From 668e14b2de0d78fe5722b227071151a68ed759a1 Mon Sep 17 00:00:00 2001 From: Craig Ringer Date: Mon, 20 Jan 2014 13:49:56 +0800 Subject: [PATCH 07/10] RLS: Enforce row-security by transforming query plans --- src/backend/executor/execMain.c | 27 +- src/backend/nodes/copyfuncs.c | 2 + src/backend/nodes/equalfuncs.c | 2 + src/backend/nodes/nodeFuncs.c | 12 +- src/backend/nodes/outfuncs.c | 2 + src/backend/nodes/readfuncs.c | 1 + src/backend/optimizer/plan/planner.c | 21 +- src/backend/optimizer/prep/preptlist.c | 68 ++- src/backend/optimizer/prep/prepunion.c | 95 +++- src/backend/optimizer/util/Makefile | 3 +- src/backend/optimizer/util/rowsecurity.c | 744 +++++++++++++++++++++++++++++++ src/backend/rewrite/rewriteHandler.c | 16 + src/backend/utils/adt/ri_triggers.c | 13 +- src/include/miscadmin.h | 1 + src/include/nodes/nodeFuncs.h | 1 + src/include/nodes/parsenodes.h | 4 +- src/include/nodes/relation.h | 4 + src/include/optimizer/rowsecurity.h | 27 ++ src/include/rewrite/rewriteHandler.h | 1 + 19 files changed, 1016 insertions(+), 28 deletions(-) create mode 100644 src/backend/optimizer/util/rowsecurity.c create mode 100644 src/include/optimizer/rowsecurity.h diff --git a/src/backend/executor/execMain.c b/src/backend/executor/execMain.c index 6b5f198..0041c23 100644 --- a/src/backend/executor/execMain.c +++ b/src/backend/executor/execMain.c @@ -789,8 +789,9 @@ InitPlan(QueryDesc *queryDesc, int eflags) foreach(l, plannedstmt->rowMarks) { PlanRowMark *rc = (PlanRowMark *) lfirst(l); - Oid relid; - Relation relation; + RangeTblEntry *rte = NULL; + Relation relation = NULL; + LOCKMODE lockmode = NoLock; ExecRowMark *erm; /* ignore "parent" rowmarks; they are irrelevant at runtime */ @@ -803,27 +804,33 @@ InitPlan(QueryDesc *queryDesc, int eflags) case ROW_MARK_NOKEYEXCLUSIVE: case ROW_MARK_SHARE: case ROW_MARK_KEYSHARE: - relid = getrelid(rc->rti, rangeTable); - relation = heap_open(relid, RowShareLock); + rte = rt_fetch(rc->rti, rangeTable); + lockmode = RowShareLock; break; case ROW_MARK_REFERENCE: - relid = getrelid(rc->rti, rangeTable); - relation = heap_open(relid, AccessShareLock); + rte = rt_fetch(rc->rti, rangeTable); + lockmode = AccessShareLock; break; case ROW_MARK_COPY: /* there's no real table here ... */ - relation = NULL; break; default: elog(ERROR, "unrecognized markType: %d", rc->markType); - relation = NULL; /* keep compiler quiet */ break; } /* Check that relation is a legal target for marking */ - if (relation) + if (rte) + { + if (rte->rtekind == RTE_RELATION) + relation = heap_open(rte->relid, lockmode); + else + { + Assert(rte->rtekind == RTE_SUBQUERY); + relation = heap_open(rte->rowsec_relid, lockmode); + } CheckValidRowMarkRel(relation, rc->markType); - + } erm = (ExecRowMark *) palloc(sizeof(ExecRowMark)); erm->relation = relation; erm->rti = rc->rti; diff --git a/src/backend/nodes/copyfuncs.c b/src/backend/nodes/copyfuncs.c index 52bd8f5..3a8b60c 100644 --- a/src/backend/nodes/copyfuncs.c +++ b/src/backend/nodes/copyfuncs.c @@ -1936,6 +1936,7 @@ _copyAppendRelInfo(const AppendRelInfo *from) COPY_SCALAR_FIELD(parent_relid); COPY_SCALAR_FIELD(child_relid); + COPY_SCALAR_FIELD(child_result); COPY_SCALAR_FIELD(parent_reltype); COPY_SCALAR_FIELD(child_reltype); COPY_NODE_FIELD(translated_vars); @@ -2467,6 +2468,7 @@ _copyQuery(const Query *from) COPY_SCALAR_FIELD(canSetTag); COPY_NODE_FIELD(utilityStmt); COPY_SCALAR_FIELD(resultRelation); + COPY_SCALAR_FIELD(sourceRelation); COPY_SCALAR_FIELD(hasAggs); COPY_SCALAR_FIELD(hasWindowFuncs); COPY_SCALAR_FIELD(hasSubLinks); diff --git a/src/backend/nodes/equalfuncs.c b/src/backend/nodes/equalfuncs.c index b9b0de2..cb2abf6 100644 --- a/src/backend/nodes/equalfuncs.c +++ b/src/backend/nodes/equalfuncs.c @@ -814,6 +814,7 @@ _equalAppendRelInfo(const AppendRelInfo *a, const AppendRelInfo *b) { COMPARE_SCALAR_FIELD(parent_relid); COMPARE_SCALAR_FIELD(child_relid); + COMPARE_SCALAR_FIELD(child_result); COMPARE_SCALAR_FIELD(parent_reltype); COMPARE_SCALAR_FIELD(child_reltype); COMPARE_NODE_FIELD(translated_vars); @@ -849,6 +850,7 @@ _equalQuery(const Query *a, const Query *b) COMPARE_SCALAR_FIELD(canSetTag); COMPARE_NODE_FIELD(utilityStmt); COMPARE_SCALAR_FIELD(resultRelation); + COMPARE_SCALAR_FIELD(sourceRelation); COMPARE_SCALAR_FIELD(hasAggs); COMPARE_SCALAR_FIELD(hasWindowFuncs); COMPARE_SCALAR_FIELD(hasSubLinks); diff --git a/src/backend/nodes/nodeFuncs.c b/src/backend/nodes/nodeFuncs.c index 123f2a6..fa8f040 100644 --- a/src/backend/nodes/nodeFuncs.c +++ b/src/backend/nodes/nodeFuncs.c @@ -1948,8 +1948,11 @@ query_tree_walker(Query *query, return true; if (walker((Node *) query->withCheckOptions, context)) return true; - if (walker((Node *) query->returningList, context)) - return true; + if (!