Skip to content

Commit 151c22d

Browse files
nathan-bossartnathan-bossart
committed
Revert MAINTAIN privilege and pg_maintain predefined role.
This reverts the following commits: 4dbdb82, c2122aa, 5b1a879, 9e1e9d6, ff9618e, 60684dd, 4441fc7, and b5d6382. A role with the MAINTAIN privilege may be able to use search_path tricks to escalate privileges to the table owner. Unfortunately, it is too late in the v16 development cycle to apply the proposed fix, i.e., restricting search_path when running maintenance commands. Bumps catversion. Reviewed-by: Jeff Davis Discussion: https://postgr.es/m/E1q7j7Y-000z1H-Hr%40gemulon.postgresql.org Backpatch-through: 16
1 parent ec99d6e commit 151c22d

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

41 files changed

+179
-445
lines changed

‎doc/src/sgml/ddl.sgml

Lines changed: 9 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1718,8 +1718,8 @@ ALTER TABLE products RENAME TO items;
17181718
<literal>INSERT</literal>, <literal>UPDATE</literal>, <literal>DELETE</literal>,
17191719
<literal>TRUNCATE</literal>, <literal>REFERENCES</literal>, <literal>TRIGGER</literal>,
17201720
<literal>CREATE</literal>, <literal>CONNECT</literal>, <literal>TEMPORARY</literal>,
1721-
<literal>EXECUTE</literal>, <literal>USAGE</literal>, <literal>SET</literal>,
1722-
<literal>ALTER SYSTEM</literal>, and <literal>MAINTAIN</literal>.
1721+
<literal>EXECUTE</literal>, <literal>USAGE</literal>, <literal>SET</literal>
1722+
and <literal>ALTER SYSTEM</literal>.
17231723
The privileges applicable to a particular
17241724
object vary depending on the object's type (table, function, etc.).
17251725
More detail about the meanings of these privileges appears below.
@@ -2010,19 +2010,7 @@ REVOKE ALL ON accounts FROM PUBLIC;
20102010
</para>
20112011
</listitem>
20122012
</varlistentry>
2013-
2014-
<varlistentry id="ddl-priv-maintain">
2015-
<term><literal>MAINTAIN</literal></term>
2016-
<listitem>
2017-
<para>
2018-
Allows <command>VACUUM</command>, <command>ANALYZE</command>,
2019-
<command>CLUSTER</command>, <command>REFRESH MATERIALIZED VIEW</command>,
2020-
<command>REINDEX</command>, and <command>LOCK TABLE</command> on a
2021-
relation.
2022-
</para>
2023-
</listitem>
2024-
</varlistentry>
2025-
</variablelist>
2013+
</variablelist>
20262014

20272015
The privileges required by other commands are listed on the
20282016
reference page of the respective command.
@@ -2171,11 +2159,6 @@ REVOKE ALL ON accounts FROM PUBLIC;
21712159
<entry><literal>A</literal></entry>
21722160
<entry><literal>PARAMETER</literal></entry>
21732161
</row>
2174-
<row>
2175-
<entry><literal>MAINTAIN</literal></entry>
2176-
<entry><literal>m</literal></entry>
2177-
<entry><literal>TABLE</literal></entry>
2178-
</row>
21792162
</tbody>
21802163
</tgroup>
21812164
</table>
@@ -2266,7 +2249,7 @@ REVOKE ALL ON accounts FROM PUBLIC;
22662249
</row>
22672250
<row>
22682251
<entry><literal>TABLE</literal> (and table-like objects)</entry>
2269-
<entry><literal>arwdDxtm</literal></entry>
2252+
<entry><literal>arwdDxt</literal></entry>
22702253
<entry>none</entry>
22712254
<entry><literal>\dp</literal></entry>
22722255
</row>
@@ -2325,11 +2308,11 @@ GRANT SELECT (col1), UPDATE (col1) ON mytable TO miriam_rw;
23252308
<programlisting>
23262309
=&gt; \dp mytable
23272310
Access privileges
2328-
Schema | Name | Type | Access privileges | Column privileges | Policies
2329-
--------+---------+-------+------------------------+-----------------------+----------
2330-
public | mytable | table | miriam=arwdDxtm/miriam+| col1: +|
2331-
| | | =r/miriam +| miriam_rw=rw/miriam |
2332-
| | | admin=arw/miriam | |
2311+
Schema | Name | Type | Access privileges | Column privileges | Policies
2312+
--------+---------+-------+-----------------------+-----------------------+----------
2313+
public | mytable | table | miriam=arwdDxt/miriam+| col1: +|
2314+
| | | =r/miriam +| miriam_rw=rw/miriam |
2315+
| | | admin=arw/miriam | |
23332316
(1 row)
23342317
</programlisting>
23352318
</para>

