user.h File Reference

#include "catalog/objectaddress.h"
#include "libpq/crypt.h"
#include "nodes/parsenodes.h"
#include "parser/parse_node.h"
#include "utils/guc.h"

Include dependency graph for user.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Typedefs
typedef void(*	check_password_hook_type) (const char *username, const char *shadow_pass, PasswordType password_type, Datum validuntil_time, bool validuntil_null)

Functions
Oid	CreateRole (ParseState *pstate, CreateRoleStmt *stmt)
Oid	AlterRole (ParseState *pstate, AlterRoleStmt *stmt)
Oid	AlterRoleSet (AlterRoleSetStmt *stmt)
void	DropRole (DropRoleStmt *stmt)
void	GrantRole (ParseState *pstate, GrantRoleStmt *stmt)
ObjectAddress	RenameRole (const char *oldname, const char *newname)
void	DropOwnedObjects (DropOwnedStmt *stmt)
void	ReassignOwnedObjects (ReassignOwnedStmt *stmt)
List *	roleSpecsToIds (List *memberNames)
bool	check_createrole_self_grant (char **newval, void **extra, GucSource source)
void	assign_createrole_self_grant (const char *newval, void *extra)

Variables
PGDLLIMPORT int	Password_encryption
PGDLLIMPORT char *	createrole_self_grant
PGDLLIMPORT check_password_hook_type	check_password_hook

Typedef Documentation

check_password_hook_type

typedef void(* check_password_hook_type) (const char *username, const char *shadow_pass, PasswordType password_type, Datum validuntil_time, bool validuntil_null)

Definition at line 25 of file user.h.

Function Documentation

AlterRole()

Oid AlterRole	(	ParseState *	pstate,
		AlterRoleStmt *	stmt
	)

Definition at line 620 of file user.c.

{
    Datum       new_record[Natts_pg_authid] = {0};
    bool        new_record_nulls[Natts_pg_authid] = {0};
    bool        new_record_repl[Natts_pg_authid] = {0};
    Relation    pg_authid_rel;
    TupleDesc   pg_authid_dsc;
    HeapTuple   tuple,
                new_tuple;
    Form_pg_authid authform;
    ListCell   *option;
    char       *rolename;
    char       *password = NULL;    /* user password */
    int         connlimit = -1; /* maximum connections allowed */
    char       *validUntil = NULL;  /* time the login is valid until */
    Datum       validUntil_datum;   /* same, as timestamptz Datum */
    bool        validUntil_null;
    DefElem    *dpassword = NULL;
    DefElem    *dissuper = NULL;
    DefElem    *dinherit = NULL;
    DefElem    *dcreaterole = NULL;
    DefElem    *dcreatedb = NULL;
    DefElem    *dcanlogin = NULL;
    DefElem    *disreplication = NULL;
    DefElem    *dconnlimit = NULL;
    DefElem    *drolemembers = NULL;
    DefElem    *dvalidUntil = NULL;
    DefElem    *dbypassRLS = NULL;
    Oid         roleid;
    Oid         currentUserId = GetUserId();
    GrantRoleOptions popt;
 
    check_rolespec_name(stmt->role,
                        _("Cannot alter reserved roles."));
 
    /* Extract options from the statement node tree */
    foreach(option, stmt->options)
    {
        DefElem    *defel = (DefElem *) lfirst(option);
 
        if (strcmp(defel->defname, "password") == 0)
        {
            if (dpassword)
                errorConflictingDefElem(defel, pstate);
            dpassword = defel;
        }
        else if (strcmp(defel->defname, "superuser") == 0)
        {
            if (dissuper)
                errorConflictingDefElem(defel, pstate);
            dissuper = defel;
        }
        else if (strcmp(defel->defname, "inherit") == 0)
        {
            if (dinherit)
                errorConflictingDefElem(defel, pstate);
            dinherit = defel;
        }
        else if (strcmp(defel->defname, "createrole") == 0)
        {
            if (dcreaterole)
                errorConflictingDefElem(defel, pstate);
            dcreaterole = defel;
        }
        else if (strcmp(defel->defname, "createdb") == 0)
        {
            if (dcreatedb)
                errorConflictingDefElem(defel, pstate);
            dcreatedb = defel;
        }
        else if (strcmp(defel->defname, "canlogin") == 0)
        {
            if (dcanlogin)
                errorConflictingDefElem(defel, pstate);
            dcanlogin = defel;
        }
        else if (strcmp(defel->defname, "isreplication") == 0)
        {
            if (disreplication)
                errorConflictingDefElem(defel, pstate);
            disreplication = defel;
        }
        else if (strcmp(defel->defname, "connectionlimit") == 0)
        {
            if (dconnlimit)
                errorConflictingDefElem(defel, pstate);
            dconnlimit = defel;
        }
        else if (strcmp(defel->defname, "rolemembers") == 0 &&
                 stmt->action != 0)
        {
            if (drolemembers)
                errorConflictingDefElem(defel, pstate);
            drolemembers = defel;
        }
        else if (strcmp(defel->defname, "validUntil") == 0)
        {
            if (dvalidUntil)
                errorConflictingDefElem(defel, pstate);
            dvalidUntil = defel;
        }
        else if (strcmp(defel->defname, "bypassrls") == 0)
        {
            if (dbypassRLS)
                errorConflictingDefElem(defel, pstate);
            dbypassRLS = defel;
        }
        else
            elog(ERROR, "option \"%s\" not recognized",
                 defel->defname);
    }
 
    if (dpassword && dpassword->arg)
        password = strVal(dpassword->arg);
    if (dconnlimit)
    {
        connlimit = intVal(dconnlimit->arg);
        if (connlimit < -1)
            ereport(ERROR,
                    (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
                     errmsg("invalid connection limit: %d", connlimit)));
    }
    if (dvalidUntil)
        validUntil = strVal(dvalidUntil->arg);
 
    /*
     * Scan the pg_authid relation to be certain the user exists.
     */
    pg_authid_rel = table_open(AuthIdRelationId, RowExclusiveLock);
    pg_authid_dsc = RelationGetDescr(pg_authid_rel);
 
    tuple = get_rolespec_tuple(stmt->role);
    authform = (Form_pg_authid) GETSTRUCT(tuple);
    rolename = pstrdup(NameStr(authform->rolname));
    roleid = authform->oid;
 
    /* To mess with a superuser in any way you gotta be superuser. */
    if (!superuser() && authform->rolsuper)
        ereport(ERROR,
                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                 errmsg("permission denied to alter role"),
                 errdetail("Only roles with the %s attribute may alter roles with %s.",
                           "SUPERUSER", "SUPERUSER")));
    if (!superuser() && dissuper)
        ereport(ERROR,
                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                 errmsg("permission denied to alter role"),
                 errdetail("Only roles with the %s attribute may change the %s attribute.",
                           "SUPERUSER", "SUPERUSER")));
 
    /*
     * Most changes to a role require that you both have CREATEROLE privileges
     * and also ADMIN OPTION on the role.
     */
    if (!have_createrole_privilege() ||
        !is_admin_of_role(GetUserId(), roleid))
    {
        /* things an unprivileged user certainly can't do */
        if (dinherit || dcreaterole || dcreatedb || dcanlogin || dconnlimit ||
            dvalidUntil || disreplication || dbypassRLS)
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to alter role"),
                     errdetail("Only roles with the %s attribute and the %s option on role \"%s\" may alter this role.",
                               "CREATEROLE", "ADMIN", rolename)));
 
        /* an unprivileged user can change their own password */
        if (dpassword && roleid != currentUserId)
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to alter role"),
                     errdetail("To change another role's password, the current user must have the %s attribute and the %s option on the role.",
                               "CREATEROLE", "ADMIN")));
    }
    else if (!superuser())
    {
        /*
         * Even if you have both CREATEROLE and ADMIN OPTION on a role, you
         * can only change the CREATEDB, REPLICATION, or BYPASSRLS attributes
         * if they are set for your own role (or you are the superuser).
         */
        if (dcreatedb && !have_createdb_privilege())
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to alter role"),
                     errdetail("Only roles with the %s attribute may change the %s attribute.",
                               "CREATEDB", "CREATEDB")));
        if (disreplication && !has_rolreplication(currentUserId))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to alter role"),
                     errdetail("Only roles with the %s attribute may change the %s attribute.",
                               "REPLICATION", "REPLICATION")));
        if (dbypassRLS && !has_bypassrls_privilege(currentUserId))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to alter role"),
                     errdetail("Only roles with the %s attribute may change the %s attribute.",
                               "BYPASSRLS", "BYPASSRLS")));
    }
 
