pg.ddx.io pgsql-committers@postgresql.org mailing list archivehelp / color / mirror / Atom feed
pgsql: Fix authorization check for role membership changes. 5+ messages / 1 participants [nested] [flat]
* pgsql: Fix authorization check for role membership changes. @ 2026-08-13 21:36 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: Nathan Bossart @ 2026-08-13 21:36 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix authorization check for role membership changes. Presently, check_role_membership_authorization() decides whether the current user may grant or revoke membership in a role by calling is_admin_of_role(), which recurses through all grants, while it chooses the grantor to record for the resulting entry by calling select_best_admin(), which recurses only through inherited grants. When the two disagree, the permission check passes and the grantor lookup then comes up empty, so the user sees an internal "no possible grantors" error. ALTER GROUP ... ADD USER reaches the same error through the separate check in AlterRole(). To fix, teach both checks to search the same way select_best_admin() does via a new has_admin_privs_of_role(). The new check passes exactly when the grantor lookup was going to succeed, so nothing that works today starts failing; the internal error simply becomes a proper permission error. Note that this leaves the other callers of is_admin_of_role() alone, so a role reachable only through a non-inherited grant can still be dropped, renamed, or altered. Whether that ought to change as well is left as a future exercise. Oversight in commit ce6b672e44. Reported-by: ChangAo Chen <cca5507@qq.com> Author: ChangAo Chen <cca5507@qq.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Pretham <prezza672@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com> Discussion: https://postgr.es/m/tencent_ADCE2B34B230A9B631854806104FEF40C105%40qq.com Discussion: https://postgr.es/m/CAJUn_kN%2BMhbb8fYP5xxQCq1KEziOinM6HgYx4ts_pPDnQ2y1nQ%40mail.gmail.com Backpatch-through: 16 Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/a8261c766067f939aeea8e2dff821fed08dada79 Modified Files -------------- src/backend/commands/user.c | 4 ++-- src/backend/utils/adt/acl.c | 27 +++++++++++++++++++++++++++ src/include/utils/acl.h | 1 + src/test/regress/expected/privileges.out | 9 +++++++++ src/test/regress/sql/privileges.sql | 5 +++++ 5 files changed, 44 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix authorization check for role membership changes. @ 2026-08-13 21:36 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: Nathan Bossart @ 2026-08-13 21:36 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix authorization check for role membership changes. Presently, check_role_membership_authorization() decides whether the current user may grant or revoke membership in a role by calling is_admin_of_role(), which recurses through all grants, while it chooses the grantor to record for the resulting entry by calling select_best_admin(), which recurses only through inherited grants. When the two disagree, the permission check passes and the grantor lookup then comes up empty, so the user sees an internal "no possible grantors" error. ALTER GROUP ... ADD USER reaches the same error through the separate check in AlterRole(). To fix, teach both checks to search the same way select_best_admin() does via a new has_admin_privs_of_role(). The new check passes exactly when the grantor lookup was going to succeed, so nothing that works today starts failing; the internal error simply becomes a proper permission error. Note that this leaves the other callers of is_admin_of_role() alone, so a role reachable only through a non-inherited grant can still be dropped, renamed, or altered. Whether that ought to change as well is left as a future exercise. Oversight in commit ce6b672e44. Reported-by: ChangAo Chen <cca5507@qq.com> Author: ChangAo Chen <cca5507@qq.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Pretham <prezza672@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com> Discussion: https://postgr.es/m/tencent_ADCE2B34B230A9B631854806104FEF40C105%40qq.com Discussion: https://postgr.es/m/CAJUn_kN%2BMhbb8fYP5xxQCq1KEziOinM6HgYx4ts_pPDnQ2y1nQ%40mail.gmail.com Backpatch-through: 16 Branch ------ REL_19_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/9db2383e0041324f01c066fa9b000750c385bfff Modified Files -------------- src/backend/commands/user.c | 4 ++-- src/backend/utils/adt/acl.c | 27 +++++++++++++++++++++++++++ src/include/utils/acl.h | 1 + src/test/regress/expected/privileges.out | 9 +++++++++ src/test/regress/sql/privileges.sql | 5 +++++ 5 files changed, 44 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix authorization check for role membership changes. @ 2026-08-13 21:36 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: Nathan Bossart @ 2026-08-13 21:36 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix authorization check for role membership changes. Presently, check_role_membership_authorization() decides whether the current user may grant or revoke membership in a role by calling is_admin_of_role(), which recurses through all grants, while it chooses the grantor to record for the resulting entry by calling select_best_admin(), which recurses only through inherited grants. When the two disagree, the permission check passes and the grantor lookup then comes up empty, so the user sees an internal "no possible grantors" error. ALTER GROUP ... ADD USER reaches the same error through the separate check in AlterRole(). To fix, teach both checks to search the same way select_best_admin() does via a new has_admin_privs_of_role(). The new check passes exactly when the grantor lookup was going to succeed, so nothing that works today starts failing; the internal error simply becomes a proper permission error. Note that this leaves the other callers of is_admin_of_role() alone, so a role reachable only through a non-inherited grant can still be dropped, renamed, or altered. Whether that ought to change as well is left as a future exercise. Oversight in commit ce6b672e44. Reported-by: ChangAo Chen <cca5507@qq.com> Author: ChangAo Chen <cca5507@qq.