mirror of
https://git.postgresql.org/git/postgresql.git
synced 2024-08-23 22:37:19 +02:00
The code in tqual.c is largely heap specific. Due to the upcoming pluggable storage work, it therefore makes sense to move it into access/heap/ (as the file's header notes, the tqual name isn't very good). But the various statically allocated snapshot and snapshot initialization functions are now (see previous commit) generic and do not depend on functions declared in tqual.h anymore. Therefore move. Also move XidInMVCCSnapshot as that's useful for future AMs, and already used outside of tqual.c. Author: Andres Freund Discussion: https://postgr.es/m/20180703070645.wchpu5muyto5n647@alap3.anarazel.de
736 lines
18 KiB
C
736 lines
18 KiB
C
/* -------------------------------------------------------------------------
|
|
*
|
|
* contrib/sepgsql/relation.c
|
|
*
|
|
* Routines corresponding to relation/attribute objects
|
|
*
|
|
* Copyright (c) 2010-2019, PostgreSQL Global Development Group
|
|
*
|
|
* -------------------------------------------------------------------------
|
|
*/
|
|
#include "postgres.h"
|
|
|
|
#include "access/genam.h"
|
|
#include "access/htup_details.h"
|
|
#include "access/sysattr.h"
|
|
#include "access/table.h"
|
|
#include "catalog/indexing.h"
|
|
#include "catalog/dependency.h"
|
|
#include "catalog/pg_attribute.h"
|
|
#include "catalog/pg_class.h"
|
|
#include "catalog/pg_namespace.h"
|
|
#include "commands/seclabel.h"
|
|
#include "lib/stringinfo.h"
|
|
#include "utils/builtins.h"
|
|
#include "utils/fmgroids.h"
|
|
#include "utils/catcache.h"
|
|
#include "utils/lsyscache.h"
|
|
#include "utils/rel.h"
|
|
#include "utils/snapmgr.h"
|
|
#include "utils/syscache.h"
|
|
|
|
#include "sepgsql.h"
|
|
|
|
static void sepgsql_index_modify(Oid indexOid);
|
|
|
|
/*
|
|
* sepgsql_attribute_post_create
|
|
*
|
|
* This routine assigns a default security label on a newly defined
|
|
* column, using ALTER TABLE ... ADD COLUMN.
|
|
* Note that this routine is not invoked in the case of CREATE TABLE,
|
|
* although it also defines columns in addition to table.
|
|
*/
|
|
void
|
|
sepgsql_attribute_post_create(Oid relOid, AttrNumber attnum)
|
|
{
|
|
Relation rel;
|
|
ScanKeyData skey[2];
|
|
SysScanDesc sscan;
|
|
HeapTuple tuple;
|
|
char *scontext;
|
|
char *tcontext;
|
|
char *ncontext;
|
|
ObjectAddress object;
|
|
Form_pg_attribute attForm;
|
|
StringInfoData audit_name;
|
|
char relkind = get_rel_relkind(relOid);
|
|
|
|
/*
|
|
* Only attributes within regular relations or partition relations have
|
|
* individual security labels.
|
|
*/
|
|
if (relkind != RELKIND_RELATION && relkind != RELKIND_PARTITIONED_TABLE)
|
|
return;
|
|
|
|
/*
|
|
* Compute a default security label of the new column underlying the
|
|
* specified relation, and check permission to create it.