    /* To add members to a role, you need ADMIN OPTION. */
    if (drolemembers && !is_admin_of_role(currentUserId, roleid))
        ereport(ERROR,
                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                 errmsg("permission denied to alter role"),
                 errdetail("Only roles with the %s option on role \"%s\" may add members.",
                           "ADMIN", rolename)));
 
    /* Convert validuntil to internal form */
    if (dvalidUntil)
    {
        validUntil_datum = DirectFunctionCall3(timestamptz_in,
                                               CStringGetDatum(validUntil),
                                               ObjectIdGetDatum(InvalidOid),
                                               Int32GetDatum(-1));
        validUntil_null = false;
    }
    else
    {
        /* fetch existing setting in case hook needs it */
        validUntil_datum = SysCacheGetAttr(AUTHNAME, tuple,
                                           Anum_pg_authid_rolvaliduntil,
                                           &validUntil_null);
    }
 
    /*
     * Call the password checking hook if there is one defined
     */
    if (check_password_hook && password)
        (*check_password_hook) (rolename,
                                password,
                                get_password_type(password),
                                validUntil_datum,
                                validUntil_null);
 
    /*
     * Build an updated tuple, perusing the information just obtained
     */
 
    /*
     * issuper/createrole/etc
     */
    if (dissuper)
    {
        bool        should_be_super = boolVal(dissuper->arg);
 
        if (!should_be_super && roleid == BOOTSTRAP_SUPERUSERID)
            ereport(ERROR,
                    (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
                     errmsg("permission denied to alter role"),
                     errdetail("The bootstrap user must have the %s attribute.",
                               "SUPERUSER")));
 
        new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(should_be_super);
        new_record_repl[Anum_pg_authid_rolsuper - 1] = true;
    }
 
    if (dinherit)
    {
        new_record[Anum_pg_authid_rolinherit - 1] = BoolGetDatum(boolVal(dinherit->arg));
        new_record_repl[Anum_pg_authid_rolinherit - 1] = true;
    }
 
    if (dcreaterole)
    {
        new_record[Anum_pg_authid_rolcreaterole - 1] = BoolGetDatum(boolVal(dcreaterole->arg));
        new_record_repl[Anum_pg_authid_rolcreaterole - 1] = true;
    }
 
    if (dcreatedb)
    {
        new_record[Anum_pg_authid_rolcreatedb - 1] = BoolGetDatum(boolVal(dcreatedb->arg));
        new_record_repl[Anum_pg_authid_rolcreatedb - 1] = true;
    }
 
    if (dcanlogin)
    {
        new_record[Anum_pg_authid_rolcanlogin - 1] = BoolGetDatum(boolVal(dcanlogin->arg));
        new_record_repl[Anum_pg_authid_rolcanlogin - 1] = true;
    }
 
    if (disreplication)
    {
        new_record[Anum_pg_authid_rolreplication - 1] = BoolGetDatum(boolVal(disreplication->arg));
        new_record_repl[Anum_pg_authid_rolreplication - 1] = true;
    }
 
    if (dconnlimit)
    {
        new_record[Anum_pg_authid_rolconnlimit - 1] = Int32GetDatum(connlimit);
        new_record_repl[Anum_pg_authid_rolconnlimit - 1] = true;
    }
 
    /* password */
    if (password)
    {
        char       *shadow_pass;
        const char *logdetail = NULL;
 
        /* Like in CREATE USER, don't allow an empty password. */
        if (password[0] == '\0' ||
            plain_crypt_verify(rolename, password, "", &logdetail) == STATUS_OK)
        {
            ereport(NOTICE,
                    (errmsg("empty string is not a valid password, clearing password")));
            new_record_nulls[Anum_pg_authid_rolpassword - 1] = true;
        }
        else
        {
            /* Encrypt the password to the requested format. */
            shadow_pass = encrypt_password(Password_encryption, rolename,
                                           password);
            new_record[Anum_pg_authid_rolpassword - 1] =
                CStringGetTextDatum(shadow_pass);
        }
        new_record_repl[Anum_pg_authid_rolpassword - 1] = true;
    }
 
    /* unset password */
    if (dpassword && dpassword->arg == NULL)
    {
        new_record_repl[Anum_pg_authid_rolpassword - 1] = true;
        new_record_nulls[Anum_pg_authid_rolpassword - 1] = true;
    }
 
    /* valid until */
    new_record[Anum_pg_authid_rolvaliduntil - 1] = validUntil_datum;
    new_record_nulls[Anum_pg_authid_rolvaliduntil - 1] = validUntil_null;
    new_record_repl[Anum_pg_authid_rolvaliduntil - 1] = true;
 
    if (dbypassRLS)
    {
        new_record[Anum_pg_authid_rolbypassrls - 1] = BoolGetDatum(boolVal(dbypassRLS->arg));
        new_record_repl[Anum_pg_authid_rolbypassrls - 1] = true;
    }
 
    new_tuple = heap_modify_tuple(tuple, pg_authid_dsc, new_record,
                                  new_record_nulls, new_record_repl);
    CatalogTupleUpdate(pg_authid_rel, &tuple->t_self, new_tuple);
 
    InvokeObjectPostAlterHook(AuthIdRelationId, roleid, 0);
 
    ReleaseSysCache(tuple);
    heap_freetuple(new_tuple);
 
    InitGrantRoleOptions(&popt);
 
    /*
     * Advance command counter so we can see new record; else tests in
     * AddRoleMems may fail.
     */
    if (drolemembers)
    {
        List       *rolemembers = (List *) drolemembers->arg;
 
        CommandCounterIncrement();
 
        if (stmt->action == +1) /* add members to role */
            AddRoleMems(currentUserId, rolename, roleid,
                        rolemembers, roleSpecsToIds(rolemembers),
                        InvalidOid, &popt);
        else if (stmt->action == -1)    /* drop members from role */
            DelRoleMems(currentUserId, rolename, roleid,
                        rolemembers, roleSpecsToIds(rolemembers),
                        InvalidOid, &popt, DROP_RESTRICT);
    }
 
    /*
     * Close pg_authid, but keep lock till commit.
     */
    table_close(pg_authid_rel, NoLock);
 
    return roleid;
}

References _, AddRoleMems(), DefElem::arg, AUTHNAME, BoolGetDatum(), boolVal, CatalogTupleUpdate(), check_password_hook, check_rolespec_name(), CommandCounterIncrement(), CStringGetDatum(), CStringGetTextDatum, DefElem::defname, DelRoleMems(), DirectFunctionCall3, DROP_RESTRICT, elog(), encrypt_password(), ereport, errcode(), errdetail(), errmsg(), ERROR, errorConflictingDefElem(), get_password_type(), get_rolespec_tuple(), GETSTRUCT, GetUserId(), has_bypassrls_privilege(), has_rolreplication(), have_createdb_privilege(), have_createrole_privilege(), heap_freetuple(), heap_modify_tuple(), InitGrantRoleOptions(), Int32GetDatum(), intVal, InvalidOid, InvokeObjectPostAlterHook, is_admin_of_role(), lfirst, NameStr, NoLock, NOTICE, ObjectIdGetDatum(), password, Password_encryption, plain_crypt_verify(), pstrdup(), RelationGetDescr, ReleaseSysCache(), roleSpecsToIds(), RowExclusiveLock, STATUS_OK, stmt, strVal, superuser(), SysCacheGetAttr(), HeapTupleData::t_self, table_close(), table_open(), and timestamptz_in().

Referenced by standard_ProcessUtility().

AlterRoleSet()

Oid AlterRoleSet

(

AlterRoleSetStmt *

stmt

)

Definition at line 1001 of file user.c.

