aboutsummaryrefslogtreecommitdiff
path: root/src/backend/utils/init/miscinit.c
Commit message (Collapse)AuthorAge
...
* Arrange for client authentication to occur before we select a specificTom Lane2010-04-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | database to connect to. This is necessary for the walsender code to work properly (it was previously using an untenable assumption that template1 would always be available to connect to). This also gets rid of a small security shortcoming that was introduced in the original patch to eliminate the flat authentication files: before, you could find out whether or not the requested database existed even if you couldn't pass the authentication checks. The changes needed to support this are mainly just to treat pg_authid and pg_auth_members as nailed relations, so that we can read them without having to be able to locate real pg_class entries for them. This mechanism was already debugged for pg_database, but we hadn't recognized the value of applying it to those catalogs too. Since the current code doesn't have support for accessing toast tables before we've brought up all of the relcache, remove pg_authid's toast table to ensure that no one can store an out-of-line toasted value of rolpassword. The case seems quite unlikely to occur in practice, and was effectively unsupported anyway in the old "flatfiles" implementation. Update genbki.pl to actually implement the same rules as bootstrap.c does for not-nullability of catalog columns. The previous coding was a bit cheesy but worked all right for the previous set of bootstrap catalogs. It does not work for pg_authid, where rolvaliduntil needs to be nullable. Initdb forced due to minor catalog changes (mainly the toast table removal).
* pgindent run for 9.0Bruce Momjian2010-02-26
|
* Wrap calls to SearchSysCache and related functions using macros.Robert Haas2010-02-14
| | | | | | | | | | | | The purpose of this change is to eliminate the need for every caller of SearchSysCache, SearchSysCacheCopy, SearchSysCacheExists, GetSysCacheOid, and SearchSysCacheList to know the maximum number of allowable keys for a syscache entry (currently 4). This will make it far easier to increase the maximum number of keys in a future release should we choose to do so, and it makes the code shorter, too. Design and review by Tom Lane.
* Create a "relation mapping" infrastructure to support changing the relfilenodesTom Lane2010-02-07
| | | | | | | | | | | | | | | | | | | | | | | of shared or nailed system catalogs. This has two key benefits: * The new CLUSTER-based VACUUM FULL can be applied safely to all catalogs. * We no longer have to use an unsafe reindex-in-place approach for reindexing shared catalogs. CLUSTER on nailed catalogs now works too, although I left it disabled on shared catalogs because the resulting pg_index.indisclustered update would only be visible in one database. Since reindexing shared system catalogs is now fully transactional and crash-safe, the former special cases in REINDEX behavior have been removed; shared catalogs are treated the same as non-shared. This commit does not do anything about the recently-discussed problem of deadlocks between VACUUM FULL/CLUSTER on a system catalog and other concurrent queries; will address that in a separate patch. As a stopgap, parallel_schedule has been tweaked to run vacuum.sql by itself, to avoid such failures during the regression tests.
* Update copyright for the year 2010.Bruce Momjian2010-01-02
|
* Prevent indirect security attacks via changing session-local state withinTom Lane2009-12-09
| | | | | | | | | | | | | | | | | | | | | | | | | | | an allegedly immutable index function. It was previously recognized that we had to prevent such a function from executing SET/RESET ROLE/SESSION AUTHORIZATION, or it could trivially obtain the privileges of the session user. However, since there is in general no privilege checking for changes of session-local state, it is also possible for such a function to change settings in a way that might subvert later operations in the same session. Examples include changing search_path to cause an unexpected function to be called, or replacing an existing prepared statement with another one that will execute a function of the attacker's choosing. The present patch secures VACUUM, ANALYZE, and CREATE INDEX/REINDEX against these threats, which are the same places previously deemed to need protection against the SET ROLE issue. GUC changes are still allowed, since there are many useful cases for that, but we prevent security problems by forcing a rollback of any GUC change after completing the operation. Other cases are handled by throwing an error if any change is attempted; these include temp table creation, closing a cursor, and creating or deleting a prepared statement. (In 7.4, the infrastructure to roll back GUC changes doesn't exist, so we settle for rejecting changes of "search_path" in these contexts.) Original report and patch by Gurjeet Singh, additional analysis by Tom Lane. Security: CVE-2009-4136
* Make it possibly to specify GUC params per user and per database.Alvaro Herrera2009-10-07
| | | | | | | | | | | | | | Create a new catalog pg_db_role_setting where they are now stored, and better encapsulate the code that deals with settings into its realm. The old datconfig and rolconfig columns are removed. psql has gained a \drds command to display the settings. Backwards compatibility warning: while the backwards-compatible system views still have the config columns, they no longer completely represent the configuration for a user or database. Catalog version bumped.
* Make it reasonably safe to use pg_ctl to start the postmaster from a boot-timeTom Lane2009-08-27
| | | | | | | | | | | | | | | | | script. To do this, have pg_ctl pass down its parent shell's PID in an environment variable PG_GRANDPARENT_PID, and teach CreateLockFile() to disregard that PID as a false match if it finds it in postmaster.pid. This allows us to cope with one level of postgres-owned shell process even with pg_ctl in the way, so it's just as safe as starting the postmaster directly. You still have to be careful about how you write the initscript though. Adjust the comments in contrib/start-scripts/ to not deprecate use of pg_ctl. Also, fix the ROTATELOGS option in the OSX script, which was indulging in exactly the sort of unsafe coding that renders this fix pointless :-(. A pipe inside the "sudo" will probably result in more than one postgres-owned process hanging around.
* Allow backends to start up without use of the flat-file copy of pg_database.Tom Lane2009-08-12
| | | | | | | | | | | | | | | | | | | | | | To make this work in the base case, pg_database now has a nailed-in-cache relation descriptor that is initialized using hardwired knowledge in relcache.c. This means pg_database is added to the set of relations that need to have a Schema_pg_xxx macro maintained in pg_attribute.h. When this path is taken, we'll have to do a seqscan of pg_database to find the row we need. In the normal case, we are able to do an indexscan to find the database's row by name. This is made possible by storing a global relcache init file that describes only the shared catalogs and their indexes (and therefore is usable by all backends in any database). A new backend loads this cache file, finds its database OID after an indexscan on pg_database, and then loads the local relcache init file for that database. This change should effectively eliminate number of databases as a factor in backend startup time, even with large numbers of databases. However, the real reason for doing it is as a first step towards getting rid of the flat files altogether. There are still several other sub-projects to be tackled before that can happen.
* 8.4 pgindent run, with new combined Linux/FreeBSD/MinGW typedef listBruce Momjian2009-06-11
| | | | provided by Andrew.
* Tell gettext which codeset to use by calling bind_textdomain_codeset(). WeHeikki Linnakangas2009-04-08
| | | | | | | | | already did that on Windows, but it's needed on other platforms too when LC_CTYPE=C. With other locales, we enforce (or trust) that the codeset of the locale matches the server encoding so we don't need to bind it explicitly. It should do no harm in that case either, but I don't have full faith in the PG encoding -> OS codeset mapping table yet. Per recent discussion on pgsql-hackers.
* On Windows, call bind_textdomain_codeset on domains other than the default one,Alvaro Herrera2009-03-08
| | | | too, so that the codeset is properly mapped on the newly added PL domains.
* Quiet repeated "loaded library" messages from child backends that are justTom Lane2009-01-05
| | | | | | re-loading a library already loaded into the postmaster. ITAGAKI Takahiro
* Allow loadable modules to create PGC_POSTMASTER GUC variables, but onlyTom Lane2009-01-03
| | | | | | when loaded via shared_preload_libraries. Needed for support of pg_stat_statements, or pretty much anything else that wants a GUC to control size of a shared memory allocation.
* Update copyright for 2009.Bruce Momjian2009-01-01
|
* Append major version number and for libraries soname major version numberPeter Eisentraut2008-12-11
| | | | | | | to the gettext domain name, to simplify parallel installations. Also, rename set_text_domain() to pg_bindtextdomain(), because that is what it does.
* Improve translatability of error messages for external modules by tweakingAlvaro Herrera2008-10-09
| | | | | the ereport macro. Included in this commit are enough files for starting plpgsql, plpython, plperl and pltcl translations.
* Remove ipcclean utility command --- didn't work on all Unixes and onBruce Momjian2008-03-27
| | | | Windows. Users should use their operating system tools instead.
* Make standard maintenance operations (including VACUUM, ANALYZE, REINDEX,Tom Lane2008-01-03
| | | | | | | | | | | | | | | | | | | and CLUSTER) execute as the table owner rather than the calling user, using the same privilege-switching mechanism already used for SECURITY DEFINER functions. The purpose of this change is to ensure that user-defined functions used in index definitions cannot acquire the privileges of a superuser account that is performing routine maintenance. While a function used in an index is supposed to be IMMUTABLE and thus not able to do anything very interesting, there are several easy ways around that restriction; and even if we could plug them all, there would remain a risk of reading sensitive information and broadcasting it through a covert channel such as CPU usage. To prevent bypassing this security measure, execution of SET SESSION AUTHORIZATION and SET ROLE is now forbidden within a SECURITY DEFINER context. Thanks to Itagaki Takahiro for reporting this vulnerability. Security: CVE-2007-6600
* Update copyrights in source tree to 2008.Bruce Momjian2008-01-01
|
* Arrange for SET LOCAL's effects to persist until the end of the current topTom Lane2007-09-11
| | | | | | | | | | | | | | transaction, unless rolled back or overridden by a SET clause for the same variable attached to a surrounding function call. Per discussion, these seem the best semantics. Note that this is an INCOMPATIBLE CHANGE: in 8.0 through 8.2, SET LOCAL's effects disappeared at subtransaction commit (leading to behavior that made little sense at the SQL level). I took advantage of the opportunity to rewrite and simplify the GUC variable save/restore logic a little bit. The old idea of a "tentative" value is gone; it was a hangover from before we had a stack. Also, we no longer need a stack entry for every nesting level, but only for those in which a variable's value actually changed.
* Implement function-local GUC parameter settings, as per recent discussion.Tom Lane2007-09-03
| | | | | | | There are still some loose ends: I didn't do anything about the SET FROM CURRENT idea yet, and it's not real clear whether we are happy with the interaction of SET LOCAL with function-local settings. The documentation is a bit spartan, too.
* Restructure autovacuum in two processes: a dummy process, which runsAlvaro Herrera2007-02-15
| | | | | | | | | continuously, and requests vacuum runs of "autovacuum workers" to postmaster. The workers do the actual vacuum work. This allows for future improvements, like allowing multiple autovacuum jobs running in parallel. For now, the code keeps the original behavior of having a single autovac process at any time by sleeping until the previous worker has finished.
* Wording cleanup for error messages. Also change can't -> cannot.Bruce Momjian2007-02-01
| | | | | | | | | | | | | | Standard English uses "may", "can", and "might" in different ways: may - permission, "You may borrow my rake." can - ability, "I can lift that log." might - possibility, "It might rain today." Unfortunately, in conversational English, their use is often mixed, as in, "You may use this variable to do X", when in fact, "can" is a better choice. Similarly, "It may crash" is better stated, "It might crash".
* Update CVS HEAD for 2007 copyright. Back branches are typically notBruce Momjian2007-01-05
| | | | back-stamped for this.
* pgindent run for 8.2.Bruce Momjian2006-10-04
|
* Seems some C compilers think 'restrict' is a fully reserved word.Tom Lane2006-08-16
| | | | Per buildfarm results from warthog.
* Add server support for "plugin" libraries that can be used for add-on tasksTom Lane2006-08-15
| | | | | | | | | | | | | | | | | | such as debugging and performance measurement. This consists of two features: a table of "rendezvous variables" that allows separately-loaded shared libraries to communicate, and a new GUC setting "local_preload_libraries" that allows libraries to be loaded into specific sessions without explicit cooperation from the client application. To make local_preload_libraries as flexible as possible, we do not restrict its use to superusers; instead, it is restricted to load only libraries stored in $libdir/plugins/. The existing LOAD command has also been modified to allow non-superusers to LOAD libraries stored in this directory. This patch also renames the existing GUC variable preload_libraries to shared_preload_libraries (after a suggestion by Simon Riggs) and does some code refactoring in dfmgr.c to improve clarity. Korry Douglas, with a little help from Tom Lane.
* Add a feature for automatic initialization and finalization of dynamicallyTom Lane2006-08-08
| | | | | | | | | loaded libraries: call functions _PG_init() and _PG_fini() if the library defines such symbols. Hence we no longer need to specify an initialization function in preload_libraries: we can assume that the library used the _PG_init() convention, instead. This removes one source of pilot error in use of preloaded libraries. Original patch by Ralf Engelschall, preload_libraries changes by me.
* Remove 576 references of include files that were not needed.Bruce Momjian2006-07-14
|
* Update copyright for 2006. Update scripts.Bruce Momjian2006-03-05
|
* Make all command-line options of postmaster and postgres the same. SeePeter Eisentraut2006-01-05
| | | | | http://archives.postgresql.org/pgsql-hackers/2006-01/msg00151.php for the complete plan.
* Remove BEOS port.Bruce Momjian2006-01-05
|
* Re-run pgindent, fixing a problem where comment lines after a blankBruce Momjian2005-11-22
| | | | | | | | | comment line where output as too long, and update typedefs for /lib directory. Also fix case where identifiers were used as variable names in the backend, but as typedefs in ecpg (favor the backend for indenting). Backpatch to 8.1.X.
