendPQExpBuffer(query, "SELECT tableoid, oid, nspname, " - "(%s nspowner) AS rolname, " - "nspacl FROM pg_namespace", - username_subquery); + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer init_acl_subquery = createPQExpBuffer(); + PQExpBuffer init_racl_subquery = createPQExpBuffer(); + + buildACLQueries(acl_subquery, racl_subquery, init_acl_subquery, + init_racl_subquery, "n.nspacl", "n.nspowner", "'n'", + dopt->binary_upgrade); + + appendPQExpBuffer(query, "SELECT n.tableoid, n.oid, n.nspname, " + "(%s nspowner) AS rolname, " + "%s as nspacl, " + "%s as rnspacl, " + "%s as initnspacl, " + "%s as initrnspacl " + "FROM pg_namespace n " + "LEFT JOIN pg_init_privs pip " + "ON (n.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_namespace') " + "AND pip.objsubid = 0) ", + username_subquery, + acl_subquery->data, + racl_subquery->data, + init_acl_subquery->data, + init_racl_subquery->data); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(init_acl_subquery); + destroyPQExpBuffer(init_racl_subquery); + } + else + appendPQExpBuffer(query, "SELECT tableoid, oid, nspname, " + "(%s nspowner) AS rolname, " + "nspacl, NULL as rnspacl, " + "NULL AS initnspacl, NULL as initrnspacl " + "FROM pg_namespace", + username_subquery); res = ExecuteSqlQuery(fout, query->data, PGRES_TUPLES_OK); @@ -3440,6 +3569,9 @@ getNamespaces(Archive *fout, int *numNamespaces) i_nspname = PQfnumber(res, "nspname"); i_rolname = PQfnumber(res, "rolname"); i_nspacl = PQfnumber(res, "nspacl"); + i_rnspacl = PQfnumber(res, "rnspacl"); + i_initnspacl = PQfnumber(res, "initnspacl"); + i_initrnspacl = PQfnumber(res, "initrnspacl"); for (i = 0; i < ntups; i++) { @@ -3450,9 +3582,25 @@ getNamespaces(Archive *fout, int *numNamespaces) nsinfo[i].dobj.name = pg_strdup(PQgetvalue(res, i, i_nspname)); nsinfo[i].rolname = pg_strdup(PQgetvalue(res, i, i_rolname)); nsinfo[i].nspacl = pg_strdup(PQgetvalue(res, i, i_nspacl)); + nsinfo[i].rnspacl = pg_strdup(PQgetvalue(res, i, i_rnspacl)); + nsinfo[i].initnspacl = pg_strdup(PQgetvalue(res, i, i_initnspacl)); + nsinfo[i].initrnspacl = pg_strdup(PQgetvalue(res, i, i_initrnspacl)); /* Decide whether to dump this namespace */ - selectDumpableNamespace(&nsinfo[i], dopt); + selectDumpableNamespace(&nsinfo[i], fout); + + /* + * Do not try to dump ACL if the ACL is empty or the default. + * + * This is useful because, for some schemas/objects, the only + * component we are going to try and dump is the ACL and if we can + * remove that then 'dump' goes to zero/false and we don't consider + * this object for dumping at all later on. + */ + if (PQgetisnull(res, i, i_nspacl) && PQgetisnull(res, i, i_rnspacl) && + PQgetisnull(res, i, i_initnspacl) && + PQgetisnull(res, i, i_initrnspacl)) + nsinfo[i].dobj.dump &= ~DUMP_COMPONENT_ACL; if (strlen(nsinfo[i].rolname) == 0) write_msg(NULL, "WARNING: owner of schema \"%s\" appears to be invalid\n", @@ -3612,6 +3760,9 @@ getTypes(Archive *fout, int *numTypes) int i_typname; int i_typnamespace; int i_typacl; + int i_rtypacl; + int i_inittypacl; + int i_initrtypacl; int i_rolname; int i_typinput; int i_typoutput; @@ -3641,10 +3792,52 @@ getTypes(Archive *fout, int *numTypes) /* Make sure we are in proper schema */ selectSourceSchema(fout, "pg_catalog"); - if (fout->remoteVersion >= 90200) + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer initacl_subquery = createPQExpBuffer(); + PQExpBuffer initracl_subquery = createPQExpBuffer(); + + buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, + initracl_subquery, "t.typacl", "t.typowner", "'T'", + dopt->binary_upgrade); + + appendPQExpBuffer(query, "SELECT t.tableoid, t.oid, t.typname, " + "t.typnamespace, " + "%s AS typacl, " + "%s AS rtypacl, " + "%s AS inittypacl, " + "%s AS initrtypacl, " + "(%s t.typowner) AS rolname, " + "t.typinput::oid AS typinput, " + "t.typoutput::oid AS typoutput, t.typelem, t.typrelid, " + "CASE WHEN t.typrelid = 0 THEN ' '::\"char\" " + "ELSE (SELECT relkind FROM pg_class WHERE oid = t.typrelid) END AS typrelkind, " + "t.typtype, t.typisdefined, " + "t.typname[0] = '_' AND t.typelem != 0 AND " + "(SELECT typarray FROM pg_type te WHERE oid = t.typelem) = t.oid AS isarray " + "FROM pg_type t " + "LEFT JOIN pg_init_privs pip " + "ON (t.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_type') " + "AND pip.objsubid = 0) ", + acl_subquery->data, + racl_subquery->data, + initacl_subquery->data, + initracl_subquery->data, + username_subquery); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(initacl_subquery); + destroyPQExpBuffer(initracl_subquery); + } + else if (fout->remoteVersion >= 90200) { appendPQExpBuffer(query, "SELECT tableoid, oid, typname, " - "typnamespace, typacl, " + "typnamespace, typacl, NULL as rtypacl, " + "NULL AS inittypacl, NULL AS initrtypacl, " "(%s typowner) AS rolname, " "typinput::oid AS typinput, " "typoutput::oid AS typoutput, typelem, typrelid, " @@ -3659,7 +3852,8 @@ getTypes(Archive *fout, int *numTypes) else if (fout->remoteVersion >= 80300) { appendPQExpBuffer(query, "SELECT tableoid, oid, typname, " - "typnamespace, NULL AS typacl, " + "typnamespace, NULL AS typacl, NULL as rtypacl, " + "NULL AS inittypacl, NULL AS initrtypacl, " "(%s typowner) AS rolname, " "typinput::oid AS typinput, " "typoutput::oid AS typoutput, typelem, typrelid, " @@ -3674,7 +3868,8 @@ getTypes(Archive *fout, int *numTypes) else if (fout->remoteVersion >= 70300) { appendPQExpBuffer(query, "SELECT tableoid, oid, typname, " - "typnamespace, NULL AS typacl, " + "typnamespace, NULL AS typacl, NULL as rtypacl, " + "NULL AS inittypacl, NULL AS initrtypacl, " "(%s typowner) AS rolname, " "typinput::oid AS typinput, " "typoutput::oid AS typoutput, typelem, typrelid, " @@ -3688,7 +3883,8 @@ getTypes(Archive *fout, int *numTypes) else if (fout->remoteVersion >= 70100) { appendPQExpBuffer(query, "SELECT tableoid, oid, typname, " - "0::oid AS typnamespace, NULL AS typacl, " + "0::oid AS typnamespace, NULL AS typacl, NULL as rtypacl, " + "NULL AS inittypacl, NULL AS initrtypacl, " "(%s typowner) AS rolname, " "typinput::oid AS typinput, " "typoutput::oid AS typoutput, typelem, typrelid, " @@ -3704,7 +3900,8 @@ getTypes(Archive *fout, int *numTypes) appendPQExpBuffer(query, "SELECT " "(SELECT oid FROM pg_class WHERE relname = 'pg_type') AS tableoid, " "oid, typname, " - "0::oid AS typnamespace, NULL AS typacl, " + "0::oid AS typnamespace, NULL AS typacl, NULL as rtypacl, " + "NULL AS inittypacl, NULL AS initrtypacl, " "(%s typowner) AS rolname, " "typinput::oid AS typinput, " "typoutput::oid AS typoutput, typelem, typrelid, " @@ -3727,6 +3924,9 @@ getTypes(Archive *fout, int *numTypes) i_typname = PQfnumber(res, "typname"); i_typnamespace = PQfnumber(res, "typnamespace"); i_typacl = PQfnumber(res, "typacl"); + i_rtypacl = PQfnumber(res, "rtypacl"); + i_inittypacl = PQfnumber(res, "inittypacl"); + i_initrtypacl = PQfnumber(res, "initrtypacl"); i_rolname = PQfnumber(res, "rolname"); i_typinput = PQfnumber(res, "typinput"); i_typoutput = PQfnumber(res, "typoutput"); @@ -3750,6 +3950,9 @@ getTypes(Archive *fout, int *numTypes) tyinfo[i].dobj.catId.oid); tyinfo[i].rolname = pg_strdup(PQgetvalue(res, i, i_rolname)); tyinfo[i].typacl = pg_strdup(PQgetvalue(res, i, i_typacl)); + tyinfo[i].rtypacl = pg_strdup(PQgetvalue(res, i, i_rtypacl)); + tyinfo[i].inittypacl = pg_strdup(PQgetvalue(res, i, i_inittypacl)); + tyinfo[i].initrtypacl = pg_strdup(PQgetvalue(res, i, i_initrtypacl)); tyinfo[i].typelem = atooid(PQgetvalue(res, i, i_typelem)); tyinfo[i].typrelid = atooid(PQgetvalue(res, i, i_typrelid)); tyinfo[i].typrelkind = *PQgetvalue(res, i, i_typrelkind); @@ -3767,7 +3970,13 @@ getTypes(Archive *fout, int *numTypes) tyinfo[i].isArray = false; /* Decide whether we want to dump it */ - selectDumpableType(&tyinfo[i], dopt); + selectDumpableType(&tyinfo[i], fout); + + /* Do not try to dump ACL if no ACL exists. */ + if (PQgetisnull(res, i, i_typacl) && PQgetisnull(res, i, i_rtypacl) && + PQgetisnull(res, i, i_inittypacl) && + PQgetisnull(res, i, i_initrtypacl)) + tyinfo[i].dobj.dump &= ~DUMP_COMPONENT_ACL; /* * If it's a domain, fetch info about its constraints, if any @@ -3875,7 +4084,6 @@ getTypes(Archive *fout, int *numTypes) OprInfo * getOperators(Archive *fout, int *numOprs) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -3961,7 +4169,7 @@ getOperators(Archive *fout, int *numOprs) oprinfo[i].oprcode = atooid(PQgetvalue(res, i, i_oprcode)); /* Decide whether we want to dump it */ - selectDumpableObject(&(oprinfo[i].dobj), dopt); + selectDumpableObject(&(oprinfo[i].dobj), fout); if (strlen(oprinfo[i].rolname) == 0) write_msg(NULL, "WARNING: owner of operator \"%s\" appears to be invalid\n", @@ -3985,7 +4193,6 @@ getOperators(Archive *fout, int *numOprs) CollInfo * getCollations(Archive *fout, int *numCollations) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -4047,7 +4254,7 @@ getCollations(Archive *fout, int *numCollations) collinfo[i].rolname = pg_strdup(PQgetvalue(res, i, i_rolname)); /* Decide whether we want to dump it */ - selectDumpableObject(&(collinfo[i].dobj), dopt); + selectDumpableObject(&(collinfo[i].dobj), fout); } PQclear(res); @@ -4067,7 +4274,6 @@ getCollations(Archive *fout, int *numCollations) ConvInfo * getConversions(Archive *fout, int *numConversions) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -4129,7 +4335,7 @@ getConversions(Archive *fout, int *numConversions) convinfo[i].rolname = pg_strdup(PQgetvalue(res, i, i_rolname)); /* Decide whether we want to dump it */ - selectDumpableObject(&(convinfo[i].dobj), dopt); + selectDumpableObject(&(convinfo[i].dobj), fout); } PQclear(res); @@ -4149,7 +4355,6 @@ getConversions(Archive *fout, int *numConversions) AccessMethodInfo * getAccessMethods(Archive *fout, int *numAccessMethods) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -4203,7 +4408,7 @@ getAccessMethods(Archive *fout, int *numAccessMethods) aminfo[i].amtype = *(PQgetvalue(res, i, i_amtype)); /* Decide whether we want to dump it */ - selectDumpableAccessMethod(&(aminfo[i]), dopt); + selectDumpableAccessMethod(&(aminfo[i]), fout); } PQclear(res); @@ -4224,7 +4429,6 @@ getAccessMethods(Archive *fout, int *numAccessMethods) OpclassInfo * getOpclasses(Archive *fout, int *numOpclasses) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -4296,7 +4500,7 @@ getOpclasses(Archive *fout, int *numOpclasses) opcinfo[i].rolname = pg_strdup(PQgetvalue(res, i, i_rolname)); /* Decide whether we want to dump it */ - selectDumpableObject(&(opcinfo[i].dobj), dopt); + selectDumpableObject(&(opcinfo[i].dobj), fout); if (fout->remoteVersion >= 70300) { @@ -4323,7 +4527,6 @@ getOpclasses(Archive *fout, int *numOpclasses) OpfamilyInfo * getOpfamilies(Archive *fout, int *numOpfamilies) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -4385,7 +4588,7 @@ getOpfamilies(Archive *fout, int *numOpfamilies) opfinfo[i].rolname = pg_strdup(PQgetvalue(res, i, i_rolname)); /* Decide whether we want to dump it */ - selectDumpableObject(&(opfinfo[i].dobj), dopt); + selectDumpableObject(&(opfinfo[i].dobj), fout); if (fout->remoteVersion >= 70300) { @@ -4426,22 +4629,79 @@ getAggregates(Archive *fout, int *numAggs) int i_proargtypes; int i_rolname; int i_aggacl; + int i_raggacl; + int i_initaggacl; + int i_initraggacl; /* Make sure we are in proper schema */ selectSourceSchema(fout, "pg_catalog"); /* - * Find all user-defined aggregates. See comment in getFuncs() for the + * Find all interesting aggregates. See comment in getFuncs() for the * rationale behind the filtering logic. */ + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer initacl_subquery = createPQExpBuffer(); + PQExpBuffer initracl_subquery = createPQExpBuffer(); + + buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, + initracl_subquery, "p.proacl", "p.proowner", "'f'", + dopt->binary_upgrade); + + appendPQExpBuffer(query, "SELECT p.tableoid, p.oid, " + "p.proname AS aggname, " + "p.pronamespace AS aggnamespace, " + "p.pronargs, p.proargtypes, " + "(%s p.proowner) AS rolname, " + "%s AS aggacl, " + "%s AS raggacl, " + "%s AS initaggacl, " + "%s AS initraggacl " + "FROM pg_proc p " + "LEFT JOIN pg_init_privs pip ON " + "(p.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_proc') " + "AND pip.objsubid = 0) " + "WHERE p.proisagg AND (" + "p.pronamespace != " + "(SELECT oid FROM pg_namespace " + "WHERE nspname = 'pg_catalog') OR " + "EXISTS (SELECT * FROM pg_init_privs pip " + "WHERE p.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class " + "WHERE relname = 'pg_proc') " + "AND p.proacl IS DISTINCT FROM pip.initprivs)", + username_subquery, + acl_subquery->data, + racl_subquery->data, + initacl_subquery->data, + initracl_subquery->data); + if (dopt->binary_upgrade) + appendPQExpBufferStr(query, + " OR EXISTS(SELECT 1 FROM pg_depend WHERE " + "classid = 'pg_proc'::regclass AND " + "objid = p.oid AND " + "refclassid = 'pg_extension'::regclass AND " + "deptype = 'e')"); + appendPQExpBufferChar(query, ')'); - if (fout->remoteVersion >= 80200) + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(initacl_subquery); + destroyPQExpBuffer(initracl_subquery); + } + else if (fout->remoteVersion >= 80200) { appendPQExpBuffer(query, "SELECT tableoid, oid, proname AS aggname, " "pronamespace AS aggnamespace, " "pronargs, proargtypes, " "(%s proowner) AS rolname, " - "proacl AS aggacl " + "proacl AS aggacl, " + "NULL AS raggacl, " + "NULL AS initaggacl, NULL AS initraggacl " "FROM pg_proc p " "WHERE proisagg AND (" "pronamespace != " @@ -4464,7 +4724,9 @@ getAggregates(Archive *fout, int *numAggs) "CASE WHEN proargtypes[0] = 'pg_catalog.\"any\"'::pg_catalog.regtype THEN 0 ELSE 1 END AS pronargs, " "proargtypes, " "(%s proowner) AS rolname, " - "proacl AS aggacl " + "proacl AS aggacl, " + "NULL AS raggacl, " + "NULL AS initaggacl, NULL AS initraggacl " "FROM pg_proc " "WHERE proisagg " "AND pronamespace != " @@ -4478,7 +4740,9 @@ getAggregates(Archive *fout, int *numAggs) "CASE WHEN aggbasetype = 0 THEN 0 ELSE 1 END AS pronargs, " "aggbasetype AS proargtypes, " "(%s aggowner) AS rolname, " - "NULL AS aggacl " + "NULL AS aggacl, " + "NULL AS raggacl, " + "NULL AS initaggacl, NULL AS initraggacl " "FROM pg_aggregate " "where oid > '%u'::oid", username_subquery, @@ -4493,7 +4757,9 @@ getAggregates(Archive *fout, int *numAggs) "CASE WHEN aggbasetype = 0 THEN 0 ELSE 1 END AS pronargs, " "aggbasetype AS proargtypes, " "(%s aggowner) AS rolname, " - "NULL AS aggacl " + "NULL AS aggacl, " + "NULL AS raggacl, " + "NULL AS initaggacl, NULL AS initraggacl " "FROM pg_aggregate " "where oid > '%u'::oid", username_subquery, @@ -4515,6 +4781,9 @@ getAggregates(Archive *fout, int *numAggs) i_proargtypes = PQfnumber(res, "proargtypes"); i_rolname = PQfnumber(res, "rolname"); i_aggacl = PQfnumber(res, "aggacl"); + i_raggacl = PQfnumber(res, "raggacl"); + i_initaggacl = PQfnumber(res, "initaggacl"); + i_initraggacl = PQfnumber(res, "initraggacl"); for (i = 0; i < ntups; i++) { @@ -4534,6 +4803,9 @@ getAggregates(Archive *fout, int *numAggs) agginfo[i].aggfn.lang = InvalidOid; /* not currently interesting */ agginfo[i].aggfn.prorettype = InvalidOid; /* not saved */ agginfo[i].aggfn.proacl = pg_strdup(PQgetvalue(res, i, i_aggacl)); + agginfo[i].aggfn.rproacl = pg_strdup(PQgetvalue(res, i, i_raggacl)); + agginfo[i].aggfn.initproacl = pg_strdup(PQgetvalue(res, i, i_initaggacl)); + agginfo[i].aggfn.initrproacl = pg_strdup(PQgetvalue(res, i, i_initraggacl)); agginfo[i].aggfn.nargs = atoi(PQgetvalue(res, i, i_pronargs)); if (agginfo[i].aggfn.nargs == 0) agginfo[i].aggfn.argtypes = NULL; @@ -4550,7 +4822,13 @@ getAggregates(Archive *fout, int *numAggs) } /* Decide whether we want to dump it */ - selectDumpableObject(&(agginfo[i].aggfn.dobj), dopt); + selectDumpableObject(&(agginfo[i].aggfn.dobj), fout); + + /* Do not try to dump ACL if no ACL exists. */ + if (PQgetisnull(res, i, i_aggacl) && PQgetisnull(res, i, i_raggacl) && + PQgetisnull(res, i, i_initaggacl) && + PQgetisnull(res, i, i_initraggacl)) + agginfo[i].aggfn.dobj.dump &= ~DUMP_COMPONENT_ACL; } PQclear(res); @@ -4586,17 +4864,21 @@ getFuncs(Archive *fout, int *numFuncs) int i_proargtypes; int i_prorettype; int i_proacl; + int i_rproacl; + int i_initproacl; + int i_initrproacl; /* Make sure we are in proper schema */ selectSourceSchema(fout, "pg_catalog"); /* - * Find all user-defined functions. Normally we can exclude functions in - * pg_catalog, which is worth doing since there are several thousand of - * 'em. However, there are some extensions that create functions in - * pg_catalog. In normal dumps we can still ignore those --- but in - * binary-upgrade mode, we must dump the member objects of the extension, - * so be sure to fetch any such functions. + * Find all interesting functions. We include functions in pg_catalog, if + * they have an ACL different from what we set at initdb time (which is + * saved in pg_init_privs for us to perform this check). There may also + * be functions which are members of extensions which we must dump if we + * are in binary upgrade mode (we'll mark those functions as to-be-dumped + * when we check if the extension is to-be-dumped and we're in binary + * upgrade mode). * * Also, in 9.2 and up, exclude functions that are internally dependent on * something else, since presumably those will be created as a result of @@ -4605,12 +4887,69 @@ getFuncs(Archive *fout, int *numFuncs) * because the constructors don't have any dependencies the range type * doesn't have; otherwise we might not get creation ordering correct. */ + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer initacl_subquery = createPQExpBuffer(); + PQExpBuffer initracl_subquery = createPQExpBuffer(); - if (fout->remoteVersion >= 70300) + buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, + initracl_subquery, "p.proacl", "p.proowner", "'f'", + dopt->binary_upgrade); + + appendPQExpBuffer(query, + "SELECT p.tableoid, p.oid, p.proname, p.prolang, " + "p.pronargs, p.proargtypes, p.prorettype, " + "%s AS proacl, " + "%s AS rproacl, " + "%s AS initproacl, " + "%s AS initrproacl, " + "p.pronamespace, " + "(%s p.proowner) AS rolname " + "FROM pg_proc p " + "LEFT JOIN pg_init_privs pip ON " + "(p.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_proc') " + "AND pip.objsubid = 0) " + "WHERE NOT proisagg " + "AND NOT EXISTS (SELECT 1 FROM pg_depend " + "WHERE classid = 'pg_proc'::regclass AND " + "objid = p.oid AND deptype = 'i') AND (" + "pronamespace != " + "(SELECT oid FROM pg_namespace " + "WHERE nspname = 'pg_catalog') OR " + "EXISTS (SELECT * FROM pg_init_privs pip " + "WHERE p.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class " + "WHERE relname = 'pg_proc') " + "AND p.proacl IS DISTINCT FROM pip.initprivs)", + acl_subquery->data, + racl_subquery->data, + initacl_subquery->data, + initracl_subquery->data, + username_subquery); + if (dopt->binary_upgrade) + appendPQExpBufferStr(query, + "\n OR EXISTS(SELECT 1 FROM pg_depend WHERE " + "classid = 'pg_proc'::regclass AND " + "objid = p.oid AND " + "refclassid = 'pg_extension'::regclass AND " + "deptype = 'e')"); + appendPQExpBufferChar(query, ')'); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(initacl_subquery); + destroyPQExpBuffer(initracl_subquery); + } + else if (fout->remoteVersion >= 70300) { appendPQExpBuffer(query, "SELECT tableoid, oid, proname, prolang, " "pronargs, proargtypes, prorettype, proacl, " + "NULL as rproacl, " + "NULL as initproacl, NULL AS initrproacl, " "pronamespace, " "(%s proowner) AS rolname " "FROM pg_proc p " @@ -4639,6 +4978,8 @@ getFuncs(Archive *fout, int *numFuncs) "SELECT tableoid, oid, proname, prolang, " "pronargs, proargtypes, prorettype, " "NULL AS proacl, " + "NULL AS rproacl, " + "NULL as initproacl, NULL AS initrproacl, " "0::oid AS pronamespace, " "(%s proowner) AS rolname " "FROM pg_proc " @@ -4655,6 +4996,8 @@ getFuncs(Archive *fout, int *numFuncs) "oid, proname, prolang, " "pronargs, proargtypes, prorettype, " "NULL AS proacl, " + "NULL AS rproacl, " + "NULL as initproacl, NULL AS initrproacl, " "0::oid AS pronamespace, " "(%s proowner) AS rolname " "FROM pg_proc " @@ -4681,6 +5024,9 @@ getFuncs(Archive *fout, int *numFuncs) i_proargtypes = PQfnumber(res, "proargtypes"); i_prorettype = PQfnumber(res, "prorettype"); i_proacl = PQfnumber(res, "proacl"); + i_rproacl = PQfnumber(res, "rproacl"); + i_initproacl = PQfnumber(res, "initproacl"); + i_initrproacl = PQfnumber(res, "initrproacl"); for (i = 0; i < ntups; i++) { @@ -4697,6 +5043,9 @@ getFuncs(Archive *fout, int *numFuncs) finfo[i].lang = atooid(PQgetvalue(res, i, i_prolang)); finfo[i].prorettype = atooid(PQgetvalue(res, i, i_prorettype)); finfo[i].proacl = pg_strdup(PQgetvalue(res, i, i_proacl)); + finfo[i].rproacl = pg_strdup(PQgetvalue(res, i, i_rproacl)); + finfo[i].initproacl = pg_strdup(PQgetvalue(res, i, i_initproacl)); + finfo[i].initrproacl = pg_strdup(PQgetvalue(res, i, i_initrproacl)); finfo[i].nargs = atoi(PQgetvalue(res, i, i_pronargs)); if (finfo[i].nargs == 0) finfo[i].argtypes = NULL; @@ -4708,7 +5057,13 @@ getFuncs(Archive *fout, int *numFuncs) } /* Decide whether we want to dump it */ - selectDumpableObject(&(finfo[i].dobj), dopt); + selectDumpableObject(&(finfo[i].dobj), fout); + + /* Do not try to dump ACL if no ACL exists. */ + if (PQgetisnull(res, i, i_proacl) && PQgetisnull(res, i, i_rproacl) && + PQgetisnull(res, i, i_initproacl) && + PQgetisnull(res, i, i_initrproacl)) + finfo[i].dobj.dump &= ~DUMP_COMPONENT_ACL; if (strlen(finfo[i].rolname) == 0) write_msg(NULL, @@ -4725,7 +5080,7 @@ getFuncs(Archive *fout, int *numFuncs) /* * getTables - * read all the user-defined tables (no indexes, no catalogs) + * read all the tables (no indexes) * in the system catalogs return them in the TableInfo* structure * * numTables is set to the number of tables read in @@ -4745,6 +5100,9 @@ getTables(Archive *fout, int *numTables) int i_relnamespace; int i_relkind; int i_relacl; + int i_rrelacl; + int i_initrelacl; + int i_initrrelacl; int i_rolname; int i_relchecks; int i_relhastriggers; @@ -4793,7 +5151,77 @@ getTables(Archive *fout, int *numTables) * we cannot correctly identify inherited columns, owned sequences, etc. */ - if (fout->remoteVersion >= 90500) + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer initacl_subquery = createPQExpBuffer(); + PQExpBuffer initracl_subquery = createPQExpBuffer(); + + /* + * Left join to pick up dependency info linking sequences to their + * owning column, if any (note this dependency is AUTO as of 8.2) + * + * Left join to detect if any privileges are still as-set-at-init, in + * which case we won't dump out ACL commands for those. + */ + + buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, + initracl_subquery, "c.relacl", "c.relowner", + "CASE WHEN c.relkind = 'S' THEN 's' ELSE 'r' END::\"char\"", + dopt->binary_upgrade); + + appendPQExpBuffer(query, + "SELECT c.tableoid, c.oid, c.relname, " + "%s AS relacl, %s as rrelacl, " + "%s AS initrelacl, %s as initrrelacl, " + "c.relkind, c.relnamespace, " + "(%s c.relowner) AS rolname, " + "c.relchecks, c.relhastriggers, " + "c.relhasindex, c.relhasrules, c.relhasoids, " + "c.relrowsecurity, c.relforcerowsecurity, " + "c.relfrozenxid, c.relminmxid, tc.oid AS toid, " + "tc.relfrozenxid AS tfrozenxid, " + "tc.relminmxid AS tminmxid, " + "c.relpersistence, c.relispopulated, " + "c.relreplident, c.relpages, " + "CASE WHEN c.reloftype <> 0 THEN c.reloftype::pg_catalog.regtype ELSE NULL END AS reloftype, " + "d.refobjid AS owning_tab, " + "d.refobjsubid AS owning_col, " + "(SELECT spcname FROM pg_tablespace t WHERE t.oid = c.reltablespace) AS reltablespace, " + "array_remove(array_remove(c.reloptions,'check_option=local'),'check_option=cascaded') AS reloptions, " + "CASE WHEN 'check_option=local' = ANY (c.reloptions) THEN 'LOCAL'::text " + "WHEN 'check_option=cascaded' = ANY (c.reloptions) THEN 'CASCADED'::text ELSE NULL END AS checkoption, " + "tc.reloptions AS toast_reloptions " + "FROM pg_class c " + "LEFT JOIN pg_depend d ON " + "(c.relkind = '%c' AND " + "d.classid = c.tableoid AND d.objid = c.oid AND " + "d.objsubid = 0 AND " + "d.refclassid = c.tableoid AND d.deptype = 'a') " + "LEFT JOIN pg_class tc ON (c.reltoastrelid = tc.oid) " + "LEFT JOIN pg_init_privs pip ON " + "(c.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class " + "WHERE relname = 'pg_class') AND pip.objsubid = 0) " + "WHERE c.relkind in ('%c', '%c', '%c', '%c', '%c', '%c') " + "ORDER BY c.oid", + acl_subquery->data, + racl_subquery->data, + initacl_subquery->data, + initracl_subquery->data, + username_subquery, + RELKIND_SEQUENCE, + RELKIND_RELATION, RELKIND_SEQUENCE, + RELKIND_VIEW, RELKIND_COMPOSITE_TYPE, + RELKIND_MATVIEW, RELKIND_FOREIGN_TABLE); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(initacl_subquery); + destroyPQExpBuffer(initracl_subquery); + } + else if (fout->remoteVersion >= 90500) { /* * Left join to pick up dependency info linking sequences to their @@ -4801,7 +5229,10 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, c.relname, " - "c.relacl, c.relkind, c.relnamespace, " + "c.relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "c.relkind, " + "c.relnamespace, " "(%s c.relowner) AS rolname, " "c.relchecks, c.relhastriggers, " "c.relhasindex, c.relhasrules, c.relhasoids, " @@ -4842,7 +5273,10 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, c.relname, " - "c.relacl, c.relkind, c.relnamespace, " + "c.relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "c.relkind, " + "c.relnamespace, " "(%s c.relowner) AS rolname, " "c.relchecks, c.relhastriggers, " "c.relhasindex, c.relhasrules, c.relhasoids, " @@ -4884,7 +5318,10 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, c.relname, " - "c.relacl, c.relkind, c.relnamespace, " + "c.relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "c.relkind, " + "c.relnamespace, " "(%s c.relowner) AS rolname, " "c.relchecks, c.relhastriggers, " "c.relhasindex, c.relhasrules, c.relhasoids, " @@ -4926,7 +5363,10 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, c.relname, " - "c.relacl, c.relkind, c.relnamespace, " + "c.relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "c.relkind, " + "c.relnamespace, " "(%s c.relowner) AS rolname, " "c.relchecks, c.relhastriggers, " "c.relhasindex, c.relhasrules, c.relhasoids, " @@ -4966,7 +5406,10 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, c.relname, " - "c.relacl, c.relkind, c.relnamespace, " + "c.relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "c.relkind, " + "c.relnamespace, " "(%s c.relowner) AS rolname, " "c.relchecks, c.relhastriggers, " "c.relhasindex, c.relhasrules, c.relhasoids, " @@ -5005,7 +5448,10 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, c.relname, " - "c.relacl, c.relkind, c.relnamespace, " + "c.relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "c.relkind, " + "c.relnamespace, " "(%s c.relowner) AS rolname, " "c.relchecks, c.relhastriggers, " "c.relhasindex, c.relhasrules, c.relhasoids, " @@ -5044,7 +5490,10 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, c.relname, " - "c.relacl, c.relkind, c.relnamespace, " + "c.relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "c.relkind, " + "c.relnamespace, " "(%s c.relowner) AS rolname, " "c.relchecks, (c.reltriggers <> 0) AS relhastriggers, " "c.relhasindex, c.relhasrules, c.relhasoids, " @@ -5083,7 +5532,9 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, relname, " - "relacl, relkind, relnamespace, " + "relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "relkind, relnamespace, " "(%s relowner) AS rolname, " "relchecks, (reltriggers <> 0) AS relhastriggers, " "relhasindex, relhasrules, relhasoids, " @@ -5121,7 +5572,9 @@ getTables(Archive *fout, int *numTables) */ appendPQExpBuffer(query, "SELECT c.tableoid, c.oid, relname, " - "relacl, relkind, relnamespace, " + "relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "relkind, relnamespace, " "(%s relowner) AS rolname, " "relchecks, (reltriggers <> 0) AS relhastriggers, " "relhasindex, relhasrules, relhasoids, " @@ -5154,7 +5607,10 @@ getTables(Archive *fout, int *numTables) else if (fout->remoteVersion >= 70200) { appendPQExpBuffer(query, - "SELECT tableoid, oid, relname, relacl, relkind, " + "SELECT tableoid, oid, relname, relacl, " + "NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "relkind, " "0::oid AS relnamespace, " "(%s relowner) AS rolname, " "relchecks, (reltriggers <> 0) AS relhastriggers, " @@ -5182,7 +5638,10 @@ getTables(Archive *fout, int *numTables) { /* all tables have oids in 7.1 */ appendPQExpBuffer(query, - "SELECT tableoid, oid, relname, relacl, relkind, " + "SELECT tableoid, oid, relname, relacl, " + "NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " + "relkind, " "0::oid AS relnamespace, " "(%s relowner) AS rolname, " "relchecks, (reltriggers <> 0) AS relhastriggers, " @@ -5216,7 +5675,8 @@ getTables(Archive *fout, int *numTables) appendPQExpBuffer(query, "SELECT " "(SELECT oid FROM pg_class WHERE relname = 'pg_class') AS tableoid, " - "oid, relname, relacl, " + "oid, relname, relacl, NULL as rrelacl, " + "NULL AS initrelacl, NULL AS initrrelacl, " "CASE WHEN relhasrules and relkind = 'r' " " and EXISTS(SELECT rulename FROM pg_rewrite r WHERE " " r.ev_class = c.oid AND r.ev_type = '1') " @@ -5270,6 +5730,9 @@ getTables(Archive *fout, int *numTables) i_relname = PQfnumber(res, "relname"); i_relnamespace = PQfnumber(res, "relnamespace"); i_relacl = PQfnumber(res, "relacl"); + i_rrelacl = PQfnumber(res, "rrelacl"); + i_initrelacl = PQfnumber(res, "initrelacl"); + i_initrrelacl = PQfnumber(res, "initrrelacl"); i_relkind = PQfnumber(res, "relkind"); i_rolname = PQfnumber(res, "rolname"); i_relchecks = PQfnumber(res, "relchecks"); @@ -5324,6 +5787,9 @@ getTables(Archive *fout, int *numTables) tblinfo[i].dobj.catId.oid); tblinfo[i].rolname = pg_strdup(PQgetvalue(res, i, i_rolname)); tblinfo[i].relacl = pg_strdup(PQgetvalue(res, i, i_relacl)); + tblinfo[i].rrelacl = pg_strdup(PQgetvalue(res, i, i_rrelacl)); + tblinfo[i].initrelacl = pg_strdup(PQgetvalue(res, i, i_initrelacl)); + tblinfo[i].initrrelacl = pg_strdup(PQgetvalue(res, i, i_initrrelacl)); tblinfo[i].relkind = *(PQgetvalue(res, i, i_relkind)); tblinfo[i].relpersistence = *(PQgetvalue(res, i, i_relpersistence)); tblinfo[i].hasindex = (strcmp(PQgetvalue(res, i, i_relhasindex), "t") == 0); @@ -5371,7 +5837,7 @@ getTables(Archive *fout, int *numTables) if (tblinfo[i].relkind == RELKIND_COMPOSITE_TYPE) tblinfo[i].dobj.dump = DUMP_COMPONENT_NONE; else - selectDumpableTable(&tblinfo[i], dopt); + selectDumpableTable(&tblinfo[i], fout); tblinfo[i].interesting = tblinfo[i].dobj.dump ? true : false; @@ -6457,7 +6923,6 @@ getTriggers(Archive *fout, TableInfo tblinfo[], int numTables) EventTriggerInfo * getEventTriggers(Archive *fout, int *numEventTriggers) { - DumpOptions *dopt = fout->dopt; int i; PQExpBuffer query; PGresult *res; @@ -6527,7 +6992,7 @@ getEventTriggers(Archive *fout, int *numEventTriggers) evtinfo[i].evtenabled = *(PQgetvalue(res, i, i_evtenabled)); /* Decide whether we want to dump it */ - selectDumpableObject(&(evtinfo[i].dobj), dopt); + selectDumpableObject(&(evtinfo[i].dobj), fout); } PQclear(res); @@ -6563,17 +7028,59 @@ getProcLangs(Archive *fout, int *numProcLangs) int i_laninline; int i_lanvalidator; int i_lanacl; + int i_rlanacl; + int i_initlanacl; + int i_initrlanacl; int i_lanowner; /* Make sure we are in proper schema */ selectSourceSchema(fout, "pg_catalog"); - if (fout->remoteVersion >= 90000) + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer initacl_subquery = createPQExpBuffer(); + PQExpBuffer initracl_subquery = createPQExpBuffer(); + + buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, + initracl_subquery, "l.lanacl", "l.lanowner", "'l'", + dopt->binary_upgrade); + + /* pg_language has a laninline column */ + appendPQExpBuffer(query, "SELECT l.tableoid, l.oid, " + "l.lanname, l.lanpltrusted, l.lanplcallfoid, " + "l.laninline, l.lanvalidator, " + "%s AS lanacl, " + "%s AS rlanacl, " + "%s AS initlanacl, " + "%s AS initrlanacl, " + "(%s l.lanowner) AS lanowner " + "FROM pg_language l " + "LEFT JOIN pg_init_privs pip " + "ON (l.