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Pretham <prezza672@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com> Discussion: https://postgr.es/m/tencent_ADCE2B34B230A9B631854806104FEF40C105%40qq.com Discussion: https://postgr.es/m/CAJUn_kN%2BMhbb8fYP5xxQCq1KEziOinM6HgYx4ts_pPDnQ2y1nQ%40mail.gmail.com Backpatch-through: 16 Branch ------ REL_18_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/0468246f5dce721af1f0dd0c465f81c028128a98 Modified Files -------------- src/backend/commands/user.c | 4 ++-- src/backend/utils/adt/acl.c | 27 +++++++++++++++++++++++++++ src/include/utils/acl.h | 1 + src/test/regress/expected/privileges.out | 9 +++++++++ src/test/regress/sql/privileges.sql | 5 +++++ 5 files changed, 44 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix authorization check for role membership changes. @ 2026-08-13 21:36 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: Nathan Bossart @ 2026-08-13 21:36 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix authorization check for role membership changes. Presently, check_role_membership_authorization() decides whether the current user may grant or revoke membership in a role by calling is_admin_of_role(), which recurses through all grants, while it chooses the grantor to record for the resulting entry by calling select_best_admin(), which recurses only through inherited grants. When the two disagree, the permission check passes and the grantor lookup then comes up empty, so the user sees an internal "no possible grantors" error. ALTER GROUP ... ADD USER reaches the same error through the separate check in AlterRole(). To fix, teach both checks to search the same way select_best_admin() does via a new has_admin_privs_of_role(). The new check passes exactly when the grantor lookup was going to succeed, so nothing that works today starts failing; the internal error simply becomes a proper permission error. Note that this leaves the other callers of is_admin_of_role() alone, so a role reachable only through a non-inherited grant can still be dropped, renamed, or altered. Whether that ought to change as well is left as a future exercise. Oversight in commit ce6b672e44. Reported-by: ChangAo Chen <cca5507@qq.com> Author: ChangAo Chen <cca5507@qq.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Pretham <prezza672@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com> Discussion: https://postgr.es/m/tencent_ADCE2B34B230A9B631854806104FEF40C105%40qq.com Discussion: https://postgr.es/m/CAJUn_kN%2BMhbb8fYP5xxQCq1KEziOinM6HgYx4ts_pPDnQ2y1nQ%40mail.gmail.com Backpatch-through: 16 Branch ------ REL_17_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/be0076b71b68f2e7cb2553af48aa8f8ecc8bda40 Modified Files -------------- src/backend/commands/user.c | 4 ++-- src/backend/utils/adt/acl.c | 27 +++++++++++++++++++++++++++ src/include/utils/acl.h | 1 + src/test/regress/expected/privileges.out | 9 +++++++++ src/test/regress/sql/privileges.sql | 5 +++++ 5 files changed, 44 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
* pgsql: Fix authorization check for role membership changes. @ 2026-08-13 21:36 Nathan Bossart <nathan@postgresql.org> 0 siblings, 0 replies; 5+ messages in thread From: Nathan Bossart @ 2026-08-13 21:36 UTC (permalink / raw) To: pgsql-committers@lists.postgresql.org Fix authorization check for role membership changes. Presently, check_role_membership_authorization() decides whether the current user may grant or revoke membership in a role by calling is_admin_of_role(), which recurses through all grants, while it chooses the grantor to record for the resulting entry by calling select_best_admin(), which recurses only through inherited grants. When the two disagree, the permission check passes and the grantor lookup then comes up empty, so the user sees an internal "no possible grantors" error. ALTER GROUP ... ADD USER reaches the same error through the separate check in AlterRole(). To fix, teach both checks to search the same way select_best_admin() does via a new has_admin_privs_of_role(). The new check passes exactly when the grantor lookup was going to succeed, so nothing that works today starts failing; the internal error simply becomes a proper permission error. Note that this leaves the other callers of is_admin_of_role() alone, so a role reachable only through a non-inherited grant can still be dropped, renamed, or altered. Whether that ought to change as well is left as a future exercise. Oversight in commit ce6b672e44. Reported-by: ChangAo Chen <cca5507@qq.com> Author: ChangAo Chen <cca5507@qq.com> Reviewed-by: Chao Li <li.evan.chao@gmail.com> Reviewed-by: Pretham <prezza672@gmail.com> Reviewed-by: Robert Haas <robertmhaas@gmail.com> Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com> Discussion: https://postgr.es/m/tencent_ADCE2B34B230A9B631854806104FEF40C105%40qq.com Discussion: https://postgr.es/m/CAJUn_kN%2BMhbb8fYP5xxQCq1KEziOinM6HgYx4ts_pPDnQ2y1nQ%40mail.gmail.com Backpatch-through: 16 Branch ------ REL_16_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/dbda203fe95de429d238f3eb1b7847de34a53479 Modified Files -------------- src/backend/commands/user.c | 4 ++-- src/backend/utils/adt/acl.c | 27 +++++++++++++++++++++++++++ src/include/utils/acl.h | 1 + src/test/regress/expected/privileges.out | 9 +++++++++ src/test/regress/sql/privileges.sql | 5 +++++ 5 files changed, 44 insertions(+), 2 deletions(-) ^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2026-08-13 21:36 UTC | newest] Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed) -- links below jump to the message on this page -- 2026-08-13 21:36 pgsql: Fix authorization check for role membership changes. Nathan Bossart <nathan@postgresql.org> 2026-08-13 21:36 pgsql: Fix authorization check for role membership changes. Nathan Bossart <nathan@postgresql.org> 2026-08-13 21:36 pgsql: Fix authorization check for role membership changes. Nathan Bossart <nathan@postgresql.org> 2026-08-13 21:36 pgsql: Fix authorization check for role membership changes. Nathan Bossart <nathan@postgresql.org> 2026-08-13 21:36 pgsql: Fix authorization check for role membership changes. Nathan Bossart <nathan@postgresql.org>
This inbox is served by DDX for PostgreSQL; see mirroring instructions for how to clone and mirror all data and code used for this inbox