{
    HeapTuple   roletuple;
    Form_pg_authid roleform;
    Oid         databaseid = InvalidOid;
    Oid         roleid = InvalidOid;
 
    if (stmt->role)
    {
        check_rolespec_name(stmt->role,
                            _("Cannot alter reserved roles."));
 
        roletuple = get_rolespec_tuple(stmt->role);
        roleform = (Form_pg_authid) GETSTRUCT(roletuple);
        roleid = roleform->oid;
 
        /*
         * Obtain a lock on the role and make sure it didn't go away in the
         * meantime.
         */
        shdepLockAndCheckObject(AuthIdRelationId, roleid);
 
        /*
         * To mess with a superuser you gotta be superuser; otherwise you need
         * CREATEROLE plus admin option on the target role; unless you're just
         * trying to change your own settings
         */
        if (roleform->rolsuper)
        {
            if (!superuser())
                ereport(ERROR,
                        (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                         errmsg("permission denied to alter role"),
                         errdetail("Only roles with the %s attribute may alter roles with %s.",
                                   "SUPERUSER", "SUPERUSER")));
        }
        else
        {
            if ((!have_createrole_privilege() ||
                 !is_admin_of_role(GetUserId(), roleid))
                && roleid != GetUserId())
                ereport(ERROR,
                        (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                         errmsg("permission denied to alter role"),
                         errdetail("Only roles with the %s attribute and the %s option on role \"%s\" may alter this role.",
                                   "CREATEROLE", "ADMIN", NameStr(roleform->rolname))));
        }
 
        ReleaseSysCache(roletuple);
    }
 
    /* look up and lock the database, if specified */
    if (stmt->database != NULL)
    {
        databaseid = get_database_oid(stmt->database, false);
        shdepLockAndCheckObject(DatabaseRelationId, databaseid);
 
        if (!stmt->role)
        {
            /*
             * If no role is specified, then this is effectively the same as
             * ALTER DATABASE ... SET, so use the same permission check.
             */
            if (!object_ownercheck(DatabaseRelationId, databaseid, GetUserId()))
                aclcheck_error(ACLCHECK_NOT_OWNER, OBJECT_DATABASE,
                               stmt->database);
        }
    }
 
    if (!stmt->role && !stmt->database)
    {
        /* Must be superuser to alter settings globally. */
        if (!superuser())
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to alter setting"),
                     errdetail("Only roles with the %s attribute may alter settings globally.",
                               "SUPERUSER")));
    }
 
    AlterSetting(databaseid, roleid, stmt->setstmt);
 
    return roleid;
}

References _, aclcheck_error(), ACLCHECK_NOT_OWNER, AlterSetting(), check_rolespec_name(), ereport, errcode(), errdetail(), errmsg(), ERROR, get_database_oid(), get_rolespec_tuple(), GETSTRUCT, GetUserId(), have_createrole_privilege(), InvalidOid, is_admin_of_role(), NameStr, OBJECT_DATABASE, object_ownercheck(), ReleaseSysCache(), shdepLockAndCheckObject(), stmt, and superuser().

Referenced by standard_ProcessUtility().

assign_createrole_self_grant()

void assign_createrole_self_grant	(	const char *	newval,
		void *	extra
	)

Definition at line 2573 of file user.c.

{
    unsigned    options = *(unsigned *) extra;
 
    createrole_self_grant_enabled = (options != 0);
    createrole_self_grant_options.specified = GRANT_ROLE_SPECIFIED_ADMIN
        | GRANT_ROLE_SPECIFIED_INHERIT
        | GRANT_ROLE_SPECIFIED_SET;
    createrole_self_grant_options.admin = false;
    createrole_self_grant_options.inherit =
        (options & GRANT_ROLE_SPECIFIED_INHERIT) != 0;
    createrole_self_grant_options.set =
        (options & GRANT_ROLE_SPECIFIED_SET) != 0;
}

References GrantRoleOptions::admin, createrole_self_grant_enabled, createrole_self_grant_options, GRANT_ROLE_SPECIFIED_ADMIN, GRANT_ROLE_SPECIFIED_INHERIT, GRANT_ROLE_SPECIFIED_SET, GrantRoleOptions::inherit, GrantRoleOptions::set, and GrantRoleOptions::specified.

check_createrole_self_grant()

bool check_createrole_self_grant	(	char **	newval,
		void **	extra,
		GucSource	source
	)

Definition at line 2522 of file user.c.

{
    char       *rawstring;
    List       *elemlist;
    ListCell   *l;
    unsigned    options = 0;
    unsigned   *result;
 
    /* Need a modifiable copy of string */
    rawstring = pstrdup(*newval);
 
    if (!SplitIdentifierString(rawstring, ',', &elemlist))
    {
        /* syntax error in list */
        GUC_check_errdetail("List syntax is invalid.");
        pfree(rawstring);
        list_free(elemlist);
        return false;
    }
 
    foreach(l, elemlist)
    {
        char       *tok = (char *) lfirst(l);
 
        if (pg_strcasecmp(tok, "SET") == 0)
            options |= GRANT_ROLE_SPECIFIED_SET;
        else if (pg_strcasecmp(tok, "INHERIT") == 0)
            options |= GRANT_ROLE_SPECIFIED_INHERIT;
        else
        {
            GUC_check_errdetail("Unrecognized key word: \"%s\".", tok);
            pfree(rawstring);
            list_free(elemlist);
            return false;
        }
    }
 
    pfree(rawstring);
    list_free(elemlist);
 
    result = (unsigned *) guc_malloc(LOG, sizeof(unsigned));
    *result = options;
    *extra = result;
 
    return true;
}

References GRANT_ROLE_SPECIFIED_INHERIT, GRANT_ROLE_SPECIFIED_SET, GUC_check_errdetail, guc_malloc(), lfirst, list_free(), LOG, newval, options, pfree(), pg_strcasecmp(), pstrdup(), and SplitIdentifierString().

CreateRole()

Oid CreateRole	(	ParseState *	pstate,
		CreateRoleStmt *	stmt
	)

Definition at line 133 of file user.c.

{
    Relation    pg_authid_rel;
    TupleDesc   pg_authid_dsc;
    HeapTuple   tuple;
    Datum       new_record[Natts_pg_authid] = {0};
    bool        new_record_nulls[Natts_pg_authid] = {0};
    Oid         currentUserId = GetUserId();
    Oid         roleid;
    ListCell   *item;
    ListCell   *option;
    char       *password = NULL;    /* user password */
    bool        issuper = false;    /* Make the user a superuser? */
    bool        inherit = true; /* Auto inherit privileges? */
    bool        createrole = false; /* Can this user create roles? */
    bool        createdb = false;   /* Can the user create databases? */
    bool        canlogin = false;   /* Can this user login? */
    bool        isreplication = false;  /* Is this a replication role? */
    bool        bypassrls = false;  /* Is this a row security enabled role? */
    int         connlimit = -1; /* maximum connections allowed */
    List       *addroleto = NIL;    /* roles to make this a member of */
    List       *rolemembers = NIL;  /* roles to be members of this role */
    List       *adminmembers = NIL; /* roles to be admins of this role */
    char       *validUntil = NULL;  /* time the login is valid until */
    Datum       validUntil_datum;   /* same, as timestamptz Datum */
    bool        validUntil_null;
    DefElem    *dpassword = NULL;
    DefElem    *dissuper = NULL;
    DefElem    *dinherit = NULL;
    DefElem    *dcreaterole = NULL;
    DefElem    *dcreatedb = NULL;
    DefElem    *dcanlogin = NULL;
    DefElem    *disreplication = NULL;
    DefElem    *dconnlimit = NULL;
    DefElem    *daddroleto = NULL;
    DefElem    *drolemembers = NULL;
    DefElem    *dadminmembers = NULL;
    DefElem    *dvalidUntil = NULL;
    DefElem    *dbypassRLS = NULL;
    GrantRoleOptions popt;
 
    /* The defaults can vary depending on the original statement type */
    switch (stmt->stmt_type)
    {
        case ROLESTMT_ROLE:
            break;
        case ROLESTMT_USER:
            canlogin = true;
            /* may eventually want inherit to default to false here */
            break;
        case ROLESTMT_GROUP:
            break;
    }
 