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_type') " + "AND pip.objsubid = 0) " + "WHERE l.lanispl " + "ORDER BY l.oid", + acl_subquery->data, + racl_subquery->data, + initacl_subquery->data, + initracl_subquery->data, + username_subquery); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(initacl_subquery); + destroyPQExpBuffer(initracl_subquery); + } + else if (fout->remoteVersion >= 90000) { /* pg_language has a laninline column */ appendPQExpBuffer(query, "SELECT tableoid, oid, " "lanname, lanpltrusted, lanplcallfoid, " - "laninline, lanvalidator, lanacl, " + "laninline, lanvalidator, lanacl, NULL AS rlanacl, " + "NULL AS initlanacl, NULL AS initrlanacl, " "(%s lanowner) AS lanowner " "FROM pg_language " "WHERE lanispl " @@ -6586,6 +7093,8 @@ getProcLangs(Archive *fout, int *numProcLangs) appendPQExpBuffer(query, "SELECT tableoid, oid, " "lanname, lanpltrusted, lanplcallfoid, " "0 AS laninline, lanvalidator, lanacl, " + "NULL AS rlanacl, " + "NULL AS initlanacl, NULL AS initrlanacl, " "(%s lanowner) AS lanowner " "FROM pg_language " "WHERE lanispl " @@ -6598,6 +7107,8 @@ getProcLangs(Archive *fout, int *numProcLangs) appendPQExpBuffer(query, "SELECT tableoid, oid, " "lanname, lanpltrusted, lanplcallfoid, " "0 AS laninline, lanvalidator, lanacl, " + "NULL AS rlanacl, " + "NULL AS initlanacl, NULL AS initrlanacl, " "(%s '10') AS lanowner " "FROM pg_language " "WHERE lanispl " @@ -6610,6 +7121,8 @@ getProcLangs(Archive *fout, int *numProcLangs) appendPQExpBuffer(query, "SELECT tableoid, oid, " "lanname, lanpltrusted, lanplcallfoid, " "0 AS laninline, lanvalidator, lanacl, " + "NULL AS rlanacl, " + "NULL AS initlanacl, NULL AS initrlanacl, " "(%s '1') AS lanowner " "FROM pg_language " "WHERE lanispl " @@ -6622,6 +7135,8 @@ getProcLangs(Archive *fout, int *numProcLangs) appendPQExpBuffer(query, "SELECT tableoid, oid, " "lanname, lanpltrusted, lanplcallfoid, " "0 AS laninline, lanvalidator, lanacl, " + "NULL AS rlanacl, " + "NULL AS initlanacl, NULL AS initrlanacl, " "NULL AS lanowner " "FROM pg_language " "WHERE lanispl " @@ -6632,6 +7147,8 @@ getProcLangs(Archive *fout, int *numProcLangs) appendPQExpBuffer(query, "SELECT tableoid, oid, " "lanname, lanpltrusted, lanplcallfoid, " "0 AS laninline, 0 AS lanvalidator, NULL AS lanacl, " + "NULL AS rlanacl, " + "NULL AS initlanacl, NULL AS initrlanacl, " "NULL AS lanowner " "FROM pg_language " "WHERE lanispl " @@ -6644,6 +7161,8 @@ getProcLangs(Archive *fout, int *numProcLangs) "oid, " "lanname, lanpltrusted, lanplcallfoid, " "0 AS laninline, 0 AS lanvalidator, NULL AS lanacl, " + "NULL AS rlanacl, " + "NULL AS initlanacl, NULL AS initrlanacl, " "NULL AS lanowner " "FROM pg_language " "WHERE lanispl " @@ -6666,6 +7185,9 @@ getProcLangs(Archive *fout, int *numProcLangs) i_laninline = PQfnumber(res, "laninline"); i_lanvalidator = PQfnumber(res, "lanvalidator"); i_lanacl = PQfnumber(res, "lanacl"); + i_rlanacl = PQfnumber(res, "rlanacl"); + i_initlanacl = PQfnumber(res, "initlanacl"); + i_initrlanacl = PQfnumber(res, "initrlanacl"); i_lanowner = PQfnumber(res, "lanowner"); for (i = 0; i < ntups; i++) @@ -6681,10 +7203,19 @@ getProcLangs(Archive *fout, int *numProcLangs) planginfo[i].laninline = atooid(PQgetvalue(res, i, i_laninline)); planginfo[i].lanvalidator = atooid(PQgetvalue(res, i, i_lanvalidator)); planginfo[i].lanacl = pg_strdup(PQgetvalue(res, i, i_lanacl)); + planginfo[i].rlanacl = pg_strdup(PQgetvalue(res, i, i_rlanacl)); + planginfo[i].initlanacl = pg_strdup(PQgetvalue(res, i, i_initlanacl)); + planginfo[i].initrlanacl = pg_strdup(PQgetvalue(res, i, i_initrlanacl)); planginfo[i].lanowner = pg_strdup(PQgetvalue(res, i, i_lanowner)); /* Decide whether we want to dump it */ - selectDumpableProcLang(&(planginfo[i]), dopt); + selectDumpableProcLang(&(planginfo[i]), fout); + + /* Do not try to dump ACL if no ACL exists. */ + if (PQgetisnull(res, i, i_lanacl) && PQgetisnull(res, i, i_rlanacl) && + PQgetisnull(res, i, i_initlanacl) && + PQgetisnull(res, i, i_initrlanacl)) + planginfo[i].dobj.dump &= ~DUMP_COMPONENT_ACL; if (fout->remoteVersion < 70300) { @@ -6717,7 +7248,6 @@ getProcLangs(Archive *fout, int *numProcLangs) CastInfo * getCasts(Archive *fout, int *numCasts) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -6823,7 +7353,7 @@ getCasts(Archive *fout, int *numCasts) } /* Decide whether we want to dump it */ - selectDumpableCast(&(castinfo[i]), dopt); + selectDumpableCast(&(castinfo[i]), fout); } PQclear(res); @@ -6859,7 +7389,6 @@ get_language_name(Archive *fout, Oid langid) TransformInfo * getTransforms(Archive *fout, int *numTransforms) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -6934,7 +7463,7 @@ getTransforms(Archive *fout, int *numTransforms) free(lanname); /* Decide whether we want to dump it */ - selectDumpableObject(&(transforminfo[i].dobj), dopt); + selectDumpableObject(&(transforminfo[i].dobj), fout); } PQclear(res); @@ -7545,7 +8074,6 @@ shouldPrintColumn(DumpOptions *dopt, TableInfo *tbinfo, int colno) TSParserInfo * getTSParsers(Archive *fout, int *numTSParsers) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -7618,7 +8146,7 @@ getTSParsers(Archive *fout, int *numTSParsers) prsinfo[i].prslextype = atooid(PQgetvalue(res, i, i_prslextype)); /* Decide whether we want to dump it */ - selectDumpableObject(&(prsinfo[i].dobj), dopt); + selectDumpableObject(&(prsinfo[i].dobj), fout); } PQclear(res); @@ -7638,7 +8166,6 @@ getTSParsers(Archive *fout, int *numTSParsers) TSDictInfo * getTSDictionaries(Archive *fout, int *numTSDicts) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -7704,7 +8231,7 @@ getTSDictionaries(Archive *fout, int *numTSDicts) dictinfo[i].dictinitoption = pg_strdup(PQgetvalue(res, i, i_dictinitoption)); /* Decide whether we want to dump it */ - selectDumpableObject(&(dictinfo[i].dobj), dopt); + selectDumpableObject(&(dictinfo[i].dobj), fout); } PQclear(res); @@ -7724,7 +8251,6 @@ getTSDictionaries(Archive *fout, int *numTSDicts) TSTemplateInfo * getTSTemplates(Archive *fout, int *numTSTemplates) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -7782,7 +8308,7 @@ getTSTemplates(Archive *fout, int *numTSTemplates) tmplinfo[i].tmpllexize = atooid(PQgetvalue(res, i, i_tmpllexize)); /* Decide whether we want to dump it */ - selectDumpableObject(&(tmplinfo[i].dobj), dopt); + selectDumpableObject(&(tmplinfo[i].dobj), fout); } PQclear(res); @@ -7802,7 +8328,6 @@ getTSTemplates(Archive *fout, int *numTSTemplates) TSConfigInfo * getTSConfigurations(Archive *fout, int *numTSConfigs) { - DumpOptions *dopt = fout->dopt; PGresult *res; int ntups; int i; @@ -7861,7 +8386,7 @@ getTSConfigurations(Archive *fout, int *numTSConfigs) cfginfo[i].cfgparser = atooid(PQgetvalue(res, i, i_cfgparser)); /* Decide whether we want to dump it */ - selectDumpableObject(&(cfginfo[i].dobj), dopt); + selectDumpableObject(&(cfginfo[i].dobj), fout); } PQclear(res); @@ -7894,6 +8419,9 @@ getForeignDataWrappers(Archive *fout, int *numForeignDataWrappers) int i_fdwhandler; int i_fdwvalidator; int i_fdwacl; + int i_rfdwacl; + int i_initfdwacl; + int i_initrfdwacl; int i_fdwoptions; /* Before 8.4, there are no foreign-data wrappers */ @@ -7908,12 +8436,55 @@ getForeignDataWrappers(Archive *fout, int *numForeignDataWrappers) /* Make sure we are in proper schema */ selectSourceSchema(fout, "pg_catalog"); - if (fout->remoteVersion >= 90100) + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer initacl_subquery = createPQExpBuffer(); + PQExpBuffer initracl_subquery = createPQExpBuffer(); + + buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, + initracl_subquery, "f.fdwacl", "f.fdwowner", "'F'", + dopt->binary_upgrade); + + appendPQExpBuffer(query, "SELECT f.tableoid, f.oid, f.fdwname, " + "(%s f.fdwowner) AS rolname, " + "f.fdwhandler::pg_catalog.regproc, " + "f.fdwvalidator::pg_catalog.regproc, " + "%s AS fdwacl, " + "%s AS rfdwacl, " + "%s AS initfdwacl, " + "%s AS initrfdwacl, " + "array_to_string(ARRAY(" + "SELECT quote_ident(option_name) || ' ' || " + "quote_literal(option_value) " + "FROM pg_options_to_table(f.fdwoptions) " + "ORDER BY option_name" + "), E',\n ') AS fdwoptions " + "FROM pg_foreign_data_wrapper f " + "LEFT JOIN pg_init_privs pip " + "ON (f.