* Standard pgindent run for 8.1.Bruce Momjian2005-10-15
|
* Avoid an Assert failure if OuterUserId hasn't been set yet duringTom Lane2005-08-17
| | | | | AbortTransaction. This can happen if a backend's InitPostgres transaction fails (eg, because the given username is invalid). Per Alvaro.
* Add per-user and per-database connection limit options.Tom Lane2005-07-31
| | | | | This patch also includes preliminary update of pg_dumpall for roles. Petr Jelinek, with review by Bruce Momjian and Tom Lane.
* Add SET ROLE. This is a partial commit of Stephen Frost's recent patch;Tom Lane2005-07-25
| | | | I'm still working on the has_role function and information_schema changes.
* Integrate autovacuum functionality into the backend. There's still aTom Lane2005-07-14
| | | | | few loose ends to be dealt with, but it seems to work. Alvaro Herrera, based on the contrib code by Matthew O'Connor.
* Arrange for the postmaster (and standalone backends, initdb, etc) toTom Lane2005-07-04
| | | | | | | | chdir into PGDATA and subsequently use relative paths instead of absolute paths to access all files under PGDATA. This seems to give a small performance improvement, and it should make the system more robust against naive DBAs doing things like moving a database directory that has a live postmaster in it. Per recent discussion.
* Fix up problems in write_auth_file and parsing of the auth file.Tom Lane2005-06-28
| | | | | In particular, make hba.c cope with zero-length tokens, which it never did properly before. Also, enforce rolcanlogin.
* Replace pg_shadow and pg_group by new role-capable catalogs pg_authidTom Lane2005-06-28
| | | | | | | | and pg_auth_members. There are still many loose ends to finish in this patch (no documentation, no regression tests, no pg_dump support for instance). But I'm going to commit it now anyway so that Alvaro can make some progress on shared dependencies. The catalog changes should be pretty much done.
* Add lock file contents printout to "can't happen" case to helpTom Lane2005-06-20
| | | | investigate buildfarm failures.
* Mention ipcrm and ipcclean in error message.Bruce Momjian2005-06-07
|
* Ipcrm -> ipcclean in error message:Bruce Momjian2005-06-07
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | --------------------------------------------------------------------------- While playing around, I got the following error message: -- FATAL: pre-existing shared memory block (key 5432001, ID 90898435) is still in use HINT: If you're sure there are no old server processes still running, remove the shared memory block with the command "ipcrm", or just delete the file "/home/hlinnaka/pgsql/data/postmaster.pid". --- Thats normal because I used "kill -9 postmaster" to shut down. The hint advises me to use "ipcrm", but there's the "ipcclean" script in bin for just this purpose. The hint should probably advise to use ipcclean. The attached patch replaces all occurances of "ipcrm" with "ipcclean" in src/backend/utils/init/miscinit.c and all the translations in src/backend/po. While reviewing the patch, I noticed a likely typo in hr.po. While I don't speak Croatian, the translation seems to advise to use the "icpm(1)" command. I changed that to "ipcclean" too. Heikki Linnakangas
* Completion of project to use fixed OIDs for all system catalogs andTom Lane2005-04-14
| | | | | | | indexes. Replace all heap_openr and index_openr calls by heap_open and index_open. Remove runtime lookups of catalog OID numbers in various places. Remove relcache's support for looking up system catalogs by name. Bulky but mostly very boring patch ...
* Treat EPERM as a non-error case when checking to see if old postmasterTom Lane2005-03-18
| | | | | | | | | is still alive. This improves our odds of not getting fooled by an unrelated process when checking a stale lock file. Other checks already in place, plus one newly added in checkDataDir(), ensure that we cannot attempt to usurp the place of a postmaster belonging to a different userid, so there is no need to error out. Add comments indicating the importance of these other checks.
* Tag appropriate files for rc3PostgreSQL Daemon2004-12-31
| | | | | | | | Also performed an initial run through of upgrading our Copyright date to extend to 2005 ... first run here was very simple ... change everything where: grep 1996-2004 && the word 'Copyright' ... scanned through the generated list with 'less' first, and after, to make sure that I only picked up the right entries ...
* Fix func_ptr declaration for netbsd-mac68k, per Rémi Zara.Tom Lane2004-12-26
|
* Adjust configuration-files GUC behavior as per my recent proposal.Tom Lane2004-10-09
| | | | | | | | The vars are renamed to data_directory, config_file, hba_file, and ident_file, and are guaranteed to be set to accurate absolute paths during postmaster startup. This commit does not yet do anything about hiding path values from non-superusers.
generated by cgit v1.2.3 (git 2.25.1) at 2025-07-29 14:00:01 +0000