    /* Extract options from the statement node tree */
    foreach(option, stmt->options)
    {
        DefElem    *defel = (DefElem *) lfirst(option);
 
        if (strcmp(defel->defname, "password") == 0)
        {
            if (dpassword)
                errorConflictingDefElem(defel, pstate);
            dpassword = defel;
        }
        else if (strcmp(defel->defname, "sysid") == 0)
        {
            ereport(NOTICE,
                    (errmsg("SYSID can no longer be specified")));
        }
        else if (strcmp(defel->defname, "superuser") == 0)
        {
            if (dissuper)
                errorConflictingDefElem(defel, pstate);
            dissuper = defel;
        }
        else if (strcmp(defel->defname, "inherit") == 0)
        {
            if (dinherit)
                errorConflictingDefElem(defel, pstate);
            dinherit = defel;
        }
        else if (strcmp(defel->defname, "createrole") == 0)
        {
            if (dcreaterole)
                errorConflictingDefElem(defel, pstate);
            dcreaterole = defel;
        }
        else if (strcmp(defel->defname, "createdb") == 0)
        {
            if (dcreatedb)
                errorConflictingDefElem(defel, pstate);
            dcreatedb = defel;
        }
        else if (strcmp(defel->defname, "canlogin") == 0)
        {
            if (dcanlogin)
                errorConflictingDefElem(defel, pstate);
            dcanlogin = defel;
        }
        else if (strcmp(defel->defname, "isreplication") == 0)
        {
            if (disreplication)
                errorConflictingDefElem(defel, pstate);
            disreplication = defel;
        }
        else if (strcmp(defel->defname, "connectionlimit") == 0)
        {
            if (dconnlimit)
                errorConflictingDefElem(defel, pstate);
            dconnlimit = defel;
        }
        else if (strcmp(defel->defname, "addroleto") == 0)
        {
            if (daddroleto)
                errorConflictingDefElem(defel, pstate);
            daddroleto = defel;
        }
        else if (strcmp(defel->defname, "rolemembers") == 0)
        {
            if (drolemembers)
                errorConflictingDefElem(defel, pstate);
            drolemembers = defel;
        }
        else if (strcmp(defel->defname, "adminmembers") == 0)
        {
            if (dadminmembers)
                errorConflictingDefElem(defel, pstate);
            dadminmembers = defel;
        }
        else if (strcmp(defel->defname, "validUntil") == 0)
        {
            if (dvalidUntil)
                errorConflictingDefElem(defel, pstate);
            dvalidUntil = defel;
        }
        else if (strcmp(defel->defname, "bypassrls") == 0)
        {
            if (dbypassRLS)
                errorConflictingDefElem(defel, pstate);
            dbypassRLS = defel;
        }
        else
            elog(ERROR, "option \"%s\" not recognized",
                 defel->defname);
    }
 
    if (dpassword && dpassword->arg)
        password = strVal(dpassword->arg);
    if (dissuper)
        issuper = boolVal(dissuper->arg);
    if (dinherit)
        inherit = boolVal(dinherit->arg);
    if (dcreaterole)
        createrole = boolVal(dcreaterole->arg);
    if (dcreatedb)
        createdb = boolVal(dcreatedb->arg);
    if (dcanlogin)
        canlogin = boolVal(dcanlogin->arg);
    if (disreplication)
        isreplication = boolVal(disreplication->arg);
    if (dconnlimit)
    {
        connlimit = intVal(dconnlimit->arg);
        if (connlimit < -1)
            ereport(ERROR,
                    (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
                     errmsg("invalid connection limit: %d", connlimit)));
    }
    if (daddroleto)
        addroleto = (List *) daddroleto->arg;
    if (drolemembers)
        rolemembers = (List *) drolemembers->arg;
    if (dadminmembers)
        adminmembers = (List *) dadminmembers->arg;
    if (dvalidUntil)
        validUntil = strVal(dvalidUntil->arg);
    if (dbypassRLS)
        bypassrls = boolVal(dbypassRLS->arg);
 
    /* Check some permissions first */
    if (!superuser_arg(currentUserId))
    {
        if (!has_createrole_privilege(currentUserId))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to create role"),
                     errdetail("Only roles with the %s attribute may create roles.",
                               "CREATEROLE")));
        if (issuper)
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to create role"),
                     errdetail("Only roles with the %s attribute may create roles with %s.",
                               "SUPERUSER", "SUPERUSER")));
        if (createdb && !have_createdb_privilege())
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to create role"),
                     errdetail("Only roles with the %s attribute may create roles with %s.",
                               "CREATEDB", "CREATEDB")));
        if (isreplication && !has_rolreplication(currentUserId))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to create role"),
                     errdetail("Only roles with the %s attribute may create roles with %s.",
                               "REPLICATION", "REPLICATION")));
        if (bypassrls && !has_bypassrls_privilege(currentUserId))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to create role"),
                     errdetail("Only roles with the %s attribute may create roles with %s.",
                               "BYPASSRLS", "BYPASSRLS")));
    }
 
    /*
     * Check that the user is not trying to create a role in the reserved
     * "pg_" namespace.
     */
    if (IsReservedName(stmt->role))
        ereport(ERROR,
                (errcode(ERRCODE_RESERVED_NAME),
                 errmsg("role name \"%s\" is reserved",
                        stmt->role),
                 errdetail("Role names starting with \"pg_\" are reserved.")));
 
    /*
     * If built with appropriate switch, whine when regression-testing
     * conventions for role names are violated.
     */
#ifdef ENFORCE_REGRESSION_TEST_NAME_RESTRICTIONS
    if (strncmp(stmt->role, "regress_", 8) != 0)
        elog(WARNING, "roles created by regression test cases should have names starting with \"regress_\"");
#endif
 
    /*
     * Check the pg_authid relation to be certain the role doesn't already
     * exist.
     */
    pg_authid_rel = table_open(AuthIdRelationId, RowExclusiveLock);
    pg_authid_dsc = RelationGetDescr(pg_authid_rel);
 
    if (OidIsValid(get_role_oid(stmt->role, true)))
        ereport(ERROR,
                (errcode(ERRCODE_DUPLICATE_OBJECT),
                 errmsg("role \"%s\" already exists",
                        stmt->role)));
 
    /* Convert validuntil to internal form */
    if (validUntil)
    {
        validUntil_datum = DirectFunctionCall3(timestamptz_in,
                                               CStringGetDatum(validUntil),
                                               ObjectIdGetDatum(InvalidOid),
                                               Int32GetDatum(-1));
        validUntil_null = false;
    }
    else
    {
        validUntil_datum = (Datum) 0;
        validUntil_null = true;
    }
 
    /*
     * Call the password checking hook if there is one defined
     */
    if (check_password_hook && password)
        (*check_password_hook) (stmt->role,
                                password,
                                get_password_type(password),
                                validUntil_datum,
                                validUntil_null);
 
    /*
     * Build a tuple to insert
     */
    new_record[Anum_pg_authid_rolname - 1] =
        DirectFunctionCall1(namein, CStringGetDatum(stmt->role));
    new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(issuper);
    new_record[Anum_pg_authid_rolinherit - 1] = BoolGetDatum(inherit);
    new_record[Anum_pg_authid_rolcreaterole - 1] = BoolGetDatum(createrole);
    new_record[Anum_pg_authid_rolcreatedb - 1] = BoolGetDatum(createdb);
    new_record[Anum_pg_authid_rolcanlogin - 1] = BoolGetDatum(canlogin);
    new_record[Anum_pg_authid_rolreplication - 1] = BoolGetDatum(isreplication);
    new_record[Anum_pg_authid_rolconnlimit - 1] = Int32GetDatum(connlimit);
 
    if (password)
    {
        char       *shadow_pass;
        const char *logdetail = NULL;
 