|
|
*/
|
|
rel = table_open(AttributeRelationId, AccessShareLock);
|
|
|
|
ScanKeyInit(&skey[0],
|
|
Anum_pg_attribute_attrelid,
|
|
BTEqualStrategyNumber, F_OIDEQ,
|
|
ObjectIdGetDatum(relOid));
|
|
ScanKeyInit(&skey[1],
|
|
Anum_pg_attribute_attnum,
|
|
BTEqualStrategyNumber, F_INT2EQ,
|
|
Int16GetDatum(attnum));
|
|
|
|
sscan = systable_beginscan(rel, AttributeRelidNumIndexId, true,
|
|
SnapshotSelf, 2, &skey[0]);
|
|
|
|
tuple = systable_getnext(sscan);
|
|
if (!HeapTupleIsValid(tuple))
|
|
elog(ERROR, "could not find tuple for column %d of relation %u",
|
|
attnum, relOid);
|
|
|
|
attForm = (Form_pg_attribute) GETSTRUCT(tuple);
|
|
|
|
scontext = sepgsql_get_client_label();
|
|
tcontext = sepgsql_get_label(RelationRelationId, relOid, 0);
|
|
ncontext = sepgsql_compute_create(scontext, tcontext,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
NameStr(attForm->attname));
|
|
|
|
/*
|
|
* check db_column:{create} permission
|
|
*/
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = 0;
|
|
|
|
initStringInfo(&audit_name);
|
|
appendStringInfo(&audit_name, "%s.%s",
|
|
getObjectIdentity(&object),
|
|
quote_identifier(NameStr(attForm->attname)));
|
|
sepgsql_avc_check_perms_label(ncontext,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
SEPG_DB_COLUMN__CREATE,
|
|
audit_name.data,
|
|
true);
|
|
|
|
/*
|
|
* Assign the default security label on a new procedure
|
|
*/
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = attnum;
|
|
SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, ncontext);
|
|
|
|
systable_endscan(sscan);
|
|
table_close(rel, AccessShareLock);
|
|
|
|
pfree(tcontext);
|
|
pfree(ncontext);
|
|
}
|
|
|
|
/*
|
|
* sepgsql_attribute_drop
|
|
*
|
|
* It checks privileges to drop the supplied column.
|
|
*/
|
|
void
|
|
sepgsql_attribute_drop(Oid relOid, AttrNumber attnum)
|
|
{
|
|
ObjectAddress object;
|
|
char *audit_name;
|
|
char relkind = get_rel_relkind(relOid);
|
|
|
|
if (relkind != RELKIND_RELATION && relkind != RELKIND_PARTITIONED_TABLE)
|
|
return;
|
|
|
|
/*
|
|
* check db_column:{drop} permission
|
|
*/
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = attnum;
|
|
audit_name = getObjectIdentity(&object);
|
|
|
|
sepgsql_avc_check_perms(&object,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
SEPG_DB_COLUMN__DROP,
|
|
audit_name,
|
|
true);
|
|
pfree(audit_name);
|
|
}
|
|
|
|
/*
|
|
* sepgsql_attribute_relabel
|
|
*
|
|
* It checks privileges to relabel the supplied column
|
|
* by the `seclabel'.
|
|
*/
|
|
void
|
|
sepgsql_attribute_relabel(Oid relOid, AttrNumber attnum,
|
|
const char *seclabel)
|
|
{
|
|
ObjectAddress object;
|
|
char *audit_name;
|
|
char relkind = get_rel_relkind(relOid);
|
|
|
|
if (relkind != RELKIND_RELATION && relkind != RELKIND_PARTITIONED_TABLE)
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_WRONG_OBJECT_TYPE),
|
|
errmsg("cannot set security label on non-regular columns")));
|
|
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = attnum;
|
|
audit_name = getObjectIdentity(&object);
|
|
|
|
/*
|
|
* check db_column:{setattr relabelfrom} permission
|
|
*/
|
|
sepgsql_avc_check_perms(&object,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
SEPG_DB_COLUMN__SETATTR |
|
|
SEPG_DB_COLUMN__RELABELFROM,
|
|
audit_name,
|
|
true);
|
|
|
|
/*
|
|
* check db_column:{relabelto} permission
|
|
*/
|
|
sepgsql_avc_check_perms_label(seclabel,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
SEPG_DB_PROCEDURE__RELABELTO,
|
|
audit_name,
|
|
true);
|
|
pfree(audit_name);
|
|
}
|
|
|
|
/*
|
|
* sepgsql_attribute_setattr
|
|
*
|
|
* It checks privileges to alter the supplied column.