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_foreign_data_wrapper') " + "AND pip.objsubid = 0) ", + username_subquery, + acl_subquery->data, + racl_subquery->data, + initacl_subquery->data, + initracl_subquery->data); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(initacl_subquery); + destroyPQExpBuffer(initracl_subquery); + } + else if (fout->remoteVersion >= 90100) { appendPQExpBuffer(query, "SELECT tableoid, oid, fdwname, " "(%s fdwowner) AS rolname, " "fdwhandler::pg_catalog.regproc, " "fdwvalidator::pg_catalog.regproc, fdwacl, " + "NULL as rfdwacl, " + "NULL as initfdwacl, NULL AS initrfdwacl, " "array_to_string(ARRAY(" "SELECT quote_ident(option_name) || ' ' || " "quote_literal(option_value) " @@ -7929,6 +8500,8 @@ getForeignDataWrappers(Archive *fout, int *numForeignDataWrappers) "(%s fdwowner) AS rolname, " "'-' AS fdwhandler, " "fdwvalidator::pg_catalog.regproc, fdwacl, " + "NULL as rfdwacl, " + "NULL as initfdwacl, NULL AS initrfdwacl, " "array_to_string(ARRAY(" "SELECT quote_ident(option_name) || ' ' || " "quote_literal(option_value) " @@ -7953,6 +8526,9 @@ getForeignDataWrappers(Archive *fout, int *numForeignDataWrappers) i_fdwhandler = PQfnumber(res, "fdwhandler"); i_fdwvalidator = PQfnumber(res, "fdwvalidator"); i_fdwacl = PQfnumber(res, "fdwacl"); + i_rfdwacl = PQfnumber(res, "rfdwacl"); + i_initfdwacl = PQfnumber(res, "initfdwacl"); + i_initrfdwacl = PQfnumber(res, "initrfdwacl"); i_fdwoptions = PQfnumber(res, "fdwoptions"); for (i = 0; i < ntups; i++) @@ -7968,9 +8544,18 @@ getForeignDataWrappers(Archive *fout, int *numForeignDataWrappers) fdwinfo[i].fdwvalidator = pg_strdup(PQgetvalue(res, i, i_fdwvalidator)); fdwinfo[i].fdwoptions = pg_strdup(PQgetvalue(res, i, i_fdwoptions)); fdwinfo[i].fdwacl = pg_strdup(PQgetvalue(res, i, i_fdwacl)); + fdwinfo[i].rfdwacl = pg_strdup(PQgetvalue(res, i, i_rfdwacl)); + fdwinfo[i].initfdwacl = pg_strdup(PQgetvalue(res, i, i_initfdwacl)); + fdwinfo[i].initrfdwacl = pg_strdup(PQgetvalue(res, i, i_initrfdwacl)); /* Decide whether we want to dump it */ - selectDumpableObject(&(fdwinfo[i].dobj), dopt); + selectDumpableObject(&(fdwinfo[i].dobj), fout); + + /* Do not try to dump ACL if no ACL exists. */ + if (PQgetisnull(res, i, i_fdwacl) && PQgetisnull(res, i, i_rfdwacl) && + PQgetisnull(res, i, i_initfdwacl) && + PQgetisnull(res, i, i_initrfdwacl)) + fdwinfo[i].dobj.dump &= ~DUMP_COMPONENT_ACL; } PQclear(res); @@ -8004,6 +8589,9 @@ getForeignServers(Archive *fout, int *numForeignServers) int i_srvtype; int i_srvversion; int i_srvacl; + int i_rsrvacl; + int i_initsrvacl; + int i_initrsrvacl; int i_srvoptions; /* Before 8.4, there are no foreign servers */ @@ -8018,17 +8606,62 @@ getForeignServers(Archive *fout, int *numForeignServers) /* Make sure we are in proper schema */ selectSourceSchema(fout, "pg_catalog"); - appendPQExpBuffer(query, "SELECT tableoid, oid, srvname, " - "(%s srvowner) AS rolname, " - "srvfdw, srvtype, srvversion, srvacl," - "array_to_string(ARRAY(" - "SELECT quote_ident(option_name) || ' ' || " - "quote_literal(option_value) " - "FROM pg_options_to_table(srvoptions) " - "ORDER BY option_name" - "), E',\n ') AS srvoptions " - "FROM pg_foreign_server", - username_subquery); + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer initacl_subquery = createPQExpBuffer(); + PQExpBuffer initracl_subquery = createPQExpBuffer(); + + buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, + initracl_subquery, "f.srvacl", "f.srvowner", "'S'", + dopt->binary_upgrade); + + appendPQExpBuffer(query, "SELECT f.tableoid, f.oid, f.srvname, " + "(%s f.srvowner) AS rolname, " + "f.srvfdw, f.srvtype, f.srvversion, " + "%s AS srvacl, " + "%s AS rsrvacl, " + "%s AS initsrvacl, " + "%s AS initrsrvacl, " + "array_to_string(ARRAY(" + "SELECT quote_ident(option_name) || ' ' || " + "quote_literal(option_value) " + "FROM pg_options_to_table(f.srvoptions) " + "ORDER BY option_name" + "), E',\n ') AS srvoptions " + "FROM pg_foreign_server f " + "LEFT JOIN pg_init_privs pip " + "ON (f.oid = pip.objoid AND pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_foreign_server') " + "AND pip.objsubid = 0) ", + username_subquery, + acl_subquery->data, + racl_subquery->data, + initacl_subquery->data, + initracl_subquery->data); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(initacl_subquery); + destroyPQExpBuffer(initracl_subquery); + } + else + { + appendPQExpBuffer(query, "SELECT tableoid, oid, srvname, " + "(%s srvowner) AS rolname, " + "srvfdw, srvtype, srvversion, srvacl, " + "NULL AS rsrvacl, " + "NULL AS initsrvacl, NULL AS initrsrvacl, " + "array_to_string(ARRAY(" + "SELECT quote_ident(option_name) || ' ' || " + "quote_literal(option_value) " + "FROM pg_options_to_table(srvoptions) " + "ORDER BY option_name" + "), E',\n ') AS srvoptions " + "FROM pg_foreign_server", + username_subquery); + } res = ExecuteSqlQuery(fout, query->data, PGRES_TUPLES_OK); @@ -8045,6 +8678,9 @@ getForeignServers(Archive *fout, int *numForeignServers) i_srvtype = PQfnumber(res, "srvtype"); i_srvversion = PQfnumber(res, "srvversion"); i_srvacl = PQfnumber(res, "srvacl"); + i_rsrvacl = PQfnumber(res, "rsrvacl"); + i_initsrvacl = PQfnumber(res, "initsrvacl"); + i_initrsrvacl = PQfnumber(res, "initrsrvacl"); i_srvoptions = PQfnumber(res, "srvoptions"); for (i = 0; i < ntups; i++) @@ -8061,9 +8697,18 @@ getForeignServers(Archive *fout, int *numForeignServers) srvinfo[i].srvversion = pg_strdup(PQgetvalue(res, i, i_srvversion)); srvinfo[i].srvoptions = pg_strdup(PQgetvalue(res, i, i_srvoptions)); srvinfo[i].srvacl = pg_strdup(PQgetvalue(res, i, i_srvacl)); + srvinfo[i].rsrvacl = pg_strdup(PQgetvalue(res, i, i_rsrvacl)); + srvinfo[i].initsrvacl = pg_strdup(PQgetvalue(res, i, i_initsrvacl)); + srvinfo[i].initrsrvacl = pg_strdup(PQgetvalue(res, i, i_initrsrvacl)); /* Decide whether we want to dump it */ - selectDumpableObject(&(srvinfo[i].dobj), dopt); + selectDumpableObject(&(srvinfo[i].dobj), fout); + + /* Do not try to dump ACL if no ACL exists. */ + if (PQgetisnull(res, i, i_srvacl) && PQgetisnull(res, i, i_rsrvacl) && + PQgetisnull(res, i, i_initsrvacl) && + PQgetisnull(res, i, i_initrsrvacl)) + srvinfo[i].dobj.dump &= ~DUMP_COMPONENT_ACL; } PQclear(res); @@ -8688,7 +9333,8 @@ dumpNamespace(Archive *fout, NamespaceInfo *nspinfo) if (nspinfo->dobj.dump & DUMP_COMPONENT_ACL) dumpACL(fout, nspinfo->dobj.catId, nspinfo->dobj.dumpId, "SCHEMA", qnspname, NULL, nspinfo->dobj.name, NULL, - nspinfo->rolname, nspinfo->nspacl); + nspinfo->rolname, nspinfo->nspacl, nspinfo->rnspacl, + nspinfo->initnspacl, nspinfo->initrnspacl); free(qnspname); @@ -8983,7 +9629,8 @@ dumpEnumType(Archive *fout, TypeInfo *tyinfo) dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", qtypname, NULL, tyinfo->dobj.name, tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + tyinfo->rolname, tyinfo->typacl, tyinfo->rtypacl, + tyinfo->inittypacl, tyinfo->initrtypacl); PQclear(res); destroyPQExpBuffer(q); @@ -9121,7 +9768,8 @@ dumpRangeType(Archive *fout, TypeInfo *tyinfo) dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", qtypname, NULL, tyinfo->dobj.name, tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + tyinfo->rolname, tyinfo->typacl, tyinfo->rtypacl, + tyinfo->inittypacl, tyinfo->initrtypacl); PQclear(res); destroyPQExpBuffer(q); @@ -9196,7 +9844,8 @@ dumpUndefinedType(Archive *fout, TypeInfo *tyinfo) dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", qtypname, NULL, tyinfo->dobj.name, tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + tyinfo->rolname, tyinfo->typacl, tyinfo->rtypacl, + tyinfo->inittypacl, tyinfo->initrtypacl); destroyPQExpBuffer(q); destroyPQExpBuffer(delq); @@ -9590,7 +10239,8 @@ dumpBaseType(Archive *fout, TypeInfo *tyinfo) dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", qtypname, NULL, tyinfo->dobj.name, tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + tyinfo->rolname, tyinfo->typacl, tyinfo->rtypacl, + tyinfo->inittypacl, tyinfo->initrtypacl); PQclear(res); destroyPQExpBuffer(q); @@ -9758,7 +10408,8 @@ dumpDomain(Archive *fout, TypeInfo *tyinfo) dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", qtypname, NULL, tyinfo->dobj.name, tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + tyinfo->rolname, tyinfo->typacl, tyinfo->rtypacl, + tyinfo->inittypacl, tyinfo->initrtypacl); /* Dump any per-constraint comments */ for (i = 0; i < tyinfo->nDomChecks; i++) @@ -9993,7 +10644,8 @@ dumpCompositeType(Archive *fout, TypeInfo *tyinfo) dumpACL(fout, tyinfo->dobj.catId, tyinfo->dobj.dumpId, "TYPE", qtypname, NULL, tyinfo->dobj.name, tyinfo->dobj.namespace->dobj.name, - tyinfo->rolname, tyinfo->typacl); + tyinfo->rolname, tyinfo->typacl, tyinfo->rtypacl, + tyinfo->inittypacl, tyinfo->initrtypacl); PQclear(res); destroyPQExpBuffer(q); @@ -10311,7 +10963,8 @@ dumpProcLang(Archive *fout, ProcLangInfo *plang) dumpACL(fout, plang->dobj.catId, plang->dobj.dumpId, "LANGUAGE", qlanname, NULL, plang->dobj.name, lanschema, - plang->lanowner, plang->lanacl); + plang->lanowner, plang->lanacl, plang->rlanacl, + plang->initlanacl, plang->initrlanacl); free(qlanname); @@ -10982,7 +11635,8 @@ dumpFunc(Archive *fout, FuncInfo *finfo) dumpACL(fout, finfo->dobj.catId, finfo->dobj.dumpId, "FUNCTION", funcsig, NULL, funcsig_tag, finfo->dobj.namespace->dobj.name, - finfo->rolname, finfo->proacl); + finfo->rolname, finfo->proacl, finfo->rproacl, + finfo->initproacl, finfo->initrproacl); PQclear(res); @@ -12700,29 +13354,29 @@ dumpAgg(Archive *fout, AggInfo *agginfo) if (fout->remoteVersion >= 90600) { appendPQExpBuffer(query, "SELECT aggtransfn, " - "aggfinalfn, aggtranstype::pg_catalog.regtype, " - "aggcombinefn, aggserialfn, aggdeserialfn, aggmtransfn, " - "aggminvtransfn, aggmfinalfn, aggmtranstype::pg_catalog.regtype, " - "aggfinalextra, aggmfinalextra, " - "aggsortop::pg_catalog.regoperator, " - "aggserialtype::pg_catalog.regtype, " - "(aggkind = 'h') AS hypothetical, " - "aggtransspace, agginitval, " - "aggmtransspace, aggminitval, " - "true AS convertok, " - "pg_catalog.pg_get_function_arguments(p.oid) AS funcargs, " - "pg_catalog.pg_get_function_identity_arguments(p.oid) AS funciargs " - "FROM pg_catalog.pg_aggregate a, pg_catalog.pg_proc p " - "WHERE a.aggfnoid = p.oid " - "AND p.oid = '%u'::pg_catalog.oid", - agginfo->aggfn.dobj.catId.oid); + "aggfinalfn, aggtranstype::pg_catalog.regtype, " + "aggcombinefn, aggserialfn, aggdeserialfn, aggmtransfn, " + "aggminvtransfn, aggmfinalfn, aggmtranstype::pg_catalog.regtype, " + "aggfinalextra, aggmfinalextra, " + "aggsortop::pg_catalog.regoperator, " + "aggserialtype::pg_catalog.regtype, " + "(aggkind = 'h') AS hypothetical, " + "aggtransspace, agginitval, " + "aggmtransspace, aggminitval, " + "true AS convertok, " + "pg_catalog.pg_get_function_arguments(p.oid) AS funcargs, " + "pg_catalog.pg_get_function_identity_arguments(p.oid) AS funciargs " + "FROM pg_catalog.pg_aggregate a, pg_catalog.pg_proc p " + "WHERE a.aggfnoid = p.oid " + "AND p.oid = '%u'::pg_catalog.oid", + agginfo->aggfn.dobj.catId.oid); } else if (fout->remoteVersion >= 90400) { appendPQExpBuffer(query, "SELECT aggtransfn, " "aggfinalfn, aggtranstype::pg_catalog.regtype, " "'-' AS aggcombinefn, '-' AS aggserialfn, " - "'-' AS aggdeserialfn, aggmtransfn, aggminvtransfn, " + "'-' AS aggdeserialfn, aggmtransfn, aggminvtransfn, " "aggmfinalfn, aggmtranstype::pg_catalog.regtype, " "aggfinalextra, aggmfinalextra, " "aggsortop::pg_catalog.regoperator, " @@ -12956,7 +13610,7 @@ dumpAgg(Archive *fout, AggInfo *agginfo) if (strcmp(aggcombinefn, "-") != 0) { - appendPQExpBuffer(details, ",\n