        /*
         * Don't allow an empty password. Libpq treats an empty password the
         * same as no password at all, and won't even try to authenticate. But
         * other clients might, so allowing it would be confusing. By clearing
         * the password when an empty string is specified, the account is
         * consistently locked for all clients.
         *
         * Note that this only covers passwords stored in the database itself.
         * There are also checks in the authentication code, to forbid an
         * empty password from being used with authentication methods that
         * fetch the password from an external system, like LDAP or PAM.
         */
        if (password[0] == '\0' ||
            plain_crypt_verify(stmt->role, password, "", &logdetail) == STATUS_OK)
        {
            ereport(NOTICE,
                    (errmsg("empty string is not a valid password, clearing password")));
            new_record_nulls[Anum_pg_authid_rolpassword - 1] = true;
        }
        else
        {
            /* Encrypt the password to the requested format. */
            shadow_pass = encrypt_password(Password_encryption, stmt->role,
                                           password);
            new_record[Anum_pg_authid_rolpassword - 1] =
                CStringGetTextDatum(shadow_pass);
        }
    }
    else
        new_record_nulls[Anum_pg_authid_rolpassword - 1] = true;
 
    new_record[Anum_pg_authid_rolvaliduntil - 1] = validUntil_datum;
    new_record_nulls[Anum_pg_authid_rolvaliduntil - 1] = validUntil_null;
 
    new_record[Anum_pg_authid_rolbypassrls - 1] = BoolGetDatum(bypassrls);
 
    /*
     * pg_largeobject_metadata contains pg_authid.oid's, so we use the
     * binary-upgrade override.
     */
    if (IsBinaryUpgrade)
    {
        if (!OidIsValid(binary_upgrade_next_pg_authid_oid))
            ereport(ERROR,
                    (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
                     errmsg("pg_authid OID value not set when in binary upgrade mode")));
 
        roleid = binary_upgrade_next_pg_authid_oid;
        binary_upgrade_next_pg_authid_oid = InvalidOid;
    }
    else
    {
        roleid = GetNewOidWithIndex(pg_authid_rel, AuthIdOidIndexId,
                                    Anum_pg_authid_oid);
    }
 
    new_record[Anum_pg_authid_oid - 1] = ObjectIdGetDatum(roleid);
 
    tuple = heap_form_tuple(pg_authid_dsc, new_record, new_record_nulls);
 
    /*
     * Insert new record in the pg_authid table
     */
    CatalogTupleInsert(pg_authid_rel, tuple);
 
    /*
     * Advance command counter so we can see new record; else tests in
     * AddRoleMems may fail.
     */
    if (addroleto || adminmembers || rolemembers)
        CommandCounterIncrement();
 
    /* Default grant. */
    InitGrantRoleOptions(&popt);
 
    /*
     * Add the new role to the specified existing roles.
     */
    if (addroleto)
    {
        RoleSpec   *thisrole = makeNode(RoleSpec);
        List       *thisrole_list = list_make1(thisrole);
        List       *thisrole_oidlist = list_make1_oid(roleid);
 
        thisrole->roletype = ROLESPEC_CSTRING;
        thisrole->rolename = stmt->role;
        thisrole->location = -1;
 
        foreach(item, addroleto)
        {
            RoleSpec   *oldrole = lfirst(item);
            HeapTuple   oldroletup = get_rolespec_tuple(oldrole);
            Form_pg_authid oldroleform = (Form_pg_authid) GETSTRUCT(oldroletup);
            Oid         oldroleid = oldroleform->oid;
            char       *oldrolename = NameStr(oldroleform->rolname);
 
            /* can only add this role to roles for which you have rights */
            check_role_membership_authorization(currentUserId, oldroleid, true);
            AddRoleMems(currentUserId, oldrolename, oldroleid,
                        thisrole_list,
                        thisrole_oidlist,
                        InvalidOid, &popt);
 
            ReleaseSysCache(oldroletup);
        }
    }
 
    /*
     * If the current user isn't a superuser, make them an admin of the new
     * role so that they can administer the new object they just created.
     * Superusers will be able to do that anyway.
     *
     * The grantor of record for this implicit grant is the bootstrap
     * superuser, which means that the CREATEROLE user cannot revoke the
     * grant. They can however grant the created role back to themselves with
     * different options, since they enjoy ADMIN OPTION on it.
     */
    if (!superuser())
    {
        RoleSpec   *current_role = makeNode(RoleSpec);
        GrantRoleOptions poptself;
        List       *memberSpecs;
        List       *memberIds = list_make1_oid(currentUserId);
 
        current_role->roletype = ROLESPEC_CURRENT_ROLE;
        current_role->location = -1;
        memberSpecs = list_make1(current_role);
 
        poptself.specified = GRANT_ROLE_SPECIFIED_ADMIN
            | GRANT_ROLE_SPECIFIED_INHERIT
            | GRANT_ROLE_SPECIFIED_SET;
        poptself.admin = true;
        poptself.inherit = false;
        poptself.set = false;
 
        AddRoleMems(BOOTSTRAP_SUPERUSERID, stmt->role, roleid,
                    memberSpecs, memberIds,
                    BOOTSTRAP_SUPERUSERID, &poptself);
 
        /*
         * We must make the implicit grant visible to the code below, else the
         * additional grants will fail.
         */
        CommandCounterIncrement();
 
        /*
         * Because of the implicit grant above, a CREATEROLE user who creates
         * a role has the ability to grant that role back to themselves with
         * the INHERIT or SET options, if they wish to inherit the role's
         * privileges or be able to SET ROLE to it. The createrole_self_grant
         * GUC can be used to make this happen automatically. This has no
         * security implications since the same user is able to make the same
         * grant using an explicit GRANT statement; it's just convenient.
         */
        if (createrole_self_grant_enabled)
            AddRoleMems(currentUserId, stmt->role, roleid,
                        memberSpecs, memberIds,
                        currentUserId, &createrole_self_grant_options);
    }
 
    /*
     * Add the specified members to this new role. adminmembers get the admin
     * option, rolemembers don't.
     *
     * NB: No permissions check is required here. If you have enough rights to
     * create a role, you can add any members you like.
     */
    AddRoleMems(currentUserId, stmt->role, roleid,
                rolemembers, roleSpecsToIds(rolemembers),
                InvalidOid, &popt);
    popt.specified |= GRANT_ROLE_SPECIFIED_ADMIN;
    popt.admin = true;
    AddRoleMems(currentUserId, stmt->role, roleid,
                adminmembers, roleSpecsToIds(adminmembers),
                InvalidOid, &popt);
 
    /* Post creation hook for new role */
    InvokeObjectPostCreateHook(AuthIdRelationId, roleid, 0);
 
    /*
     * Close pg_authid, but keep lock till commit.
     */
    table_close(pg_authid_rel, NoLock);
 
    return roleid;
}

References AddRoleMems(), GrantRoleOptions::admin, DefElem::arg, binary_upgrade_next_pg_authid_oid, BoolGetDatum(), boolVal, CatalogTupleInsert(), check_password_hook, check_role_membership_authorization(), CommandCounterIncrement(), createdb(), createrole_self_grant_enabled, createrole_self_grant_options, CStringGetDatum(), CStringGetTextDatum, DefElem::defname, DirectFunctionCall1, DirectFunctionCall3, elog(), encrypt_password(), ereport, errcode(), ERRCODE_DUPLICATE_OBJECT, errdetail(), errmsg(), ERROR, errorConflictingDefElem(), get_password_type(), get_role_oid(), get_rolespec_tuple(), GetNewOidWithIndex(), GETSTRUCT, GetUserId(), GRANT_ROLE_SPECIFIED_ADMIN, GRANT_ROLE_SPECIFIED_INHERIT, GRANT_ROLE_SPECIFIED_SET, has_bypassrls_privilege(), has_createrole_privilege(), has_rolreplication(), have_createdb_privilege(), heap_form_tuple(), if(), GrantRoleOptions::inherit, InitGrantRoleOptions(), Int32GetDatum(), intVal, InvalidOid, InvokeObjectPostCreateHook, IsBinaryUpgrade, IsReservedName(), lfirst, list_make1, list_make1_oid, RoleSpec::location, makeNode, namein(), NameStr, NIL, NoLock, NOTICE, ObjectIdGetDatum(), OidIsValid, password, Password_encryption, plain_crypt_verify(), RelationGetDescr, ReleaseSysCache(), RoleSpec::rolename, ROLESPEC_CSTRING, ROLESPEC_CURRENT_ROLE, roleSpecsToIds(), ROLESTMT_GROUP, ROLESTMT_ROLE, ROLESTMT_USER, RoleSpec::roletype, RowExclusiveLock, GrantRoleOptions::set, GrantRoleOptions::specified, STATUS_OK, stmt, strVal, superuser(), superuser_arg(), table_close(), table_open(), timestamptz_in(), and WARNING.