|
|
*/
|
|
void
|
|
sepgsql_attribute_setattr(Oid relOid, AttrNumber attnum)
|
|
{
|
|
ObjectAddress object;
|
|
char *audit_name;
|
|
char relkind = get_rel_relkind(relOid);
|
|
|
|
if (relkind != RELKIND_RELATION && relkind != RELKIND_PARTITIONED_TABLE)
|
|
return;
|
|
|
|
/*
|
|
* check db_column:{setattr} permission
|
|
*/
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = attnum;
|
|
audit_name = getObjectIdentity(&object);
|
|
|
|
sepgsql_avc_check_perms(&object,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
SEPG_DB_COLUMN__SETATTR,
|
|
audit_name,
|
|
true);
|
|
pfree(audit_name);
|
|
}
|
|
|
|
/*
|
|
* sepgsql_relation_post_create
|
|
*
|
|
* The post creation hook of relation/attribute
|
|
*/
|
|
void
|
|
sepgsql_relation_post_create(Oid relOid)
|
|
{
|
|
Relation rel;
|
|
ScanKeyData skey;
|
|
SysScanDesc sscan;
|
|
HeapTuple tuple;
|
|
Form_pg_class classForm;
|
|
ObjectAddress object;
|
|
uint16_t tclass;
|
|
char *scontext; /* subject */
|
|
char *tcontext; /* schema */
|
|
char *rcontext; /* relation */
|
|
char *ccontext; /* column */
|
|
char *nsp_name;
|
|
StringInfoData audit_name;
|
|
|
|
/*
|
|
* Fetch catalog record of the new relation. Because pg_class entry is not
|
|
* visible right now, we need to scan the catalog using SnapshotSelf.
|
|
*/
|
|
rel = table_open(RelationRelationId, AccessShareLock);
|
|
|
|
ScanKeyInit(&skey,
|
|
Anum_pg_class_oid,
|
|
BTEqualStrategyNumber, F_OIDEQ,
|
|
ObjectIdGetDatum(relOid));
|
|
|
|
sscan = systable_beginscan(rel, ClassOidIndexId, true,
|
|
SnapshotSelf, 1, &skey);
|
|
|
|
tuple = systable_getnext(sscan);
|
|
if (!HeapTupleIsValid(tuple))
|
|
elog(ERROR, "could not find tuple for relation %u", relOid);
|
|
|
|
classForm = (Form_pg_class) GETSTRUCT(tuple);
|
|
|
|
/* ignore indexes on toast tables */
|
|
if (classForm->relkind == RELKIND_INDEX &&
|
|
classForm->relnamespace == PG_TOAST_NAMESPACE)
|
|
goto out;
|
|
|
|
/*
|
|
* check db_schema:{add_name} permission of the namespace
|
|
*/
|
|
object.classId = NamespaceRelationId;
|
|
object.objectId = classForm->relnamespace;
|
|
object.objectSubId = 0;
|
|
sepgsql_avc_check_perms(&object,
|
|
SEPG_CLASS_DB_SCHEMA,
|
|
SEPG_DB_SCHEMA__ADD_NAME,
|
|
getObjectIdentity(&object),
|
|
true);
|
|
|
|
switch (classForm->relkind)
|
|
{
|
|
case RELKIND_RELATION:
|
|
case RELKIND_PARTITIONED_TABLE:
|
|
tclass = SEPG_CLASS_DB_TABLE;
|
|
break;
|
|
case RELKIND_SEQUENCE:
|
|
tclass = SEPG_CLASS_DB_SEQUENCE;
|
|
break;
|
|
case RELKIND_VIEW:
|
|
tclass = SEPG_CLASS_DB_VIEW;
|
|
break;
|
|
case RELKIND_INDEX:
|
|
/* deal with indexes specially; no need for tclass */
|
|
sepgsql_index_modify(relOid);
|
|
goto out;
|
|
default:
|
|
/* ignore other relkinds */
|
|
goto out;
|
|
}
|
|
|
|
/*
|
|
* Compute a default security label when we create a new relation object
|
|
* under the specified namespace.