COMBINEFUNC = %s", aggcombinefn); + appendPQExpBuffer(details, ",\n COMBINEFUNC = %s", aggcombinefn); } /* @@ -12965,9 +13619,9 @@ dumpAgg(Archive *fout, AggInfo *agginfo) */ if (strcmp(aggserialfn, "-") != 0) { - appendPQExpBuffer(details, ",\n SERIALFUNC = %s", aggserialfn); - appendPQExpBuffer(details, ",\n DESERIALFUNC = %s", aggdeserialfn); - appendPQExpBuffer(details, ",\n SERIALTYPE = %s", aggserialtype); + appendPQExpBuffer(details, ",\n SERIALFUNC = %s", aggserialfn); + appendPQExpBuffer(details, ",\n DESERIALFUNC = %s", aggdeserialfn); + appendPQExpBuffer(details, ",\n SERIALTYPE = %s", aggserialtype); } if (strcmp(aggmtransfn, "-") != 0) @@ -13047,7 +13701,7 @@ dumpAgg(Archive *fout, AggInfo *agginfo) dumpSecLabel(fout, labelq->data, agginfo->aggfn.dobj.namespace->dobj.name, agginfo->aggfn.rolname, - agginfo->aggfn.dobj.catId, 0, agginfo->aggfn.dobj.dumpId); + agginfo->aggfn.dobj.catId, 0, agginfo->aggfn.dobj.dumpId); /* * Since there is no GRANT ON AGGREGATE syntax, we have to make the ACL @@ -13065,7 +13719,9 @@ dumpAgg(Archive *fout, AggInfo *agginfo) "FUNCTION", aggsig, NULL, aggsig_tag, agginfo->aggfn.dobj.namespace->dobj.name, - agginfo->aggfn.rolname, agginfo->aggfn.proacl); + agginfo->aggfn.rolname, agginfo->aggfn.proacl, + agginfo->aggfn.rproacl, + agginfo->aggfn.initproacl, agginfo->aggfn.initrproacl); free(aggsig); if (aggfullsig) @@ -13509,7 +14165,8 @@ dumpForeignDataWrapper(Archive *fout, FdwInfo *fdwinfo) "FOREIGN DATA WRAPPER", qfdwname, NULL, fdwinfo->dobj.name, NULL, fdwinfo->rolname, - fdwinfo->fdwacl); + fdwinfo->fdwacl, fdwinfo->rfdwacl, + fdwinfo->initfdwacl, fdwinfo->initrfdwacl); /* Dump Foreign Data Wrapper Comments */ if (fdwinfo->dobj.dump & DUMP_COMPONENT_COMMENT) @@ -13605,7 +14262,8 @@ dumpForeignServer(Archive *fout, ForeignServerInfo *srvinfo) "FOREIGN SERVER", qsrvname, NULL, srvinfo->dobj.name, NULL, srvinfo->rolname, - srvinfo->srvacl); + srvinfo->srvacl, srvinfo->rsrvacl, + srvinfo->initsrvacl, srvinfo->initrsrvacl); /* Dump user mappings */ if (srvinfo->dobj.dump & DUMP_COMPONENT_USERMAP) @@ -13784,7 +14442,7 @@ dumpDefaultACL(Archive *fout, DefaultACLInfo *daclinfo) if (daclinfo->dobj.dump & DUMP_COMPONENT_ACL) ArchiveEntry(fout, daclinfo->dobj.catId, daclinfo->dobj.dumpId, tag->data, - daclinfo->dobj.namespace ? daclinfo->dobj.namespace->dobj.name : NULL, + daclinfo->dobj.namespace ? daclinfo->dobj.namespace->dobj.name : NULL, NULL, daclinfo->defaclrole, false, "DEFAULT ACL", SECTION_POST_DATA, @@ -13811,13 +14469,16 @@ dumpDefaultACL(Archive *fout, DefaultACLInfo *daclinfo) * 'owner' is the owner, NULL if there is no owner (for languages). * 'acls' is the string read out of the fooacl system catalog field; * it will be parsed here. + * 'racls' contains any initial ACLs that the object had which have now been + * revoked by the user, it will also be parsed here. *---------- */ static void dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId, const char *type, const char *name, const char *subname, const char *tag, const char *nspname, const char *owner, - const char *acls) + const char *acls, const char *racls, + const char *initacls, const char *initracls) { DumpOptions *dopt = fout->dopt; PQExpBuffer sql; @@ -13832,11 +14493,30 @@ dumpACL(Archive *fout, CatalogId objCatId, DumpId objDumpId, sql = createPQExpBuffer(); - if (!buildACLCommands(name, subname, type, acls, owner, + /* + * Check to see if this object has had any initial ACLs included for it. + * If so, we are in binary upgrade mode and these are the ACLs to turn + * into GRANT and REVOKE statements to set and record the initial + * privileges for an extension object. Let the backend know that these + * are to be recorded by calling binary_upgrade_set_record_init_privs() + * before and after. + */ + if (strlen(initacls) != 0 || strlen(initracls) != 0) + { + appendPQExpBuffer(sql, "SELECT binary_upgrade_set_record_init_privs(true);\n"); + if (!buildACLCommands(name, subname, type, initacls, initracls, owner, + "", fout->remoteVersion, sql)) + exit_horribly(NULL, + "could not parse initial GRANT ACL list (%s) or initial REVOKE ACL list (%s) for object \"%s\" (%s)\n", + initacls, initracls, name, type); + appendPQExpBuffer(sql, "SELECT binary_upgrade_set_record_init_privs(false);\n"); + } + + if (!buildACLCommands(name, subname, type, acls, racls, owner, "", fout->remoteVersion, sql)) exit_horribly(NULL, - "could not parse ACL list (%s) for object \"%s\" (%s)\n", - acls, name, type); + "could not parse GRANT ACL list (%s) or REVOKE ACL list (%s) for object \"%s\" (%s)\n", + acls, racls, name, type); if (sql->len > 0) ArchiveEntry(fout, nilCatalogId, createDumpId(), @@ -14159,7 +14839,8 @@ collectSecLabels(Archive *fout, SecLabelItem **items) static void dumpTable(Archive *fout, TableInfo *tbinfo) { - char *namecopy; + DumpOptions *dopt = fout->dopt; + char *namecopy; if (tbinfo->relkind == RELKIND_SEQUENCE) dumpSequence(fout, tbinfo); @@ -14174,12 +14855,13 @@ dumpTable(Archive *fout, TableInfo *tbinfo) "TABLE", namecopy, NULL, tbinfo->dobj.name, tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, - tbinfo->relacl); + tbinfo->relacl, tbinfo->rrelacl, + tbinfo->initrelacl, tbinfo->initrrelacl); /* - * Handle column ACLs, if any. Note: we pull these with a separate - * query rather than trying to fetch them during getTableAttrs, so - * that we won't miss ACLs on system columns. + * Handle column ACLs, if any. Note: we pull these with a separate query + * rather than trying to fetch them during getTableAttrs, so that we won't + * miss ACLs on system columns. */ if (fout->remoteVersion >= 80400 && tbinfo->dobj.dump & DUMP_COMPONENT_ACL) { @@ -14187,18 +14869,65 @@ dumpTable(Archive *fout, TableInfo *tbinfo) PGresult *res; int i; - appendPQExpBuffer(query, - "SELECT attname, attacl FROM pg_catalog.pg_attribute " - "WHERE attrelid = '%u' AND NOT attisdropped " - "AND attacl IS NOT NULL " - "ORDER BY attnum", - tbinfo->dobj.catId.oid); + if (fout->remoteVersion >= 90600) + { + PQExpBuffer acl_subquery = createPQExpBuffer(); + PQExpBuffer racl_subquery = createPQExpBuffer(); + PQExpBuffer initacl_subquery = createPQExpBuffer(); + PQExpBuffer initracl_subquery = createPQExpBuffer(); + + buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, + initracl_subquery, "at.attacl", "c.relowner", "'c'", + dopt->binary_upgrade); + + appendPQExpBuffer(query, + "SELECT at.attname, " + "%s AS attacl, " + "%s AS rattacl, " + "%s AS initattacl, " + "%s AS initrattacl " + "FROM pg_catalog.pg_attribute at " + "JOIN pg_catalog.pg_class c ON (at.attrelid = c.oid) " + "LEFT JOIN pg_init_privs pip ON " + "(pip.classoid = " + "(SELECT oid FROM pg_class WHERE relname = 'pg_class') AND " + " at.attrelid = pip.objoid AND at.attnum = pip.objsubid) " + "WHERE at.attrelid = '%u' AND " + "NOT at.attisdropped " + "AND at.attacl IS NOT NULL " + "ORDER BY at.attnum", + acl_subquery->data, + racl_subquery->data, + initacl_subquery->data, + initracl_subquery->data, + tbinfo->dobj.catId.oid); + + destroyPQExpBuffer(acl_subquery); + destroyPQExpBuffer(racl_subquery); + destroyPQExpBuffer(initacl_subquery); + destroyPQExpBuffer(initracl_subquery); + } + else + { + appendPQExpBuffer(query, + "SELECT attname, attacl, NULL as rattacl, " + "NULL AS initattacl, NULL AS initrattacl " + "FROM pg_catalog.pg_attribute " + "WHERE attrelid = '%u' AND NOT attisdropped " + "AND attacl IS NOT NULL " + "ORDER BY attnum", + tbinfo->dobj.catId.oid); + } + res = ExecuteSqlQuery(fout, query->data, PGRES_TUPLES_OK); for (i = 0; i < PQntuples(res); i++) { char *attname = PQgetvalue(res, i, 0); char *attacl = PQgetvalue(res, i, 1); + char *rattacl = PQgetvalue(res, i, 2); + char *initattacl = PQgetvalue(res, i, 3); + char *initrattacl = PQgetvalue(res, i, 4); char *attnamecopy; char *acltag; @@ -14208,7 +14937,7 @@ dumpTable(Archive *fout, TableInfo *tbinfo) dumpACL(fout, tbinfo->dobj.catId, tbinfo->dobj.dumpId, "TABLE", namecopy, attnamecopy, acltag, tbinfo->dobj.namespace->dobj.name, tbinfo->rolname, - attacl); + attacl, rattacl, initattacl, initrattacl); free(attnamecopy); free(acltag); } @@ -14905,7 +15634,7 @@ dumpTableSchema(Archive *fout, TableInfo *tbinfo) (strcmp(reltypename, "TABLE") == 0) ? tbinfo->hasoids : false, reltypename, tbinfo->postponed_def ? - SECTION_POST_DATA : SECTION_PRE_DATA, + SECTION_POST_DATA : SECTION_PRE_DATA, q->data, delq->data, NULL, NULL, 0, NULL, NULL); @@ -15889,15 +16618,15 @@ dumpTrigger(Archive *fout, TriggerInfo *tginfo) fmtId(tbinfo->dobj.name)); if (tginfo->dobj.dump & DUMP_COMPONENT_DEFINITION) - ArchiveEntry(fout, tginfo->dobj.catId, tginfo->dobj.dumpId, - tginfo->dobj.name, - tbinfo->dobj.namespace->dobj.name, - NULL, - tbinfo->rolname, false, - "TRIGGER", SECTION_POST_DATA, - query->data, delqry->data, NULL, - NULL, 0, - NULL, NULL); + ArchiveEntry(fout, tginfo->dobj.catId, tginfo->dobj.dumpId, + tginfo->dobj.name, + tbinfo->dobj.namespace->dobj.name, + NULL, + tbinfo->rolname, false, + "TRIGGER", SECTION_POST_DATA, + query->data, delqry->data, NULL, + NULL, 0, + NULL, NULL); if (tginfo->dobj.dump & DUMP_COMPONENT_COMMENT) dumpComment(fout, labelq->data, @@ -16284,7 +17013,7 @@ processExtensionTables(Archive *fout, ExtensionInfo extinfo[], TableInfo *configtbl; Oid configtbloid = atooid(extconfigarray[j]); bool dumpobj = - curext->dobj.dump & DUMP_COMPONENT_DEFINITION; + curext->dobj.dump & DUMP_COMPONENT_DEFINITION; configtbl = findTableByOid(configtbloid); if (configtbl == NULL) @@ -16304,7 +17033,7 @@ processExtensionTables(Archive *fout, ExtensionInfo extinfo[], /* check table's schema explicitly requested */ if (configtbl->dobj.namespace->dobj.dump & - DUMP_COMPONENT_DATA) + DUMP_COMPONENT_DATA) dumpobj = true; } diff --git a/src/bin/pg_dump/pg_dump.h b/src/bin/pg_dump/pg_dump.h index 85f9f48..7314cbe 100644 --- a/src/bin/pg_dump/pg_dump.h +++ b/src/bin/pg_dump/pg_dump.h @@ -113,6 +113,9 @@ typedef struct _namespaceInfo DumpableObject dobj; char *rolname; /* name of owner, or empty string */ char *nspacl; + char *rnspacl; + char *initnspacl; + char *initrnspacl; } NamespaceInfo; typedef struct _extensionInfo @@ -135,6 +138,9 @@ typedef struct _typeInfo */ char *rolname; /* name of owner, or empty string */ char *typacl; + char *rtypacl; + char *inittypacl; + char *initrtypacl; Oid typelem; Oid typrelid; char typrelkind; /* 'r', 'v', 'c', etc */ @@ -164,6 +170,9 @@ typedef struct _funcInfo Oid *argtypes; Oid prorettype; char *proacl; + char *rproacl; + char *initproacl; + char *initrproacl; } FuncInfo; /* AggInfo is a superset of FuncInfo */ @@ -220,6 +229,9 @@ typedef struct _tableInfo DumpableObject dobj; char *rolname; /* name of owner, or empty string */ char *relacl; + char *rrelacl; + char *initrelacl; + char *initrrelacl; char relkind; char relpersistence; /* relation persistence */ bool relispopulated; /* relation is populated */ @@ -388,6 +400,9 @@ typedef struct _procLangInfo Oid laninline; Oid lanvalidator; char *lanacl; + char *rlanacl; + char *initlanacl; + char *initrlanacl; char *lanowner; /* name of owner, or empty string */ } ProcLangInfo; @@ -457,6 +472,9 @@ typedef struct _fdwInfo char *fdwvalidator; char *fdwoptions; char *fdwacl; + char *rfdwacl; + char *initfdwacl; + char *initrfdwacl; } FdwInfo; typedef struct _foreignServerInfo @@ -467,6 +485,9 @@ typedef struct _foreignServerInfo char *srvtype; char *srvversion; char *srvacl; + char *rsrvacl; + char *initsrvacl; + char *initrsrvacl; char *srvoptions; } ForeignServerInfo; @@ -483,6 +504,9 @@ typedef struct _blobInfo DumpableObject dobj; char *rolname; char *blobacl; + char *rblobacl; + char *initblobacl; + char *initrblobacl; } BlobInfo; /* diff --git a/src/bin/pg_dump/pg_dumpall.c b/src/bin/pg_dump/pg_dumpall.c index 530d3f4..a594937 100644 --- a/src/bin/pg_dump/pg_dumpall.c +++ b/src/bin/pg_dump/pg_dumpall.c @@ -1113,8 +1113,8 @@ dumpTablespaces(PGconn *conn) fspcname, spcoptions); if (!skip_acls && - !buildACLCommands(fspcname, NULL, "TABLESPACE", spcacl, spcowner, - "", server_version, buf)) + !buildACLCommands(fspcname, NULL, "TABLESPACE", spcacl, "", + spcowner, "", server_version, buf)) { fprintf(stderr, _("%s: could not parse ACL list (%s) for tablespace \"%s\"\n"), progname, spcacl, fspcname); @@ -1444,7 +1444,7 @@ dumpCreateDB(PGconn *conn) } if (!skip_acls && - !buildACLCommands(fdbname, NULL, "DATABASE", dbacl, dbowner, + !buildACLCommands(fdbname, NULL, "DATABASE", dbacl, "", dbowner, "", server_version, buf)) { fprintf(stderr, _("%s: could not parse ACL list (%s) for database \"%s\"\n"), diff --git a/src/include/catalog/binary_upgrade.h b/src/include/catalog/binary_upgrade.h index e7da413..709373c 100644 --- a/src/include/catalog/binary_upgrade.h +++ b/src/include/catalog/binary_upgrade.h @@ -30,4 +30,6 @@ extern PGDLLIMPORT Oid binary_upgrade_next_toast_pg_class_oid; extern PGDLLIMPORT Oid binary_upgrade_next_pg_enum_oid; extern PGDLLIMPORT Oid binary_upgrade_next_pg_authid_oid; +extern PGDLLIMPORT bool binary_upgrade_record_init_privs; + #endif /* BINARY_UPGRADE_H */ diff --git a/src/include/catalog/pg_proc.h b/src/include/catalog/pg_proc.h index a0edf93..bf2c05b 100644 --- a/src/include/catalog/pg_proc.h +++ b/src/include/catalog/pg_proc.h @@ -5239,6 +5239,8 @@ DATA(insert OID = 3590 ( binary_upgrade_set_next_pg_authid_oid PGNSP PGUID 12 1 DESCR("for use by pg_upgrade"); DATA(insert OID = 3591 ( binary_upgrade_create_empty_extension PGNSP PGUID 12 1 0 0 0 f f f f f f v r 7 0 2278 "25 25 16 25 1028 1009 1009" _null_ _null_ _null_ _null_ _null_ binary_upgrade_create_empty_extension _null_ _null_ _null_ )); DESCR("for use by pg_upgrade"); +DATA(insert OID = 3577 ( binary_upgrade_set_record_init_privs PGNSP PGUID 12 1 0 0 0 f f f f t f v r 1 0 2278 "16" _null_ _null_ _null_ _null_ _null_ binary_upgrade_set_record_init_privs _null_ _null_ _null_ )); +DESCR("for use by pg_upgrade"); /* replication/origin.h */ DATA(insert OID = 6003 ( pg_replication_origin_create PGNSP PGUID 12 1 0 0 0 f f f f t f v u 1 0 26 "25" _null_ _null_ _null_ _null_ _null_ pg_replication_origin_create _null_ _null_ _null_ )); diff --git a/src/test/regress/expected/init_privs.out b/src/test/regress/expected/init_privs.out new file mode 100644 index 0000000..980940f --- /dev/null +++ b/src/test/regress/expected/init_privs.out @@ -0,0 +1,13 @@ +-- Test iniital privileges +-- There should always be some initial privileges, set up by initdb +SELECT count(*) > 0 FROM pg_init_privs; + ?column? +---------- + t +(1 row) + +CREATE ROLE init_privs_test_role1; +CREATE ROLE init_privs_test_role2; +-- Intentionally include some non-initial privs for pg_dump to dump out +GRANT SELECT ON pg_proc TO init_privs_test_role1; +GRANT SELECT (prosrc) ON pg_proc TO init_privs_test_role2; diff --git a/src/test/regress/parallel_schedule b/src/test/regress/parallel_schedule index 7c7b58d..6c1f21b 100644 --- a/src/test/regress/parallel_schedule +++ b/src/test/regress/parallel_schedule @@ -84,7 +84,7 @@ test: select_into select_distinct select_distinct_on select_implicit select_havi # ---------- # Another group of parallel tests # ---------- -test: brin gin gist spgist privileges security_label collate matview lock replica_identity rowsecurity object_address tablesample groupingsets drop_operator +test: brin gin gist spgist privileges init_privs security_label collate matview lock replica_identity rowsecurity object_address tablesample groupingsets drop_operator # ---------- # Another group of parallel tests diff --git a/src/test/regress/serial_schedule b/src/test/regress/serial_schedule index 1b66516..8269c52 100644 --- a/src/test/regress/serial_schedule +++ b/src/test/regress/serial_schedule @@ -105,6 +105,7 @@ test: gin test: gist test: spgist test: privileges +test: init_privs test: security_label test: collate test: matview diff --git a/src/test/regress/sql/init_privs.sql b/src/test/regress/sql/init_privs.sql new file mode 100644 index 0000000..38d4a88 --- /dev/null +++ b/src/test/regress/sql/init_privs.sql @@ -0,0 +1,11 @@ +-- Test iniital privileges + +-- There should always be some initial privileges, set up by initdb +SELECT count(*) > 0 FROM pg_init_privs; + +CREATE ROLE init_privs_test_role1; +CREATE ROLE init_privs_test_role2; + +-- Intentionally include some non-initial privs for pg_dump to dump out +GRANT SELECT ON pg_proc TO init_privs_test_role1; +GRANT SELECT (prosrc) ON pg_proc TO init_privs_test_role2; -- 2.5.0 From 3c10f0ca8c4e8c1044c746d6154215de54037302 Mon Sep 17 00:00:00 2001 From: Stephen Frost Date: Mon, 14 Mar 2016 11:05:25 -0400 Subject: [PATCH 5/5] Use GRANT system to manage access to sensitive functions Now that pg_dump will properly dump out any ACL changes made to functions which exist in pg_catalog, switch to using the GRANT system to manage access to those functions. This means removing 'if (!superuser()) ereport()' checks from the functions themselves and then REVOKEing EXECUTE right from 'public' for these functions in system_views.sql. --- doc/src/sgml/backup.sgml | 8 +++-- doc/src/sgml/func.sgml | 19 ++++++------ doc/src/sgml/monitoring.sgml | 12 +++++--- src/backend/access/transam/xlogfuncs.c | 56 +++++++++++++--------------------- src/backend/catalog/system_views.sql | 21 +++++++++++++ src/backend/postmaster/pgstat.c | 24 ++++++--------- src/backend/utils/adt/misc.c | 16 ++++------ 7 files changed, 81 insertions(+), 75 deletions(-) diff --git a/doc/src/sgml/backup.sgml b/doc/src/sgml/backup.sgml index 9092cf8..8c65df2 100644 --- a/doc/src/sgml/backup.sgml +++ b/doc/src/sgml/backup.sgml @@ -826,7 +826,9 @@ test ! -f /mnt/server/archivedir/00000001000000A900000065 && cp pg_xlog/ - Connect to the database as a superuser and issue the command: + Connect to the database as a user with rights to run pg_start_backup + (superuser, or a user who has been granted EXECUTE on the function) + and issue the command: SELECT pg_start_backup('label'); @@ -877,7 +879,9 @@ SELECT pg_start_backup('label', true); - Again connect to the database as a superuser, and issue the command: + Again connect to the database as a user with rights to run + pg_stop_backup (superuser, or a user who has been granted EXECUTE on + the function), and issue the command: SELECT pg_stop_backup(); diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml index c6017e6..acba5b4 100644 --- a/doc/src/sgml/func.sgml +++ b/doc/src/sgml/func.sgml @@ -17302,8 +17302,9 @@ SELECT set_config('log_statement_stats', 'off', false); The functions shown in send control signals to - other server processes. Use of these functions is usually restricted - to superusers, with noted exceptions. + other server processes. Use of these functions is restricted to + superusers by default but access may be granted to others with the + GRANT, with noted exceptions. @@ -17453,7 +17454,7 @@ SELECT set_config('log_statement_stats', 'off', false); pg_create_restore_point(name text)pg_lsn - Create a named point for performing restore (restricted to superusers) + Create a named point for performing restore (restricted to superusers by default, but other users can be granted EXECUTE to run the function) @@ -17481,21 +17482,21 @@ SELECT set_config('log_statement_stats', 'off', false); pg_start_backup(label text , fast boolean , exclusive boolean ) pg_lsn - Prepare for performing on-line backup (restricted to superusers or replication roles) + Prepare for performing on-line backup (restricted to superusers by default, but other users can be granted EXECUTE to run the function) pg_stop_backup() pg_lsn - Finish performing exclusive on-line backup (restricted to superusers or replication roles) + Finish performing exclusive on-line backup (restricted to superusers by default, but other users can be granted EXECUTE to run the function) pg_stop_backup(exclusive boolean) setof record - Finish performing exclusive or non-exclusive on-line backup (restricted to superusers or replication roles) + Finish performing exclusive or non-exclusive on-line backup (restricted to superusers by default, but other users can be granted EXECUTE to run the function) @@ -17516,7 +17517,7 @@ SELECT set_config('log_statement_stats', 'off', false); pg_switch_xlog() pg_lsn - Force switch to a new transaction log file (restricted to superusers) + Force switch to a new transaction log file (restricted to superusers by default, but other users can be granted EXECUTE to run the function) @@ -17784,7 +17785,7 @@ postgres=# SELECT * FROM pg_xlogfile_name_offset(pg_stop_backup()); pg_xlog_replay_pause() void - Pauses recovery immediately (restricted to superusers). + Pauses recovery immediately (restricted to superusers by default, but other users can be granted EXECUTE to run the function). @@ -17792,7 +17793,7 @@ postgres=# SELECT * FROM