diff options
| -rw-r--r-- | src/bin/pg_dump/pg_dump.c | 19 | ||||
| -rw-r--r-- | src/bin/pg_dump/t/002_pg_dump.pl | 19 |
2 files changed, 37 insertions, 1 deletions
diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c index d9940dc4e87..fee7055249e 100644 --- a/src/bin/pg_dump/pg_dump.c +++ b/src/bin/pg_dump/pg_dump.c @@ -9787,9 +9787,26 @@ getDefaultACLs(Archive *fout, int *numDefaultACLs) PQExpBuffer initacl_subquery = createPQExpBuffer(); PQExpBuffer initracl_subquery = createPQExpBuffer(); + /* + * Global entries (with defaclnamespace=0) replace the hard-wired + * default ACL for their object type. We should dump them as deltas + * from the default ACL, since that will be used as a starting point + * for interpreting the ALTER DEFAULT PRIVILEGES commands. On the + * other hand, non-global entries can only add privileges not revoke + * them. We must dump those as-is (i.e., as deltas from an empty + * ACL). We implement that by passing NULL as the object type for + * acldefault(), which works because acldefault() is STRICT. + * + * We can use defaclobjtype as the object type for acldefault(), + * except for the case of 'S' (DEFACLOBJ_SEQUENCE) which must be + * converted to 's'. + */ buildACLQueries(acl_subquery, racl_subquery, initacl_subquery, initracl_subquery, "defaclacl", "defaclrole", - "CASE WHEN defaclobjtype = 'S' THEN 's' ELSE defaclobjtype END::\"char\"", + "CASE WHEN defaclnamespace = 0 THEN" + " CASE WHEN defaclobjtype = 'S' THEN 's'::\"char\"" + " ELSE defaclobjtype END " + "ELSE NULL END", dopt->binary_upgrade); appendPQExpBuffer(query, "SELECT d.oid, d.tableoid, " diff --git a/src/bin/pg_dump/t/002_pg_dump.pl b/src/bin/pg_dump/t/002_pg_dump.pl index 9342738918f..4e613efbfa6 100644 --- a/src/bin/pg_dump/t/002_pg_dump.pl +++ b/src/bin/pg_dump/t/002_pg_dump.pl @@ -436,6 +436,25 @@ my %tests = ( }, }, + 'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role GRANT EXECUTE ON FUNCTIONS' + => { + create_order => 15, + create_sql => 'ALTER DEFAULT PRIVILEGES + FOR ROLE regress_dump_test_role IN SCHEMA dump_test + GRANT EXECUTE ON FUNCTIONS TO regress_dump_test_role;', + regexp => qr/^ + \QALTER DEFAULT PRIVILEGES \E + \QFOR ROLE regress_dump_test_role IN SCHEMA dump_test \E + \QGRANT ALL ON FUNCTIONS TO regress_dump_test_role;\E + /xm, + like => + { %full_runs, %dump_test_schema_runs, section_post_data => 1, }, + unlike => { + exclude_dump_test_schema => 1, + no_privs => 1, + }, + }, + 'ALTER DEFAULT PRIVILEGES FOR ROLE regress_dump_test_role REVOKE' => { create_order => 55, create_sql => 'ALTER DEFAULT PRIVILEGES |