‎doc/src/sgml/func.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23545,7 +23545,7 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute');
2354523545
are <literal>SELECT</literal>, <literal>INSERT</literal>,
2354623546
<literal>UPDATE</literal>, <literal>DELETE</literal>,
2354723547
<literal>TRUNCATE</literal>, <literal>REFERENCES</literal>,
23548-
<literal>TRIGGER</literal>, and <literal>MAINTAIN</literal>.
23548+
and <literal>TRIGGER</literal>.
2354923549
</para></entry>
2355023550
</row>
2355123551

‎doc/src/sgml/ref/alter_default_privileges.sgml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ ALTER DEFAULT PRIVILEGES
2828

2929
<phrase>where <replaceable class="parameter">abbreviated_grant_or_revoke</replaceable> is one of:</phrase>
3030

31-
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
31+
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
3232
[, ...] | ALL [ PRIVILEGES ] }
3333
ON TABLES
3434
TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
@@ -51,7 +51,7 @@ GRANT { USAGE | CREATE | ALL [ PRIVILEGES ] }
5151
TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
5252

5353
REVOKE [ GRANT OPTION FOR ]
54-
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
54+
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
5555
[, ...] | ALL [ PRIVILEGES ] }
5656
ON TABLES
5757
FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]

‎doc/src/sgml/ref/analyze.sgml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -182,9 +182,11 @@ ANALYZE [ VERBOSE ] [ <replaceable class="parameter">table_and_columns</replacea
182182
<title>Notes</title>
183183

184184
<para>
185-
To analyze a table, one must ordinarily have the <literal>MAINTAIN</literal>
186-
privilege on the table. However, database owners are allowed to
185+
To analyze a table, one must ordinarily be the table's owner or a
186+
superuser. However, database owners are allowed to
187187
analyze all tables in their databases, except shared catalogs.
188+
(The restriction for shared catalogs means that a true database-wide
189+
<command>ANALYZE</command> can only be performed by a superuser.)
188190
<command>ANALYZE</command> will skip over any tables that the calling user
189191
does not have permission to analyze.
190192
</para>

‎doc/src/sgml/ref/cluster.sgml

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,9 @@ CLUSTER [VERBOSE]
7070
<command>CLUSTER</command> without a
7171
<replaceable class="parameter">table_name</replaceable> reclusters all the
7272
previously-clustered tables in the current database that the calling user
73-
has privileges for. This form of <command>CLUSTER</command> cannot be
74-
executed inside a transaction block.
73+
owns, or all such tables if called by a superuser. This
74+
form of <command>CLUSTER</command> cannot be executed inside a transaction
75+
block.
7576
</para>
7677

7778
<para>
@@ -132,11 +133,6 @@ CLUSTER [VERBOSE]
132133
<refsect1>
133134
<title>Notes</title>
134135

135-
<para>
136-
To cluster a table, one must have the <literal>MAINTAIN</literal> privilege
137-
on the table.
138-
</para>
139-
140136
<para>
141137
In cases where you are accessing single rows randomly
142138
within a table, the actual order of the data in the

‎doc/src/sgml/ref/grant.sgml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ PostgreSQL documentation
2121

2222
<refsynopsisdiv>
2323
<synopsis>
24-
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
24+
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
2525
[, ...] | ALL [ PRIVILEGES ] }
2626
ON { [ TABLE ] <replaceable class="parameter">table_name</replaceable> [, ...]
2727
| ALL TABLES IN SCHEMA <replaceable class="parameter">schema_name</replaceable> [, ...] }
@@ -193,7 +193,6 @@ GRANT <replaceable class="parameter">role_name</replaceable> [, ...] TO <replace
193193
<term><literal>USAGE</literal></term>
194194
<term><literal>SET</literal></term>
195195
<term><literal>ALTER SYSTEM</literal></term>
196-
<term><literal>MAINTAIN</literal></term>
197196
<listitem>
198197
<para>
199198
Specific types of privileges, as defined in <xref linkend="ddl-priv"/>.