|
|
*/
|
|
scontext = sepgsql_get_client_label();
|
|
tcontext = sepgsql_get_label(NamespaceRelationId,
|
|
classForm->relnamespace, 0);
|
|
rcontext = sepgsql_compute_create(scontext, tcontext, tclass,
|
|
NameStr(classForm->relname));
|
|
|
|
/*
|
|
* check db_xxx:{create} permission
|
|
*/
|
|
nsp_name = get_namespace_name(classForm->relnamespace);
|
|
initStringInfo(&audit_name);
|
|
appendStringInfo(&audit_name, "%s.%s",
|
|
quote_identifier(nsp_name),
|
|
quote_identifier(NameStr(classForm->relname)));
|
|
sepgsql_avc_check_perms_label(rcontext,
|
|
tclass,
|
|
SEPG_DB_DATABASE__CREATE,
|
|
audit_name.data,
|
|
true);
|
|
|
|
/*
|
|
* Assign the default security label on the new regular or partitioned
|
|
* relation.
|
|
*/
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = 0;
|
|
SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, rcontext);
|
|
|
|
/*
|
|
* We also assign a default security label on columns of a new table.
|
|
*/
|
|
if (classForm->relkind == RELKIND_RELATION ||
|
|
classForm->relkind == RELKIND_PARTITIONED_TABLE)
|
|
{
|
|
Relation arel;
|
|
ScanKeyData akey;
|
|
SysScanDesc ascan;
|
|
HeapTuple atup;
|
|
Form_pg_attribute attForm;
|
|
|
|
arel = table_open(AttributeRelationId, AccessShareLock);
|
|
|
|
ScanKeyInit(&akey,
|
|
Anum_pg_attribute_attrelid,
|
|
BTEqualStrategyNumber, F_OIDEQ,
|
|
ObjectIdGetDatum(relOid));
|
|
|
|
ascan = systable_beginscan(arel, AttributeRelidNumIndexId, true,
|
|
SnapshotSelf, 1, &akey);
|
|
|
|
while (HeapTupleIsValid(atup = systable_getnext(ascan)))
|
|
{
|
|
attForm = (Form_pg_attribute) GETSTRUCT(atup);
|
|
|
|
resetStringInfo(&audit_name);
|
|
appendStringInfo(&audit_name, "%s.%s.%s",
|
|
quote_identifier(nsp_name),
|
|
quote_identifier(NameStr(classForm->relname)),
|
|
quote_identifier(NameStr(attForm->attname)));
|
|
|
|
ccontext = sepgsql_compute_create(scontext,
|
|
rcontext,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
NameStr(attForm->attname));
|
|
|
|
/*
|
|
* check db_column:{create} permission
|
|
*/
|
|
sepgsql_avc_check_perms_label(ccontext,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
SEPG_DB_COLUMN__CREATE,
|
|
audit_name.data,
|
|
true);
|
|
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = attForm->attnum;
|
|
SetSecurityLabel(&object, SEPGSQL_LABEL_TAG, ccontext);
|
|
|
|
pfree(ccontext);
|
|
}
|
|
systable_endscan(ascan);
|
|
table_close(arel, AccessShareLock);
|
|
}
|
|
pfree(rcontext);
|
|
|
|
out:
|
|
systable_endscan(sscan);
|
|
table_close(rel, AccessShareLock);
|
|
}
|
|
|
|
/*
|
|
* sepgsql_relation_drop
|
|
*
|
|
* It checks privileges to drop the supplied relation.
