postgres.git / summary / log / commit / refs

commit    b81d3791ed8f52bf2507c306bda922dc272f20ce
Author:   Noah Misch <noah@leadboat.com>
Date:     Fri Dec 25 18:41:59 2020 +0000
First released in: 14.0, 9.5.25, 9.6.21, 10.16, 11.11, 12.6, 13.2

    Invalidate acl.c caches when pg_authid changes.
    
    This makes existing sessions reflect "ALTER ROLE ... [NO]INHERIT" as
    quickly as they have been reflecting "GRANT role_name".  Back-patch to
    9.5 (all supported versions).
    
    Reviewed by Nathan Bossart.
    
    Discussion: https://postgr.es/m/20201221095028.GB3777719@rfd.leadboat.com


 src/backend/utils/adt/acl.c              | 9 ++++++---
 src/test/regress/expected/privileges.out | 7 +++++++
 src/test/regress/sql/privileges.sql      | 6 ++++++
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/src/backend/utils/adt/acl.c b/src/backend/utils/adt/acl.c
index 5142b4fbf5a..5bca2c247cc 100644
--- a/src/backend/utils/adt/acl.c
+++ b/src/backend/utils/adt/acl.c
@@ -49,7 +49,6 @@ typedef struct
  * role.  In most of these tests the "given role" is the same, namely the
  * active current user.  So we can optimize it by keeping a cached list of
  * all the roles the "given role" is a member of, directly or indirectly.
- * The cache is flushed whenever we detect a change in pg_auth_members.
  *
  * There are actually two caches, one computed under "has_privs" rules
  * (do not recurse where rolinherit isn't true) and one computed under
@@ -4693,12 +4692,16 @@ initialize_acl(void)
 	if (!IsBootstrapProcessingMode())
 	{
 		/*
-		 * In normal mode, set a callback on any syscache invalidation of
-		 * pg_auth_members rows
+		 * In normal mode, set a callback on any syscache invalidation of rows
+		 * of pg_auth_members (for each AUTHMEM search in this file) or
+		 * pg_authid (for has_rolinherit())
 		 */
 		CacheRegisterSyscacheCallback(AUTHMEMROLEMEM,
 									  RoleMembershipCacheCallback,
 									  (Datum) 0);
+		CacheRegisterSyscacheCallback(AUTHOID,
+									  RoleMembershipCacheCallback,
+									  (Datum) 0);
 	}
 }
 
diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out
index ce972b40d4a..1b9f3d117db 100644
--- a/src/test/regress/expected/privileges.out
+++ b/src/test/regress/expected/privileges.out
@@ -346,6 +346,13 @@ SET SESSION AUTHORIZATION regress_user1;
 SELECT * FROM atest3; -- fail
 ERROR:  permission denied for relation atest3
 DELETE FROM atest3; -- ok
+BEGIN;
+RESET SESSION AUTHORIZATION;
+ALTER ROLE regress_priv_user1 NOINHERIT;
+SET SESSION AUTHORIZATION regress_priv_user1;
+DELETE FROM atest3;
+ERROR:  permission denied for table atest3
+ROLLBACK;
 -- views
 SET SESSION AUTHORIZATION regress_user3;
 CREATE VIEW atestv1 AS SELECT * FROM atest1; -- ok
diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql
index d285f6198cf..e66909e36c3 100644
--- a/src/test/regress/sql/privileges.sql
+++ b/src/test/regress/sql/privileges.sql
@@ -216,6 +216,12 @@ SET SESSION AUTHORIZATION regress_user1;
 SELECT * FROM atest3; -- fail
 DELETE FROM atest3; -- ok
 
+BEGIN;
+RESET SESSION AUTHORIZATION;
+ALTER ROLE regress_priv_user1 NOINHERIT;
+SET SESSION AUTHORIZATION regress_priv_user1;
+DELETE FROM atest3;
+ROLLBACK;
 
 -- views
 


[parent: 0b54a80a38c7]