pg_xlogfile_name_offset(pg_stop_backup()); pg_xlog_replay_resume() void - Restarts recovery if it was paused (restricted to superusers). + Restarts recovery if it was paused (restricted to superusers by default, but other users can be granted EXECUTE to run the function). diff --git a/doc/src/sgml/monitoring.sgml b/doc/src/sgml/monitoring.sgml index 105d541..5ab3acc 100644 --- a/doc/src/sgml/monitoring.sgml +++ b/doc/src/sgml/monitoring.sgml @@ -2289,7 +2289,8 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i void Reset all statistics counters for the current database to zero - (requires superuser privileges) + (requires superuser privileges by default, but EXECUTE for this + function can be granted to others.) @@ -2298,7 +2299,8 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i void Reset some cluster-wide statistics counters to zero, depending on the - argument (requires superuser privileges). + argument (requires superuser privileges by default, but EXECUTE for + this functiion can be granted to others). Calling pg_stat_reset_shared('bgwriter') will zero all the counters shown in the pg_stat_bgwriter view. Calling pg_stat_reset_shared('archiver') will zero all the @@ -2311,7 +2313,8 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i void Reset statistics for a single table or index in the current database to - zero (requires superuser privileges) + zero (requires superuser privileges by default, but EXECUTE for this + function can be granted to others) @@ -2320,7 +2323,8 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i void Reset statistics for a single function in the current database to - zero (requires superuser privileges) + zero (requires superuser privileges by default, but EXECUTE for this + function can be granted to others) diff --git a/src/backend/access/transam/xlogfuncs.c b/src/backend/access/transam/xlogfuncs.c index 6a2fffc..d69a924 100644 --- a/src/backend/access/transam/xlogfuncs.c +++ b/src/backend/access/transam/xlogfuncs.c @@ -66,6 +66,9 @@ nonexclusive_base_backup_cleanup(int code, Datum arg) * contains the user-supplied label string (typically this would be used * to tell where the backup dump will be stored) and the starting time and * starting WAL location for the dump. + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_start_backup(PG_FUNCTION_ARGS) @@ -79,11 +82,6 @@ pg_start_backup(PG_FUNCTION_ARGS) backupidstr = text_to_cstring(backupid); - if (!superuser() && !has_rolreplication(GetUserId())) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("must be superuser or replication role to run a backup"))); - if (exclusive_backup_running || nonexclusive_backup_running) ereport(ERROR, (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE), @@ -142,17 +140,15 @@ pg_start_backup(PG_FUNCTION_ARGS) * Note: this version is only called to stop an exclusive backup. The function * pg_stop_backup_v2 (overloaded as pg_stop_backup in SQL) is called to * stop non-exclusive backups. + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_stop_backup(PG_FUNCTION_ARGS) { XLogRecPtr stoppoint; - if (!superuser() && !has_rolreplication(GetUserId())) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be superuser or replication role to run a backup")))); - if (nonexclusive_backup_running) ereport(ERROR, (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE), @@ -179,6 +175,9 @@ pg_stop_backup(PG_FUNCTION_ARGS) * Works the same as pg_stop_backup, except for non-exclusive backups it returns * the backup label and tablespace map files as text fields in as part of the * resultset. + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_stop_backup_v2(PG_FUNCTION_ARGS) @@ -205,11 +204,6 @@ pg_stop_backup_v2(PG_FUNCTION_ARGS) errmsg("materialize mode required, but it is not " \ "allowed in this context"))); - if (!superuser() && !has_rolreplication(GetUserId())) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be superuser or replication role to run a backup")))); - /* Build a tuple descriptor for our result type */ if (get_call_result_type(fcinfo, NULL, &tupdesc) != TYPEFUNC_COMPOSITE) elog(ERROR, "return type must be a row type"); @@ -285,17 +279,15 @@ pg_stop_backup_v2(PG_FUNCTION_ARGS) /* * pg_switch_xlog: switch to next xlog file + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_switch_xlog(PG_FUNCTION_ARGS) { XLogRecPtr switchpoint; - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be superuser to switch transaction log files")))); - if (RecoveryInProgress()) ereport(ERROR, (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE), @@ -312,6 +304,9 @@ pg_switch_xlog(PG_FUNCTION_ARGS) /* * pg_create_restore_point: a named point for restore + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_create_restore_point(PG_FUNCTION_ARGS) @@ -320,11 +315,6 @@ pg_create_restore_point(PG_FUNCTION_ARGS) char *restore_name_str; XLogRecPtr restorepoint; - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be superuser to create a restore point")))); - if (RecoveryInProgress()) ereport(ERROR, (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE), @@ -546,15 +536,13 @@ pg_xlogfile_name(PG_FUNCTION_ARGS) /* * pg_xlog_replay_pause - pause recovery now + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_xlog_replay_pause(PG_FUNCTION_ARGS) { - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be superuser to control recovery")))); - if (!RecoveryInProgress()) ereport(ERROR, (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE), @@ -568,15 +556,13 @@ pg_xlog_replay_pause(PG_FUNCTION_ARGS) /* * pg_xlog_replay_resume - resume recovery now + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_xlog_replay_resume(PG_FUNCTION_ARGS) { - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be superuser to control recovery")))); - if (!RecoveryInProgress()) ereport(ERROR, (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE), diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql index 2bd40a1..25b9511 100644 --- a/src/backend/catalog/system_views.sql +++ b/src/backend/catalog/system_views.sql @@ -997,3 +997,24 @@ RETURNS text[] LANGUAGE INTERNAL STRICT IMMUTABLE AS 'parse_ident'; + +-- The default permissions for functions mean that anyone can execute them. +-- A number of functions shouldn't be executable by just anyone, but rather +-- than use explicit 'superuser()' checks in those functions, we use the GRANT +-- system to REVOKE access to those functions at initdb time. Administrators +-- can later change who can access these functions, or leave them as only +-- available to superuser / cluster owner, if they choose. +REVOKE EXECUTE ON FUNCTION pg_start_backup(text, boolean, boolean) FROM public; +REVOKE EXECUTE ON FUNCTION pg_stop_backup() FROM public; +REVOKE EXECUTE ON FUNCTION pg_stop_backup(boolean) FROM public; +REVOKE EXECUTE ON FUNCTION pg_create_restore_point(text) FROM public; +REVOKE EXECUTE ON FUNCTION pg_switch_xlog() FROM public; +REVOKE EXECUTE ON FUNCTION pg_xlog_replay_pause() FROM public; +REVOKE EXECUTE ON FUNCTION pg_xlog_replay_resume() FROM public; +REVOKE EXECUTE ON FUNCTION pg_rotate_logfile() FROM public; +REVOKE EXECUTE ON FUNCTION pg_reload_conf() FROM public; + +REVOKE EXECUTE ON FUNCTION pg_stat_reset() FROM public; +REVOKE EXECUTE ON FUNCTION pg_stat_reset_shared(text) FROM public; +REVOKE EXECUTE ON FUNCTION pg_stat_reset_single_table_counters(oid) FROM public; +REVOKE EXECUTE ON FUNCTION pg_stat_reset_single_function_counters(oid) FROM public; diff --git a/src/backend/postmaster/pgstat.c b/src/backend/postmaster/pgstat.c index 1467355..41f4374 100644 --- a/src/backend/postmaster/pgstat.c +++ b/src/backend/postmaster/pgstat.c @@ -1217,6 +1217,9 @@ pgstat_drop_relation(Oid relid) * pgstat_reset_counters() - * * Tell the statistics collector to reset counters for our database. + * + * Permission checking for this function is managed through the normal + * GRANT system. * ---------- */ void @@ -1227,11 +1230,6 @@ pgstat_reset_counters(void) if (pgStatSock == PGINVALID_SOCKET) return; - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("must be superuser to reset statistics counters"))); - pgstat_setheader(&msg.m_hdr, PGSTAT_MTYPE_RESETCOUNTER); msg.m_databaseid = MyDatabaseId; pgstat_send(&msg, sizeof(msg)); @@ -1241,6 +1239,9 @@ pgstat_reset_counters(void) * pgstat_reset_shared_counters() - * * Tell the statistics collector to reset cluster-wide shared counters. + * + * Permission checking for this function is managed through the normal + * GRANT system. * ---------- */ void @@ -1251,11 +1252,6 @@ pgstat_reset_shared_counters(const char *target) if (pgStatSock == PGINVALID_SOCKET) return; - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("must be superuser to reset statistics counters"))); - if (strcmp(target, "archiver") == 0) msg.m_resettarget = RESET_ARCHIVER; else if (strcmp(target, "bgwriter") == 0) @@ -1274,6 +1270,9 @@ pgstat_reset_shared_counters(const char *target) * pgstat_reset_single_counter() - * * Tell the statistics collector to reset a single counter. + * + * Permission checking for this function is managed through the normal + * GRANT system. * ---------- */ void @@ -1284,11 +1283,6 @@ pgstat_reset_single_counter(Oid objoid, PgStat_Single_Reset_Type type) if (pgStatSock == PGINVALID_SOCKET) return; - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("must be superuser to reset statistics counters"))); - pgstat_setheader(&msg.m_hdr, PGSTAT_MTYPE_RESETSINGLECOUNTER); msg.m_databaseid = MyDatabaseId; msg.m_resettype = type; diff --git a/src/backend/utils/adt/misc.c b/src/backend/utils/adt/misc.c index 6f7c407..ebc7bb3 100644 --- a/src/backend/utils/adt/misc.c +++ b/src/backend/utils/adt/misc.c @@ -321,15 +321,13 @@ pg_terminate_backend(PG_FUNCTION_ARGS) /* * Signal to reload the database configuration + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_reload_conf(PG_FUNCTION_ARGS) { - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be superuser to signal the postmaster")))); - if (kill(PostmasterPid, SIGHUP)) { ereport(WARNING, @@ -343,15 +341,13 @@ pg_reload_conf(PG_FUNCTION_ARGS) /* * Rotate log file + * + * Permission checking for this function is managed through the normal + * GRANT system. */ Datum pg_rotate_logfile(PG_FUNCTION_ARGS) { - if (!superuser()) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be superuser to rotate log files")))); - if (!Logging_collector) { ereport(WARNING, -- 2.5.0