From 871dfe4b7270aa33d0ed8c05abd59d3c2653bd1e Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Fri, 22 Oct 2021 15:22:26 -0400 Subject: [PATCH] pg_dump: fix mis-dumping of non-global default privileges. Non-global default privilege entries should be dumped as-is, not made relative to the default ACL for their object type. This would typically only matter if one had revoked some on-by-default privileges in a global entry, and then wanted to grant them again in a non-global entry. Per report from Boris Korzun. This is an old bug, so back-patch to all supported branches. Neil Chen, test case by Masahiko Sawada Discussion: https://postgr.es/m/111621616618184@mail.yandex.ru Discussion: https://postgr.es/m/CAA3qoJnr2+1dVJObNtfec=qW4Z0nz=A9+r5bZKoTSy5RDjskMw@mail.gmail.com --- src/bin/pg_dump/pg_dump.c | 19 ++++++++++++++++++- src/bin/pg_dump/t/002_pg_dump.pl | 19 +++++++++++++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c index 542e8af467..8554b6eeb1 100644 --- a/src/bin/pg_dump/pg_dump.c +++ b/src/bin/pg_dump/pg_dump.c @@ -9467,9 +9467,26 @@ getDefaultACLs(Archive *fout, int *numDefaultACLs) PQExpBuffer initacl_subquery = createPQExpBuffer(); PQExpBuffer initracl_subquery = createPQExpBuffer(); + /* + * Global entries (with defaclnamespace=0) replace the hard-wired + * default ACL for their object type. We should dump them as deltas + * from the default ACL, since that will be used as a starting point + * for interpreting the ALTER DEFAULT PRIVILEGES commands. On the + * other hand, non-global entries can only add privileges not revoke + * them. We must dump those as-is (i.e., as deltas from an empty + * ACL). We implement that by passing NULL as the object type for + * acldefault(), which works because acldefault() is STRICT. + * + * We can use defaclobjtype as the object type for acldefault(), + * except for the case of 'S' (DEFACLOBJ_SEQUENCE) which must be + * converted to 's'. + */ buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, initracl_subquery, "defaclacl", "defaclrole", - "CASE WHEN defaclobjtype = 'S' THEN 's' ELSE defaclobjtype END::\"char\"", + "CASE WHEN defaclnamespace = 0 THEN" + " CASE WHEN defaclobjtype = 'S' THEN 's'::\"char\"" + " ELSE defaclobjtype END " + "ELSE NULL END", dopt->binary_upgrade); appendPQExpBuffer(query, "SELECT d.oid, d.tableoid, " diff --git a/src/bin/pg_dump/t/002_pg_dump.pl b/src/bin/pg_dump/t/002_pg_dump.pl index c3cfec8605..f834afaf56 100644 --- a/src/bin/pg_dump/t/002_pg_dump.pl +++ b/src/bin/pg_dump/t/002_pg_dump.pl @@ -410,6 +410,25 @@ my %tests = ( }, }, + 'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role GRANT EXECUTE ON FUNCTIONS' + => { + create_order => 15, + create_sql => 'ALTER DEFAULT PRIVILEGES + FOR ROLE regress_dump_test_role IN SCHEMA dump_test + GRANT EXECUTE ON FUNCTIONS TO regress_dump_test_role;', + regexp => qr/^ + \QALTER DEFAULT PRIVILEGES \E + \QFOR ROLE regress_dump_test_role IN SCHEMA dump_test \E + \QGRANT ALL ON FUNCTIONS TO regress_dump_test_role;\E + /xm, + like => + { %full_runs, %dump_test_schema_runs, section_post_data => 1, }, + unlike => { + exclude_dump_test_schema => 1, + no_privs => 1, + }, + }, + 'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role REVOKE' => { create_order => 55, create_sql => 'ALTER DEFAULT PRIVILEGES