Referenced by standard_ProcessUtility().

DropOwnedObjects()

void DropOwnedObjects

(

DropOwnedStmt *

stmt

)

Definition at line 1590 of file user.c.

{
    List       *role_ids = roleSpecsToIds(stmt->roles);
    ListCell   *cell;
 
    /* Check privileges */
    foreach(cell, role_ids)
    {
        Oid         roleid = lfirst_oid(cell);
 
        if (!has_privs_of_role(GetUserId(), roleid))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to drop objects"),
                     errdetail("Only roles with privileges of role \"%s\" may drop objects owned by it.",
                               GetUserNameFromId(roleid, false))));
    }
 
    /* Ok, do it */
    shdepDropOwned(role_ids, stmt->behavior);
}

References ereport, errcode(), errdetail(), errmsg(), ERROR, GetUserId(), GetUserNameFromId(), has_privs_of_role(), lfirst_oid, roleSpecsToIds(), shdepDropOwned(), and stmt.

Referenced by ProcessUtilitySlow().

DropRole()

void DropRole

(

DropRoleStmt *

stmt

)

Definition at line 1091 of file user.c.

{
    Relation    pg_authid_rel,
                pg_auth_members_rel;
    ListCell   *item;
    List       *role_addresses = NIL;
 
    if (!have_createrole_privilege())
        ereport(ERROR,
                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                 errmsg("permission denied to drop role"),
                 errdetail("Only roles with the %s attribute and the %s option on the target roles may drop roles.",
                           "CREATEROLE", "ADMIN")));
 
    /*
     * Scan the pg_authid relation to find the Oid of the role(s) to be
     * deleted and perform preliminary permissions and sanity checks.
     */
    pg_authid_rel = table_open(AuthIdRelationId, RowExclusiveLock);
    pg_auth_members_rel = table_open(AuthMemRelationId, RowExclusiveLock);
 
    foreach(item, stmt->roles)
    {
        RoleSpec   *rolspec = lfirst(item);
        char       *role;
        HeapTuple   tuple,
                    tmp_tuple;
        Form_pg_authid roleform;
        ScanKeyData scankey;
        SysScanDesc sscan;
        Oid         roleid;
        ObjectAddress *role_address;
 
        if (rolspec->roletype != ROLESPEC_CSTRING)
            ereport(ERROR,
                    (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
                     errmsg("cannot use special role specifier in DROP ROLE")));
        role = rolspec->rolename;
 
        tuple = SearchSysCache1(AUTHNAME, PointerGetDatum(role));
        if (!HeapTupleIsValid(tuple))
        {
            if (!stmt->missing_ok)
            {
                ereport(ERROR,
                        (errcode(ERRCODE_UNDEFINED_OBJECT),
                         errmsg("role \"%s\" does not exist", role)));
            }
            else
            {
                ereport(NOTICE,
                        (errmsg("role \"%s\" does not exist, skipping",
                                role)));
            }
 
            continue;
        }
 
        roleform = (Form_pg_authid) GETSTRUCT(tuple);
        roleid = roleform->oid;
 
        if (roleid == GetUserId())
            ereport(ERROR,
                    (errcode(ERRCODE_OBJECT_IN_USE),
                     errmsg("current user cannot be dropped")));
        if (roleid == GetOuterUserId())
            ereport(ERROR,
                    (errcode(ERRCODE_OBJECT_IN_USE),
                     errmsg("current user cannot be dropped")));
        if (roleid == GetSessionUserId())
            ereport(ERROR,
                    (errcode(ERRCODE_OBJECT_IN_USE),
                     errmsg("session user cannot be dropped")));
 
        /*
         * For safety's sake, we allow createrole holders to drop ordinary
         * roles but not superuser roles, and only if they also have ADMIN
         * OPTION.
         */
        if (roleform->rolsuper && !superuser())
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to drop role"),
                     errdetail("Only roles with the %s attribute may drop roles with %s.",
                               "SUPERUSER", "SUPERUSER")));
        if (!is_admin_of_role(GetUserId(), roleid))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to drop role"),
                     errdetail("Only roles with the %s attribute and the %s option on role \"%s\" may drop this role.",
                               "CREATEROLE", "ADMIN", NameStr(roleform->rolname))));
 
        /* DROP hook for the role being removed */
        InvokeObjectDropHook(AuthIdRelationId, roleid, 0);
 
        /* Don't leak the syscache tuple */
        ReleaseSysCache(tuple);
 
        /*
         * Lock the role, so nobody can add dependencies to her while we drop
         * her.  We keep the lock until the end of transaction.
         */
        LockSharedObject(AuthIdRelationId, roleid, 0, AccessExclusiveLock);
 
        /*
         * If there is a pg_auth_members entry that has one of the roles to be
         * dropped as the roleid or member, it should be silently removed, but
         * if there is a pg_auth_members entry that has one of the roles to be
         * dropped as the grantor, the operation should fail.
         *
         * It's possible, however, that a single pg_auth_members entry could
         * fall into multiple categories - e.g. the user could do "GRANT foo
         * TO bar GRANTED BY baz" and then "DROP ROLE baz, bar". We want such
         * an operation to succeed regardless of the order in which the
         * to-be-dropped roles are passed to DROP ROLE.
         *
         * To make that work, we remove all pg_auth_members entries that can
         * be silently removed in this loop, and then below we'll make a
         * second pass over the list of roles to be removed and check for any
         * remaining dependencies.
         */
        ScanKeyInit(&scankey,
                    Anum_pg_auth_members_roleid,
                    BTEqualStrategyNumber, F_OIDEQ,
                    ObjectIdGetDatum(roleid));
 
        sscan = systable_beginscan(pg_auth_members_rel, AuthMemRoleMemIndexId,
                                   true, NULL, 1, &scankey);
 
        while (HeapTupleIsValid(tmp_tuple = systable_getnext(sscan)))
        {
            Form_pg_auth_members authmem_form;
 
            authmem_form = (Form_pg_auth_members) GETSTRUCT(tmp_tuple);
            deleteSharedDependencyRecordsFor(AuthMemRelationId,
                                             authmem_form->oid, 0);
            CatalogTupleDelete(pg_auth_members_rel, &tmp_tuple->t_self);
        }
 
        systable_endscan(sscan);
 
        ScanKeyInit(&scankey,
                    Anum_pg_auth_members_member,
                    BTEqualStrategyNumber, F_OIDEQ,
                    ObjectIdGetDatum(roleid));
 
        sscan = systable_beginscan(pg_auth_members_rel, AuthMemMemRoleIndexId,
                                   true, NULL, 1, &scankey);
 
        while (HeapTupleIsValid(tmp_tuple = systable_getnext(sscan)))
        {
            Form_pg_auth_members authmem_form;
 
            authmem_form = (Form_pg_auth_members) GETSTRUCT(tmp_tuple);
            deleteSharedDependencyRecordsFor(AuthMemRelationId,
                                             authmem_form->oid, 0);
            CatalogTupleDelete(pg_auth_members_rel, &tmp_tuple->t_self);
        }
 
        systable_endscan(sscan);
 
        /*
         * Advance command counter so that later iterations of this loop will
         * see the changes already made.  This is essential if, for example,
         * we are trying to drop both a role and one of its direct members ---
         * we'll get an error if we try to delete the linking pg_auth_members
         * tuple twice.  (We do not need a CCI between the two delete loops
         * above, because it's not allowed for a role to directly contain
         * itself.)
         */
        CommandCounterIncrement();
 
        /* Looks tentatively OK, add it to the list. */
        role_address = palloc(sizeof(ObjectAddress));
        role_address->classId = AuthIdRelationId;
        role_address->objectId = roleid;
        role_address->objectSubId = 0;
        role_addresses = lappend(role_addresses, role_address);
    }
 
    /*
     * Second pass over the roles to be removed.
     */
    foreach(item, role_addresses)
    {
        ObjectAddress *role_address = lfirst(item);
        Oid         roleid = role_address->objectId;
        HeapTuple   tuple;
        Form_pg_authid roleform;
        char       *detail;
        char       *detail_log;
 
