diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/utils/adt/misc.c | 8 | ||||
| -rw-r--r-- | src/include/catalog/catversion.h | 2 | ||||
| -rw-r--r-- | src/include/catalog/pg_authid.h | 8 | ||||
| -rw-r--r-- | src/test/regress/expected/rolenames.out | 5 | ||||
| -rw-r--r-- | src/test/regress/sql/rolenames.sql | 2 |
5 files changed, 20 insertions, 5 deletions
diff --git a/src/backend/utils/adt/misc.c b/src/backend/utils/adt/misc.c index ebc7bb388a7..a44fa38173a 100644 --- a/src/backend/utils/adt/misc.c +++ b/src/backend/utils/adt/misc.c @@ -21,6 +21,7 @@ #include <unistd.h> #include "access/sysattr.h" +#include "catalog/pg_authid.h" #include "catalog/catalog.h" #include "catalog/pg_tablespace.h" #include "catalog/pg_type.h" @@ -244,7 +245,8 @@ pg_signal_backend(int pid, int sig) return SIGNAL_BACKEND_NOSUPERUSER; /* Users can signal backends they have role membership in. */ - if (!has_privs_of_role(GetUserId(), proc->roleId)) + if (!has_privs_of_role(GetUserId(), proc->roleId) && + !has_privs_of_role(GetUserId(), DEFAULT_ROLE_SIGNAL_BACKENDID)) return SIGNAL_BACKEND_NOPERMISSION; /* @@ -290,7 +292,7 @@ pg_cancel_backend(PG_FUNCTION_ARGS) if (r == SIGNAL_BACKEND_NOPERMISSION) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be a member of the role whose query is being canceled")))); + (errmsg("must be a member of the role whose query is being canceled or member of pg_signal_backend")))); PG_RETURN_BOOL(r == SIGNAL_BACKEND_SUCCESS); } @@ -314,7 +316,7 @@ pg_terminate_backend(PG_FUNCTION_ARGS) if (r == SIGNAL_BACKEND_NOPERMISSION) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - (errmsg("must be a member of the role whose process is being terminated")))); + (errmsg("must be a member of the role whose process is being terminated or member of pg_signal_backend")))); PG_RETURN_BOOL(r == SIGNAL_BACKEND_SUCCESS); } diff --git a/src/include/catalog/catversion.h b/src/include/catalog/catversion.h index 6d254ba133c..5b7053da067 100644 --- a/src/include/catalog/catversion.h +++ b/src/include/catalog/catversion.h @@ -53,6 +53,6 @@ */ /* yyyymmddN */ -#define CATALOG_VERSION_NO 201604071 +#define CATALOG_VERSION_NO 201604082 #endif diff --git a/src/include/catalog/pg_authid.h b/src/include/catalog/pg_authid.h index c1630833b81..533081def6e 100644 --- a/src/include/catalog/pg_authid.h +++ b/src/include/catalog/pg_authid.h @@ -93,10 +93,16 @@ typedef FormData_pg_authid *Form_pg_authid; * * The uppercase quantities will be replaced at initdb time with * user choices. + * + * If adding new default roles or changing the OIDs below, be sure to add or + * update the #defines which follow as appropriate. * ---------------- */ DATA(insert OID = 10 ( "POSTGRES" t t t t t t t -1 _null_ _null_)); +DATA(insert OID = 4200 ( "pg_signal_backend" f t f f f f f -1 _null_ _null_)); + +#define BOOTSTRAP_SUPERUSERID 10 -#define BOOTSTRAP_SUPERUSERID 10 +#define DEFAULT_ROLE_SIGNAL_BACKENDID 4200 #endif /* PG_AUTHID_H */ diff --git a/src/test/regress/expected/rolenames.out b/src/test/regress/expected/rolenames.out index 01b3b90ec14..15a97abe195 100644 --- a/src/test/regress/expected/rolenames.out +++ b/src/test/regress/expected/rolenames.out @@ -824,6 +824,11 @@ ERROR: role "pg_abcdef" is reserved DETAIL: Cannot GRANT roles to a reserved role. SET ROLE pg_testrole; -- error ERROR: invalid value for parameter "role": "pg_testrole" +SET ROLE pg_signal_backend; --error +ERROR: invalid value for parameter "role": "pg_signal_backend" +CREATE SCHEMA test_schema AUTHORIZATION pg_signal_backend; --error +ERROR: role "pg_signal_backend" is reserved +DETAIL: Cannot specify reserved role as owner. UPDATE pg_proc SET proacl = null WHERE proname LIKE 'testagg_'; SELECT proname, proacl FROM pg_proc WHERE proname LIKE 'testagg_'; proname | proacl diff --git a/src/test/regress/sql/rolenames.sql b/src/test/regress/sql/rolenames.sql index 1e0e9af8da1..b58a16359b2 100644 --- a/src/test/regress/sql/rolenames.sql +++ b/src/test/regress/sql/rolenames.sql @@ -385,6 +385,8 @@ GRANT testrol0 TO pg_abc; -- error GRANT pg_abc TO pg_abcdef; -- error SET ROLE pg_testrole; -- error +SET ROLE pg_signal_backend; --error +CREATE SCHEMA test_schema AUTHORIZATION pg_signal_backend; --error UPDATE pg_proc SET proacl = null WHERE proname LIKE 'testagg_'; SELECT proname, proacl FROM pg_proc WHERE proname LIKE 'testagg_'; |