|
|
*/
|
|
void
|
|
sepgsql_relation_drop(Oid relOid)
|
|
{
|
|
ObjectAddress object;
|
|
char *audit_name;
|
|
uint16_t tclass = 0;
|
|
char relkind = get_rel_relkind(relOid);
|
|
|
|
switch (relkind)
|
|
{
|
|
case RELKIND_RELATION:
|
|
case RELKIND_PARTITIONED_TABLE:
|
|
tclass = SEPG_CLASS_DB_TABLE;
|
|
break;
|
|
case RELKIND_SEQUENCE:
|
|
tclass = SEPG_CLASS_DB_SEQUENCE;
|
|
break;
|
|
case RELKIND_VIEW:
|
|
tclass = SEPG_CLASS_DB_VIEW;
|
|
break;
|
|
case RELKIND_INDEX:
|
|
/* ignore indexes on toast tables */
|
|
if (get_rel_namespace(relOid) == PG_TOAST_NAMESPACE)
|
|
return;
|
|
/* other indexes are handled specially below; no need for tclass */
|
|
break;
|
|
default:
|
|
/* ignore other relkinds */
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* check db_schema:{remove_name} permission
|
|
*/
|
|
object.classId = NamespaceRelationId;
|
|
object.objectId = get_rel_namespace(relOid);
|
|
object.objectSubId = 0;
|
|
audit_name = getObjectIdentity(&object);
|
|
|
|
sepgsql_avc_check_perms(&object,
|
|
SEPG_CLASS_DB_SCHEMA,
|
|
SEPG_DB_SCHEMA__REMOVE_NAME,
|
|
audit_name,
|
|
true);
|
|
pfree(audit_name);
|
|
|
|
/* deal with indexes specially */
|
|
if (relkind == RELKIND_INDEX)
|
|
{
|
|
sepgsql_index_modify(relOid);
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* check db_table/sequence/view:{drop} permission
|
|
*/
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = 0;
|
|
audit_name = getObjectIdentity(&object);
|
|
|
|
sepgsql_avc_check_perms(&object,
|
|
tclass,
|
|
SEPG_DB_TABLE__DROP,
|
|
audit_name,
|
|
true);
|
|
pfree(audit_name);
|
|
|
|
/*
|
|
* check db_column:{drop} permission
|
|
*/
|
|
if (relkind == RELKIND_RELATION || relkind == RELKIND_PARTITIONED_TABLE)
|
|
{
|
|
Form_pg_attribute attForm;
|
|
CatCList *attrList;
|
|
HeapTuple atttup;
|
|
int i;
|
|
|
|
attrList = SearchSysCacheList1(ATTNUM, ObjectIdGetDatum(relOid));
|
|
for (i = 0; i < attrList->n_members; i++)
|
|
{
|
|
atttup = &attrList->members[i]->tuple;
|
|
attForm = (Form_pg_attribute) GETSTRUCT(atttup);
|
|
|
|
if (attForm->attisdropped)
|
|
continue;
|
|
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = attForm->attnum;
|
|
audit_name = getObjectIdentity(&object);
|
|
|
|
sepgsql_avc_check_perms(&object,
|
|
SEPG_CLASS_DB_COLUMN,
|
|
SEPG_DB_COLUMN__DROP,
|
|
audit_name,
|
|
true);
|
|
pfree(audit_name);
|
|
}
|
|
ReleaseCatCacheList(attrList);
|
|
}
|
|
}
|
|
|
|
/*
|
|
* sepgsql_relation_relabel
|
|
*
|
|
* It checks privileges to relabel the supplied relation by the `seclabel'.