‎doc/src/sgml/ref/lock.sgml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,8 +166,8 @@ LOCK [ TABLE ] [ ONLY ] <replaceable class="parameter">name</replaceable> [ * ]
166166

167167
<para>
168168
To lock a table, the user must have the right privilege for the specified
169-
<replaceable class="parameter">lockmode</replaceable>.
170-
If the user has <literal>MAINTAIN</literal>,
169+
<replaceable class="parameter">lockmode</replaceable>, or be the table's
170+
owner or a superuser. If the user has
171171
<literal>UPDATE</literal>, <literal>DELETE</literal>, or
172172
<literal>TRUNCATE</literal> privileges on the table, any <replaceable
173173
class="parameter">lockmode</replaceable> is permitted. If the user has

‎doc/src/sgml/ref/refresh_materialized_view.sgml

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,8 @@ REFRESH MATERIALIZED VIEW [ CONCURRENTLY ] <replaceable class="parameter">name</
3131

3232
<para>
3333
<command>REFRESH MATERIALIZED VIEW</command> completely replaces the
34-
contents of a materialized view. To execute this command you must have the
35-
<literal>MAINTAIN</literal>
36-
privilege on the materialized view. The old contents are discarded. If
34+
contents of a materialized view. To execute this command you must be the
35+
owner of the materialized view. The old contents are discarded. If
3736
<literal>WITH DATA</literal> is specified (or defaults) the backing query
3837
is executed to provide the new data, and the materialized view is left in a
3938
scannable state. If <literal>WITH NO DATA</literal> is specified no new

‎doc/src/sgml/ref/reindex.sgml

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -292,21 +292,16 @@ REINDEX [ ( <replaceable class="parameter">option</replaceable> [, ...] ) ] { DA
292292
</para>
293293

294294
<para>
295-
Reindexing a single index or table requires
296-
having the <literal>MAINTAIN</literal> privilege on the
297-
table. Note that while <command>REINDEX</command> on a partitioned index or
298-
table requires having the <literal>MAINTAIN</literal> privilege on the
299-
partitioned table, such commands skip the privilege checks when processing
300-
the individual partitions. Reindexing a schema or database requires being the
301-
owner of that schema or database or having privileges of the
302-
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
303-
role. Note specifically that it's thus
295+
Reindexing a single index or table requires being the owner of that
296+
index or table. Reindexing a schema or database requires being the
297+
owner of that schema or database. Note specifically that it's thus
304298
possible for non-superusers to rebuild indexes of tables owned by
305-
other users. However, as a special exception,
306-
<command>REINDEX DATABASE</command>, <command>REINDEX SCHEMA</command>,
307-
and <command>REINDEX SYSTEM</command> will skip indexes on shared catalogs
308-
unless the user has the <literal>MAINTAIN</literal> privilege on the
309-
catalog.
299+
other users. However, as a special exception, when
300+
<command>REINDEX DATABASE</command>, <command>REINDEX SCHEMA</command>
301+
or <command>REINDEX SYSTEM</command> is issued by a non-superuser,
302+
indexes on shared catalogs will be skipped unless the user owns the
303+
catalog (which typically won't be the case). Of course, superusers
304+
can always reindex anything.
310305
</para>
311306

312307
<para>

‎doc/src/sgml/ref/revoke.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ PostgreSQL documentation
2222
<refsynopsisdiv>
2323
<synopsis>
2424
REVOKE [ GRANT OPTION FOR ]
25-
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
25+
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
2626
[, ...] | ALL [ PRIVILEGES ] }
2727
ON { [ TABLE ] <replaceable class="parameter">table_name</replaceable> [, ...]
2828
| ALL TABLES IN SCHEMA <replaceable>schema_name</replaceable> [, ...] }

‎doc/src/sgml/ref/vacuum.sgml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -444,9 +444,11 @@ VACUUM [ FULL ] [ FREEZE ] [ VERBOSE ] [ ANALYZE ] [ <replaceable class="paramet
444444
<title>Notes</title>
445445

446446
<para>
447-
To vacuum a table, one must ordinarily have the <literal>MAINTAIN</literal>
448-
privilege on the table. However, database owners are allowed to
447+
To vacuum a table, one must ordinarily be the table's owner or a
448+
superuser. However, database owners are allowed to
449449
vacuum all tables in their databases, except shared catalogs.
450+
(The restriction for shared catalogs means that a true database-wide
451+
<command>VACUUM</command> can only be performed by a superuser.)
450452
<command>VACUUM</command> will skip over any tables that the calling user
451453
does not have permission to vacuum.
452454
</para>