        /*
         * Re-find the pg_authid tuple.
         *
         * Since we've taken a lock on the role OID, it shouldn't be possible
         * for the tuple to have been deleted -- or for that matter updated --
         * unless the user is manually modifying the system catalogs.
         */
        tuple = SearchSysCache1(AUTHOID, ObjectIdGetDatum(roleid));
        if (!HeapTupleIsValid(tuple))
            elog(ERROR, "could not find tuple for role %u", roleid);
        roleform = (Form_pg_authid) GETSTRUCT(tuple);
 
        /*
         * Check for pg_shdepend entries depending on this role.
         *
         * This needs to happen after we've completed removing any
         * pg_auth_members entries that can be removed silently, in order to
         * avoid spurious failures. See notes above for more details.
         */
        if (checkSharedDependencies(AuthIdRelationId, roleid,
                                    &detail, &detail_log))
            ereport(ERROR,
                    (errcode(ERRCODE_DEPENDENT_OBJECTS_STILL_EXIST),
                     errmsg("role \"%s\" cannot be dropped because some objects depend on it",
                            NameStr(roleform->rolname)),
                     errdetail_internal("%s", detail),
                     errdetail_log("%s", detail_log)));
 
        /*
         * Remove the role from the pg_authid table
         */
        CatalogTupleDelete(pg_authid_rel, &tuple->t_self);
 
        ReleaseSysCache(tuple);
 
        /*
         * Remove any comments or security labels on this role.
         */
        DeleteSharedComments(roleid, AuthIdRelationId);
        DeleteSharedSecurityLabel(roleid, AuthIdRelationId);
 
        /*
         * Remove settings for this role.
         */
        DropSetting(InvalidOid, roleid);
    }
 
    /*
     * Now we can clean up; but keep locks until commit.
     */
    table_close(pg_auth_members_rel, NoLock);
    table_close(pg_authid_rel, NoLock);
}

References AccessExclusiveLock, AUTHNAME, AUTHOID, BTEqualStrategyNumber, CatalogTupleDelete(), checkSharedDependencies(), ObjectAddress::classId, CommandCounterIncrement(), DeleteSharedComments(), deleteSharedDependencyRecordsFor(), DeleteSharedSecurityLabel(), DropSetting(), elog(), ereport, errcode(), errdetail(), errdetail_internal(), errdetail_log(), errmsg(), ERROR, GetOuterUserId(), GetSessionUserId(), GETSTRUCT, GetUserId(), have_createrole_privilege(), HeapTupleIsValid, InvalidOid, InvokeObjectDropHook, is_admin_of_role(), lappend(), lfirst, LockSharedObject(), NameStr, NIL, NoLock, NOTICE, ObjectAddress::objectId, ObjectIdGetDatum(), ObjectAddress::objectSubId, palloc(), PointerGetDatum(), ReleaseSysCache(), RoleSpec::rolename, ROLESPEC_CSTRING, RoleSpec::roletype, RowExclusiveLock, ScanKeyInit(), SearchSysCache1(), stmt, superuser(), systable_beginscan(), systable_endscan(), systable_getnext(), HeapTupleData::t_self, table_close(), and table_open().

Referenced by standard_ProcessUtility().

GrantRole()

void GrantRole	(	ParseState *	pstate,
		GrantRoleStmt *	stmt
	)

Definition at line 1487 of file user.c.

{
    Relation    pg_authid_rel;
    Oid         grantor;
    List       *grantee_ids;
    ListCell   *item;
    GrantRoleOptions popt;
    Oid         currentUserId = GetUserId();
 
    /* Parse options list. */
    InitGrantRoleOptions(&popt);
    foreach(item, stmt->opt)
    {
        DefElem    *opt = (DefElem *) lfirst(item);
        char       *optval = defGetString(opt);
 
        if (strcmp(opt->defname, "admin") == 0)
        {
            popt.specified |= GRANT_ROLE_SPECIFIED_ADMIN;
 
            if (parse_bool(optval, &popt.admin))
                continue;
        }
        else if (strcmp(opt->defname, "inherit") == 0)
        {
            popt.specified |= GRANT_ROLE_SPECIFIED_INHERIT;
            if (parse_bool(optval, &popt.inherit))
                continue;
        }
        else if (strcmp(opt->defname, "set") == 0)
        {
            popt.specified |= GRANT_ROLE_SPECIFIED_SET;
            if (parse_bool(optval, &popt.set))
                continue;
        }
        else
            ereport(ERROR,
                    errcode(ERRCODE_SYNTAX_ERROR),
                    errmsg("unrecognized role option \"%s\"", opt->defname),
                    parser_errposition(pstate, opt->location));
 
        ereport(ERROR,
                (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
                 errmsg("unrecognized value for role option \"%s\": \"%s\"",
                        opt->defname, optval),
                 parser_errposition(pstate, opt->location)));
    }
 
    /* Lookup OID of grantor, if specified. */
    if (stmt->grantor)
        grantor = get_rolespec_oid(stmt->grantor, false);
    else
        grantor = InvalidOid;
 
    grantee_ids = roleSpecsToIds(stmt->grantee_roles);
 
    /* AccessShareLock is enough since we aren't modifying pg_authid */
    pg_authid_rel = table_open(AuthIdRelationId, AccessShareLock);
 
    /*
     * Step through all of the granted roles and add, update, or remove
     * entries in pg_auth_members as appropriate. If stmt->is_grant is true,
     * we are adding new grants or, if they already exist, updating options on
     * those grants. If stmt->is_grant is false, we are revoking grants or
     * removing options from them.
     */
    foreach(item, stmt->granted_roles)
    {
        AccessPriv *priv = (AccessPriv *) lfirst(item);
        char       *rolename = priv->priv_name;
        Oid         roleid;
 
        /* Must reject priv(columns) and ALL PRIVILEGES(columns) */
        if (rolename == NULL || priv->cols != NIL)
            ereport(ERROR,
                    (errcode(ERRCODE_INVALID_GRANT_OPERATION),
                     errmsg("column names cannot be included in GRANT/REVOKE ROLE")));
 
        roleid = get_role_oid(rolename, false);
        check_role_membership_authorization(currentUserId,
                                            roleid, stmt->is_grant);
        if (stmt->is_grant)
            AddRoleMems(currentUserId, rolename, roleid,
                        stmt->grantee_roles, grantee_ids,
                        grantor, &popt);
        else
            DelRoleMems(currentUserId, rolename, roleid,
                        stmt->grantee_roles, grantee_ids,
                        grantor, &popt, stmt->behavior);
    }
 
    /*
     * Close pg_authid, but keep lock till commit.
     */
    table_close(pg_authid_rel, NoLock);
}

References AccessShareLock, AddRoleMems(), GrantRoleOptions::admin, check_role_membership_authorization(), AccessPriv::cols, defGetString(), DefElem::defname, DelRoleMems(), ereport, errcode(), errmsg(), ERROR, get_role_oid(), get_rolespec_oid(), GetUserId(), GRANT_ROLE_SPECIFIED_ADMIN, GRANT_ROLE_SPECIFIED_INHERIT, GRANT_ROLE_SPECIFIED_SET, GrantRoleOptions::inherit, InitGrantRoleOptions(), InvalidOid, lfirst, DefElem::location, NIL, NoLock, parse_bool(), parser_errposition(), AccessPriv::priv_name, roleSpecsToIds(), GrantRoleOptions::set, GrantRoleOptions::specified, stmt, table_close(), and table_open().

Referenced by standard_ProcessUtility().

ReassignOwnedObjects()

void ReassignOwnedObjects

(

ReassignOwnedStmt *

stmt

)

Definition at line 1618 of file user.c.