|
|
*/
|
|
void
|
|
sepgsql_relation_relabel(Oid relOid, const char *seclabel)
|
|
{
|
|
ObjectAddress object;
|
|
char *audit_name;
|
|
char relkind = get_rel_relkind(relOid);
|
|
uint16_t tclass = 0;
|
|
|
|
if (relkind == RELKIND_RELATION || relkind == RELKIND_PARTITIONED_TABLE)
|
|
tclass = SEPG_CLASS_DB_TABLE;
|
|
else if (relkind == RELKIND_SEQUENCE)
|
|
tclass = SEPG_CLASS_DB_SEQUENCE;
|
|
else if (relkind == RELKIND_VIEW)
|
|
tclass = SEPG_CLASS_DB_VIEW;
|
|
else
|
|
ereport(ERROR,
|
|
(errcode(ERRCODE_WRONG_OBJECT_TYPE),
|
|
errmsg("cannot set security labels on relations except "
|
|
"for tables, sequences or views")));
|
|
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = 0;
|
|
audit_name = getObjectIdentity(&object);
|
|
|
|
/*
|
|
* check db_xxx:{setattr relabelfrom} permission
|
|
*/
|
|
sepgsql_avc_check_perms(&object,
|
|
tclass,
|
|
SEPG_DB_TABLE__SETATTR |
|
|
SEPG_DB_TABLE__RELABELFROM,
|
|
audit_name,
|
|
true);
|
|
|
|
/*
|
|
* check db_xxx:{relabelto} permission
|
|
*/
|
|
sepgsql_avc_check_perms_label(seclabel,
|
|
tclass,
|
|
SEPG_DB_TABLE__RELABELTO,
|
|
audit_name,
|
|
true);
|
|
pfree(audit_name);
|
|
}
|
|
|
|
/*
|
|
* sepgsql_relation_setattr
|
|
*
|
|
* It checks privileges to set attribute of the supplied relation
|
|
*/
|
|
void
|
|
sepgsql_relation_setattr(Oid relOid)
|
|
{
|
|
Relation rel;
|
|
ScanKeyData skey;
|
|
SysScanDesc sscan;
|
|
HeapTuple oldtup;
|
|
HeapTuple newtup;
|
|
Form_pg_class oldform;
|
|
Form_pg_class newform;
|
|
ObjectAddress object;
|
|
char *audit_name;
|
|
uint16_t tclass;
|
|
|
|
switch (get_rel_relkind(relOid))
|
|
{
|
|
case RELKIND_RELATION:
|
|
case RELKIND_PARTITIONED_TABLE:
|
|
tclass = SEPG_CLASS_DB_TABLE;
|
|
break;
|
|
case RELKIND_SEQUENCE:
|
|
tclass = SEPG_CLASS_DB_SEQUENCE;
|
|
break;
|
|
case RELKIND_VIEW:
|
|
tclass = SEPG_CLASS_DB_VIEW;
|
|
break;
|
|
case RELKIND_INDEX:
|
|
/* deal with indexes specially */
|
|
sepgsql_index_modify(relOid);
|
|
return;
|
|
default:
|
|
/* other relkinds don't need additional work */
|
|
return;
|
|
}
|
|
|
|
/*
|
|
* Fetch newer catalog
|
|
*/
|
|
rel = table_open(RelationRelationId, AccessShareLock);
|
|
|
|
ScanKeyInit(&skey,
|
|
Anum_pg_class_oid,
|
|
BTEqualStrategyNumber, F_OIDEQ,
|
|
ObjectIdGetDatum(relOid));
|
|
|
|
sscan = systable_beginscan(rel, ClassOidIndexId, true,
|
|
SnapshotSelf, 1, &skey);
|
|
|
|
newtup = systable_getnext(sscan);
|
|
if (!HeapTupleIsValid(newtup))
|
|
elog(ERROR, "could not find tuple for relation %u", relOid);
|
|
newform = (Form_pg_class) GETSTRUCT(newtup);
|
|
|
|
/*
|
|
* Fetch older catalog
|
|
*/
|
|
oldtup = SearchSysCache1(RELOID, ObjectIdGetDatum(relOid));
|
|
if (!HeapTupleIsValid(oldtup))
|
|
elog(ERROR, "cache lookup failed for relation %u", relOid);
|
|
oldform = (Form_pg_class) GETSTRUCT(oldtup);
|
|
|
|
/*
|
|
* Does this ALTER command takes operation to namespace?
|
|
*/
|
|
if (newform->relnamespace != oldform->relnamespace)
|
|
{
|
|
sepgsql_schema_remove_name(oldform->relnamespace);
|
|
sepgsql_schema_add_name(newform->relnamespace);
|
|
}
|
|
if (strcmp(NameStr(newform->relname), NameStr(oldform->relname)) != 0)
|
|
sepgsql_schema_rename(oldform->relnamespace);
|
|
|
|
/*
|
|
* XXX - In the future version, db_tuple:{use} of system catalog entry
|
|
* shall be checked, if tablespace configuration is changed.
|
|
*/
|
|
|
|
/*
|
|
* check db_xxx:{setattr} permission
|
|
*/
|
|
object.classId = RelationRelationId;
|
|
object.objectId = relOid;
|
|
object.objectSubId = 0;
|
|
audit_name = getObjectIdentity(&object);
|
|
|
|
sepgsql_avc_check_perms(&object,
|
|
tclass,
|
|
SEPG_DB_TABLE__SETATTR,
|
|
audit_name,
|
|
true);
|
|
pfree(audit_name);
|
|
|
|
ReleaseSysCache(oldtup);
|
|
systable_endscan(sscan);
|
|
table_close(rel, AccessShareLock);
|
|
}
|
|
|
|
/*
|
|
* sepgsql_relation_setattr_extra
|
|
*
|
|
* It checks permission of the relation being referenced by extra attributes,
|
|
* such as pg_index entries. Like core PostgreSQL, sepgsql also does not deal
|
|
* with such entries as individual "objects", thus, modification of these
|
|
* entries shall be considered as setting an attribute of the underlying
|
|
* relation.
|
|
*/
|
|
static void
|
|
sepgsql_relation_setattr_extra(Relation catalog,
|
|
Oid catindex_id,
|
|
Oid extra_oid,
|
|
AttrNumber anum_relation_id,
|
|
AttrNumber anum_extra_id)
|
|
{
|
|
ScanKeyData skey;
|
|
SysScanDesc sscan;
|
|
HeapTuple tuple;
|
|
Datum datum;
|
|
bool isnull;
|
|
|
|
ScanKeyInit(&skey, anum_extra_id,
|
|
BTEqualStrategyNumber, F_OIDEQ,
|
|
ObjectIdGetDatum(extra_oid));
|
|
|
|
sscan = systable_beginscan(catalog, catindex_id, true,
|
|
SnapshotSelf, 1, &skey);
|
|
tuple = systable_getnext(sscan);
|
|
if (!HeapTupleIsValid(tuple))
|
|
elog(ERROR, "could not find tuple for object %u in catalog \"%s\"",
|
|
extra_oid, RelationGetRelationName(catalog));
|
|
|
|
datum = heap_getattr(tuple, anum_relation_id,
|
|
RelationGetDescr(catalog), &isnull);
|
|
Assert(!isnull);
|
|
|
|
sepgsql_relation_setattr(DatumGetObjectId(datum));
|
|
|
|
systable_endscan(sscan);
|
|
}
|
|
|
|
/*
|
|
* sepgsql_index_modify
|
|
* Handle index create, update, drop
|
|
*
|
|
* Unlike other relation kinds, indexes do not have their own security labels,
|
|
* so instead of doing checks directly, treat them as extra attributes of their
|
|
* owning tables; so check 'setattr' permissions on the table.
|
|
*/
|
|
static void
|
|
sepgsql_index_modify(Oid indexOid)
|
|
{
|
|
Relation catalog = table_open(IndexRelationId, AccessShareLock);
|
|
|
|
/* check db_table:{setattr} permission of the table being indexed */
|
|
sepgsql_relation_setattr_extra(catalog,
|
|
IndexRelidIndexId,
|
|
indexOid,
|
|
Anum_pg_index_indrelid,
|
|
Anum_pg_index_indexrelid);
|
|
table_close(catalog, AccessShareLock);
|
|
}
|