‎doc/src/sgml/user-manag.sgml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -683,18 +683,6 @@ DROP ROLE doomed_role;
683683
the <link linkend="sql-checkpoint"><command>CHECKPOINT</command></link>
684684
command.</entry>
685685
</row>
686-
<row>
687-
<entry>pg_maintain</entry>
688-
<entry>Allow executing
689-
<link linkend="sql-vacuum"><command>VACUUM</command></link>,
690-
<link linkend="sql-analyze"><command>ANALYZE</command></link>,
691-
<link linkend="sql-cluster"><command>CLUSTER</command></link>,
692-
<link linkend="sql-refreshmaterializedview"><command>REFRESH MATERIALIZED VIEW</command></link>,
693-
<link linkend="sql-reindex"><command>REINDEX</command></link>,
694-
and <link linkend="sql-lock"><command>LOCK TABLE</command></link> on all
695-
relations, as if having <literal>MAINTAIN</literal> rights on those
696-
objects, even without having it explicitly.</entry>
697-
</row>
698686
<row>
699687
<entry>pg_use_reserved_connections</entry>
700688
<entry>Allow use of connection slots reserved via

‎src/backend/catalog/aclchk.c

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2612,8 +2612,6 @@ string_to_privilege(const char *privname)
26122612
return ACL_SET;
26132613
if (strcmp(privname, "alter system") == 0)
26142614
return ACL_ALTER_SYSTEM;
2615-
if (strcmp(privname, "maintain") == 0)
2616-
return ACL_MAINTAIN;
26172615
if (strcmp(privname, "rule") == 0)
26182616
return 0; /* ignore old RULE privileges */
26192617
ereport(ERROR,
@@ -2655,8 +2653,6 @@ privilege_to_string(AclMode privilege)
26552653
return "SET";
26562654
case ACL_ALTER_SYSTEM:
26572655
return "ALTER SYSTEM";
2658-
case ACL_MAINTAIN:
2659-
return "MAINTAIN";
26602656
default:
26612657
elog(ERROR, "unrecognized privilege: %d", (int) privilege);
26622658
}
@@ -3388,17 +3384,6 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask,
33883384
has_privs_of_role(roleid, ROLE_PG_WRITE_ALL_DATA))
33893385
result |= (mask & (ACL_INSERT | ACL_UPDATE | ACL_DELETE));
33903386

3391-
/*
3392-
* Check if ACL_MAINTAIN is being checked and, if so, and not already set
3393-
* as part of the result, then check if the user is a member of the
3394-
* pg_maintain role, which allows VACUUM, ANALYZE, CLUSTER, REFRESH
3395-
* MATERIALIZED VIEW, and REINDEX on all relations.
3396-
*/
3397-
if (mask & ACL_MAINTAIN &&
3398-
!(result & ACL_MAINTAIN) &&
3399-
has_privs_of_role(roleid, ROLE_PG_MAINTAIN))
3400-
result |= ACL_MAINTAIN;
3401-
34023387
return result;
34033388
}
34043389

‎src/backend/commands/analyze.c

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -159,15 +159,16 @@ analyze_rel(Oid relid, RangeVar *relation,
159159
return;
160160

161161
/*
162-
* Check if relation needs to be skipped based on privileges. This check
162+
* Check if relation needs to be skipped based on ownership. This check
163163
* happens also when building the relation list to analyze for a manual
164164
* operation, and needs to be done additionally here as ANALYZE could
165-
* happen across multiple transactions where privileges could have changed
166-
* in-between. Make sure to generate only logs for ANALYZE in this case.
165+
* happen across multiple transactions where relation ownership could have
166+
* changed in-between. Make sure to generate only logs for ANALYZE in
167+
* this case.
167168
*/
168-
if (!vacuum_is_permitted_for_relation(RelationGetRelid(onerel),
169-
onerel->rd_rel,
170-
params->options & ~VACOPT_VACUUM))
169+
if (!vacuum_is_relation_owner(RelationGetRelid(onerel),
170+
onerel->rd_rel,
171+
params->options & VACOPT_ANALYZE))
171172
{
172173
relation_close(onerel, ShareUpdateExclusiveLock);
173174
return;

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy