pgsql: Add new catalog called pg_init_privs

Started by Stephen Frostalmost 10 years ago8 messages
#1Stephen Frost
sfrost@snowman.net

Add new catalog called pg_init_privs

This new catalog holds the privileges which the system was
initialized with at initdb time, along with any permissions set
by extensions at CREATE EXTENSION time. This allows pg_dump
(and any other similar use-cases) to detect when the privileges
set on initdb-created or extension-created objects have been
changed from what they were set to at initdb/extension-creation
time and handle those changes appropriately.

Reviews by Alexander Korotkov, Jose Luis Tallon

Branch
------
master

Details
-------
http://git.postgresql.org/pg/commitdiff/6c268df1276e9dd73e4d2cc89cf8787e8f186bda

Modified Files
--------------
doc/src/sgml/catalogs.sgml | 108 +++++++++++++++++++++
src/backend/catalog/Makefile | 2 +-
src/backend/catalog/aclchk.c | 149 +++++++++++++++++++++++++++++
src/backend/catalog/dependency.c | 46 ++++++++-
src/bin/initdb/initdb.c | 143 +++++++++++++++++++++++++++
src/include/catalog/indexing.h | 3 +
src/include/catalog/pg_init_privs.h | 101 +++++++++++++++++++
src/test/regress/expected/sanity_check.out | 1 +
8 files changed, 549 insertions(+), 4 deletions(-)

--
Sent via pgsql-committers mailing list (pgsql-committers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-committers

#2Alvaro Herrera
alvherre@2ndquadrant.com
In reply to: Stephen Frost (#1)
Re: [COMMITTERS] pgsql: Add new catalog called pg_init_privs

Stephen Frost wrote:

Add new catalog called pg_init_privs

This new catalog holds the privileges which the system was
initialized with at initdb time, along with any permissions set
by extensions at CREATE EXTENSION time. This allows pg_dump
(and any other similar use-cases) to detect when the privileges
set on initdb-created or extension-created objects have been
changed from what they were set to at initdb/extension-creation
time and handle those changes appropriately.

If you have an extension that's marked not relocatable and drop it, its
schema is left behind; trying to create the extension again, *crash*.

$ cat /pgsql/install/master/share/extension/crash--1.sql
grant usage on schema @extschema@ to public;

$ cat /pgsql/install/master/share/extension/crash.control
comment = 'crash'
default_version = '1'
relocatable = false
superuser = true
schema = 'crash'

alvherre=# create extension crash;
CREATE EXTENSION
alvherre=# drop extension crash;
DROP EXTENSION
alvherre=# \dn
Listado de esquemas
Nombre | Due�o
--------+----------
crash | alvherre
public | alvherre
(2 filas)

alvherre=# create extension crash;
el servidor ha cerrado la conexi�n inesperadamente
Probablemente se debe a que el servidor termin� de manera anormal
antes o durante el procesamiento de la petici�n.
La conexi�n al servidor se ha perdido. Intentando reiniciar: con �xito.

--
�lvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers

#3Stephen Frost
sfrost@snowman.net
In reply to: Alvaro Herrera (#2)
Re: [COMMITTERS] pgsql: Add new catalog called pg_init_privs

Alvaro,

* Alvaro Herrera (alvherre@2ndquadrant.com) wrote:

Stephen Frost wrote:

Add new catalog called pg_init_privs

This new catalog holds the privileges which the system was
initialized with at initdb time, along with any permissions set
by extensions at CREATE EXTENSION time. This allows pg_dump
(and any other similar use-cases) to detect when the privileges
set on initdb-created or extension-created objects have been
changed from what they were set to at initdb/extension-creation
time and handle those changes appropriately.

If you have an extension that's marked not relocatable and drop it, its
schema is left behind; trying to create the extension again, *crash*.

Will take a look at this, though I'm just about to commit a fix that's
probably related (and addresses Pavel's issue). Basically, for reasons
unknown, I was calling systable_endscan() immediately after
systable_getnext(), which doesn't work when you want to use the tuple
you got back.

Thanks!

Stephen

#4Alvaro Herrera
alvherre@2ndquadrant.com
In reply to: Stephen Frost (#3)
Re: [COMMITTERS] pgsql: Add new catalog called pg_init_privs

Stephen Frost wrote:

Alvaro,

Will take a look at this, though I'm just about to commit a fix that's
probably related (and addresses Pavel's issue). Basically, for reasons
unknown, I was calling systable_endscan() immediately after
systable_getnext(), which doesn't work when you want to use the tuple
you got back.

Yeah, I noticed that bug too. It might well explain the issue, because
the tuple is seen as 0x7f.

#0 heap_deform_tuple (tuple=tuple@entry=0x339f438, tupleDesc=tupleDesc@entry=0x7f680f3dcde0,
values=values@entry=0x3390cd8,
isnull=isnull@entry=0x339f3c8 "\177\177\177\177\177~\177\177h\367\071\003")
at /pgsql/source/master/src/backend/access/common/heaptuple.c:881
#1 0x0000000000479e3a in heap_modify_tuple (tuple=tuple@entry=0x339f438, tupleDesc=0x7f680f3dcde0,
replValues=replValues@entry=0x7ffd662a3770, replIsnull=replIsnull@entry=0x7ffd662a3750 "",
doReplace=doReplace@entry=0x7ffd662a3760 "")
at /pgsql/source/master/src/backend/access/common/heaptuple.c:817
#2 0x0000000000518feb in recordExtensionInitPriv (objoid=46960, classoid=2615, objsubid=0,
new_acl=0x339f188) at /pgsql/source/master/src/backend/catalog/aclchk.c:5305
#3 0x000000000051d2b5 in ExecGrant_Namespace (istmt=<optimized out>)
at /pgsql/source/master/src/backend/catalog/aclchk.c:2942

Not sure what "Pavel's issue" is, since it's not listed in the open
items page.

--
�lvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers

#5Stephen Frost
sfrost@snowman.net
In reply to: Alvaro Herrera (#4)
Re: [COMMITTERS] pgsql: Add new catalog called pg_init_privs

* Alvaro Herrera (alvherre@2ndquadrant.com) wrote:

Stephen Frost wrote:

Alvaro,

Will take a look at this, though I'm just about to commit a fix that's
probably related (and addresses Pavel's issue). Basically, for reasons
unknown, I was calling systable_endscan() immediately after
systable_getnext(), which doesn't work when you want to use the tuple
you got back.

Yeah, I noticed that bug too. It might well explain the issue, because
the tuple is seen as 0x7f.

#0 heap_deform_tuple (tuple=tuple@entry=0x339f438, tupleDesc=tupleDesc@entry=0x7f680f3dcde0,
values=values@entry=0x3390cd8,
isnull=isnull@entry=0x339f3c8 "\177\177\177\177\177~\177\177h\367\071\003")
at /pgsql/source/master/src/backend/access/common/heaptuple.c:881
#1 0x0000000000479e3a in heap_modify_tuple (tuple=tuple@entry=0x339f438, tupleDesc=0x7f680f3dcde0,
replValues=replValues@entry=0x7ffd662a3770, replIsnull=replIsnull@entry=0x7ffd662a3750 "",
doReplace=doReplace@entry=0x7ffd662a3760 "")
at /pgsql/source/master/src/backend/access/common/heaptuple.c:817
#2 0x0000000000518feb in recordExtensionInitPriv (objoid=46960, classoid=2615, objsubid=0,
new_acl=0x339f188) at /pgsql/source/master/src/backend/catalog/aclchk.c:5305
#3 0x000000000051d2b5 in ExecGrant_Namespace (istmt=<optimized out>)
at /pgsql/source/master/src/backend/catalog/aclchk.c:2942

Not sure what "Pavel's issue" is, since it's not listed in the open
items page.

Here's the latest message ID on the thread he started.

CAFj8pRB_8WggxG1EKgfDQ_G_C1p1iLC_j9M3JfLfMLd2Vxt_+w@mail.gmail.com

Pretty sure it's the same issue. Going through testing now and will
push the fix very shortly.

Thanks!

Stephen

#6Alvaro Herrera
alvherre@2ndquadrant.com
In reply to: Stephen Frost (#5)
Re: [COMMITTERS] pgsql: Add new catalog called pg_init_privs

Stephen Frost wrote:

Here's the latest message ID on the thread he started.

CAFj8pRB_8WggxG1EKgfDQ_G_C1p1iLC_j9M3JfLfMLd2Vxt_+w@mail.gmail.com

Pretty sure it's the same issue. Going through testing now and will
push the fix very shortly.

May I suggest adding the extension I showed to
src/test/modules/test_extensions.

--
�lvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services

--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers

#7Stephen Frost
sfrost@snowman.net
In reply to: Alvaro Herrera (#6)
Re: [COMMITTERS] pgsql: Add new catalog called pg_init_privs

Alvaro,

On Friday, April 15, 2016, Alvaro Herrera <alvherre@2ndquadrant.com> wrote:

Stephen Frost wrote:

Here's the latest message ID on the thread he started.

CAFj8pRB_8WggxG1EKgfDQ_G_C1p1iLC_j9M3JfLfMLd2Vxt_+w@mail.gmail.com

<javascript:;>

Pretty sure it's the same issue. Going through testing now and will
push the fix very shortly.

May I suggest adding the extension I showed to
src/test/modules/test_extensions.

Yup, already done and will be included in my commit.

Thanks!

Stephen

#8Stephen Frost
sfrost@snowman.net
In reply to: Alvaro Herrera (#4)
Re: [COMMITTERS] pgsql: Add new catalog called pg_init_privs

* Alvaro Herrera (alvherre@2ndquadrant.com) wrote:

Stephen Frost wrote:

Alvaro,

Will take a look at this, though I'm just about to commit a fix that's
probably related (and addresses Pavel's issue). Basically, for reasons
unknown, I was calling systable_endscan() immediately after
systable_getnext(), which doesn't work when you want to use the tuple
you got back.

Yeah, I noticed that bug too. It might well explain the issue, because
the tuple is seen as 0x7f.

Fix pushed.

Thanks!

Stephen