{
    List       *role_ids = roleSpecsToIds(stmt->roles);
    ListCell   *cell;
    Oid         newrole;
 
    /* Check privileges */
    foreach(cell, role_ids)
    {
        Oid         roleid = lfirst_oid(cell);
 
        if (!has_privs_of_role(GetUserId(), roleid))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to reassign objects"),
                     errdetail("Only roles with privileges of role \"%s\" may reassign objects owned by it.",
                               GetUserNameFromId(roleid, false))));
    }
 
    /* Must have privileges on the receiving side too */
    newrole = get_rolespec_oid(stmt->newrole, false);
 
    if (!has_privs_of_role(GetUserId(), newrole))
        ereport(ERROR,
                (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                 errmsg("permission denied to reassign objects"),
                 errdetail("Only roles with privileges of role \"%s\" may reassign objects to it.",
                           GetUserNameFromId(newrole, false))));
 
    /* Ok, do it */
    shdepReassignOwned(role_ids, newrole);
}

References ereport, errcode(), errdetail(), errmsg(), ERROR, get_rolespec_oid(), GetUserId(), GetUserNameFromId(), has_privs_of_role(), lfirst_oid, roleSpecsToIds(), shdepReassignOwned(), and stmt.

Referenced by standard_ProcessUtility().

RenameRole()

ObjectAddress RenameRole	(	const char *	oldname,
		const char *	newname
	)

Definition at line 1341 of file user.c.

{
    HeapTuple   oldtuple,
                newtuple;
    TupleDesc   dsc;
    Relation    rel;
    Datum       datum;
    bool        isnull;
    Datum       repl_val[Natts_pg_authid];
    bool        repl_null[Natts_pg_authid];
    bool        repl_repl[Natts_pg_authid];
    int         i;
    Oid         roleid;
    ObjectAddress address;
    Form_pg_authid authform;
 
    rel = table_open(AuthIdRelationId, RowExclusiveLock);
    dsc = RelationGetDescr(rel);
 
    oldtuple = SearchSysCache1(AUTHNAME, CStringGetDatum(oldname));
    if (!HeapTupleIsValid(oldtuple))
        ereport(ERROR,
                (errcode(ERRCODE_UNDEFINED_OBJECT),
                 errmsg("role \"%s\" does not exist", oldname)));
 
    /*
     * XXX Client applications probably store the session user somewhere, so
     * renaming it could cause confusion.  On the other hand, there may not be
     * an actual problem besides a little confusion, so think about this and
     * decide.  Same for SET ROLE ... we don't restrict renaming the current
     * effective userid, though.
     */
 
    authform = (Form_pg_authid) GETSTRUCT(oldtuple);
    roleid = authform->oid;
 
    if (roleid == GetSessionUserId())
        ereport(ERROR,
                (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
                 errmsg("session user cannot be renamed")));
    if (roleid == GetOuterUserId())
        ereport(ERROR,
                (errcode(ERRCODE_FEATURE_NOT_SUPPORTED),
                 errmsg("current user cannot be renamed")));
 
    /*
     * Check that the user is not trying to rename a system role and not
     * trying to rename a role into the reserved "pg_" namespace.
     */
    if (IsReservedName(NameStr(authform->rolname)))
        ereport(ERROR,
                (errcode(ERRCODE_RESERVED_NAME),
                 errmsg("role name \"%s\" is reserved",
                        NameStr(authform->rolname)),
                 errdetail("Role names starting with \"pg_\" are reserved.")));
 
    if (IsReservedName(newname))
        ereport(ERROR,
                (errcode(ERRCODE_RESERVED_NAME),
                 errmsg("role name \"%s\" is reserved",
                        newname),
                 errdetail("Role names starting with \"pg_\" are reserved.")));
 
    /*
     * If built with appropriate switch, whine when regression-testing
     * conventions for role names are violated.
     */
#ifdef ENFORCE_REGRESSION_TEST_NAME_RESTRICTIONS
    if (strncmp(newname, "regress_", 8) != 0)
        elog(WARNING, "roles created by regression test cases should have names starting with \"regress_\"");
#endif
 
    /* make sure the new name doesn't exist */
    if (SearchSysCacheExists1(AUTHNAME, CStringGetDatum(newname)))
        ereport(ERROR,
                (errcode(ERRCODE_DUPLICATE_OBJECT),
                 errmsg("role \"%s\" already exists", newname)));
 
    /*
     * Only superusers can mess with superusers. Otherwise, a user with
     * CREATEROLE can rename a role for which they have ADMIN OPTION.
     */
    if (authform->rolsuper)
    {
        if (!superuser())
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to rename role"),
                     errdetail("Only roles with the %s attribute may rename roles with %s.",
                               "SUPERUSER", "SUPERUSER")));
    }
    else
    {
        if (!have_createrole_privilege() ||
            !is_admin_of_role(GetUserId(), roleid))
            ereport(ERROR,
                    (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
                     errmsg("permission denied to rename role"),
                     errdetail("Only roles with the %s attribute and the %s option on role \"%s\" may rename this role.",
                               "CREATEROLE", "ADMIN", NameStr(authform->rolname))));
    }
 
    /* OK, construct the modified tuple */
    for (i = 0; i < Natts_pg_authid; i++)
        repl_repl[i] = false;
 
    repl_repl[Anum_pg_authid_rolname - 1] = true;
    repl_val[Anum_pg_authid_rolname - 1] = DirectFunctionCall1(namein,
                                                               CStringGetDatum(newname));
    repl_null[Anum_pg_authid_rolname - 1] = false;
 
    datum = heap_getattr(oldtuple, Anum_pg_authid_rolpassword, dsc, &isnull);
 
    if (!isnull && get_password_type(TextDatumGetCString(datum)) == PASSWORD_TYPE_MD5)
    {
        /* MD5 uses the username as salt, so just clear it on a rename */
        repl_repl[Anum_pg_authid_rolpassword - 1] = true;
        repl_null[Anum_pg_authid_rolpassword - 1] = true;
 
        ereport(NOTICE,
                (errmsg("MD5 password cleared because of role rename")));
    }
 
    newtuple = heap_modify_tuple(oldtuple, dsc, repl_val, repl_null, repl_repl);
    CatalogTupleUpdate(rel, &oldtuple->t_self, newtuple);
 
    InvokeObjectPostAlterHook(AuthIdRelationId, roleid, 0);
 
    ObjectAddressSet(address, AuthIdRelationId, roleid);
 
    ReleaseSysCache(oldtuple);
 
    /*
     * Close pg_authid, but keep lock till commit.
     */
    table_close(rel, NoLock);
 
    return address;
}

References AUTHNAME, CatalogTupleUpdate(), CStringGetDatum(), DirectFunctionCall1, elog(), ereport, errcode(), ERRCODE_DUPLICATE_OBJECT, errdetail(), errmsg(), ERROR, get_password_type(), GetOuterUserId(), GetSessionUserId(), GETSTRUCT, GetUserId(), have_createrole_privilege(), heap_getattr(), heap_modify_tuple(), HeapTupleIsValid, i, InvokeObjectPostAlterHook, is_admin_of_role(), IsReservedName(), namein(), NameStr, NoLock, NOTICE, ObjectAddressSet, PASSWORD_TYPE_MD5, RelationGetDescr, ReleaseSysCache(), RowExclusiveLock, SearchSysCache1(), SearchSysCacheExists1, superuser(), HeapTupleData::t_self, table_close(), table_open(), TextDatumGetCString, and WARNING.

Referenced by ExecRenameStmt().

roleSpecsToIds()

List* roleSpecsToIds

(

List *

memberNames

)

Definition at line 1659 of file user.c.

{
    List       *result = NIL;
    ListCell   *l;
 
    foreach(l, memberNames)
    {
        RoleSpec   *rolespec = lfirst_node(RoleSpec, l);
        Oid         roleid;
 
        roleid = get_rolespec_oid(rolespec, false);
        result = lappend_oid(result, roleid);
    }
    return result;
}

References get_rolespec_oid(), lappend_oid(), lfirst_node, and NIL.

Referenced by AlterRole(), AlterTableMoveAll(), CreateRole(), DropOwnedObjects(), GrantRole(), and ReassignOwnedObjects().

Variable Documentation

check_password_hook

PGDLLIMPORT check_password_hook_type check_password_hook

extern

Definition at line 92 of file user.c.

Referenced by _PG_init(), AlterRole(), and CreateRole().

createrole_self_grant

PGDLLIMPORT char* createrole_self_grant

extern

Definition at line 87 of file user.c.

Password_encryption

PGDLLIMPORT int Password_encryption

extern

Definition at line 86 of file user.c.

Referenced by AlterRole(), CheckPWChallengeAuth(), and CreateRole().