(flags & QTW_IGNORE_RETURNING)) + { + if (walker((Node *) query->returningList, context)) + return true; + } if (walker((Node *) query->jointree, context)) return true; if (walker(query->setOperations, context)) @@ -2686,7 +2689,10 @@ query_tree_mutator(Query *query, MUTATE(query->targetList, query->targetList, List *); MUTATE(query->withCheckOptions, query->withCheckOptions, List *); - MUTATE(query->returningList, query->returningList, List *); + if (!(flags & QTW_IGNORE_RETURNING)) + MUTATE(query->returningList, query->returningList, List *); + else + query->returningList = copyObject(query->returningList); MUTATE(query->jointree, query->jointree, FromExpr *); MUTATE(query->setOperations, query->setOperations, Node *); MUTATE(query->havingQual, query->havingQual, Node *); diff --git a/src/backend/nodes/outfuncs.c b/src/backend/nodes/outfuncs.c index cfa4cb3..500faeb 100644 --- a/src/backend/nodes/outfuncs.c +++ b/src/backend/nodes/outfuncs.c @@ -1925,6 +1925,7 @@ _outAppendRelInfo(StringInfo str, const AppendRelInfo *node) WRITE_UINT_FIELD(parent_relid); WRITE_UINT_FIELD(child_relid); + WRITE_UINT_FIELD(child_result); WRITE_OID_FIELD(parent_reltype); WRITE_OID_FIELD(child_reltype); WRITE_NODE_FIELD(translated_vars); @@ -2241,6 +2242,7 @@ _outQuery(StringInfo str, const Query *node) appendStringInfoString(str, " :utilityStmt <>"); WRITE_INT_FIELD(resultRelation); + WRITE_INT_FIELD(sourceRelation); WRITE_BOOL_FIELD(hasAggs); WRITE_BOOL_FIELD(hasWindowFuncs); WRITE_BOOL_FIELD(hasSubLinks); diff --git a/src/backend/nodes/readfuncs.c b/src/backend/nodes/readfuncs.c index 335579f..884f45c 100644 --- a/src/backend/nodes/readfuncs.c +++ b/src/backend/nodes/readfuncs.c @@ -201,6 +201,7 @@ _readQuery(void) READ_BOOL_FIELD(canSetTag); READ_NODE_FIELD(utilityStmt); READ_INT_FIELD(resultRelation); + READ_INT_FIELD(sourceRelation); READ_BOOL_FIELD(hasAggs); READ_BOOL_FIELD(hasWindowFuncs); READ_BOOL_FIELD(hasSubLinks); diff --git a/src/backend/optimizer/plan/planner.c b/src/backend/optimizer/plan/planner.c index 8c12eb9..63f0ec2 100644 --- a/src/backend/optimizer/plan/planner.c +++ b/src/backend/optimizer/plan/planner.c @@ -33,6 +33,7 @@ #include "optimizer/planmain.h" #include "optimizer/planner.h" #include "optimizer/prep.h" +#include "optimizer/rowsecurity.h" #include "optimizer/subselect.h" #include "optimizer/tlist.h" #include "parser/analyze.h" @@ -406,6 +407,19 @@ subquery_planner(PlannerGlobal *glob, Query *parse, expand_inherited_tables(root); /* + * Apply row-security policy of the relation being referenced, + * if configured with either of built-in or extension's features. + * RangeTblEntry of the relation with row-security policy shall + * be replaced with a row-security subquery that has simple scan + * on the target relation with row-security policy qualifiers. + * + * This routine assumes PlannerInfo is already handled with + * expand_inherited_tables, thus, AppendRelInfo or PlanRowMark + * have valid information. + */ + apply_row_security_policy(root); + + /* * Set hasHavingQual to remember if HAVING clause is present. Needed * because preprocess_expression will reduce a constant-true condition to * an empty qual list ... but "HAVING TRUE" is not a semantic no-op. @@ -898,6 +912,8 @@ inheritance_planner(PlannerInfo *root) ChangeVarNodes((Node *) subroot.parse, rti, newrti, 0); ChangeVarNodes((Node *) subroot.rowMarks, rti, newrti, 0); ChangeVarNodes((Node *) subroot.append_rel_list, rti, newrti, 0); + if (subroot.parse->sourceRelation == rti) + subroot.parse->sourceRelation = newrti; rte = copyObject(rte); subroot.parse->rtable = lappend(subroot.parse->rtable, rte); @@ -960,7 +976,10 @@ inheritance_planner(PlannerInfo *root) root->init_plans = subroot.init_plans; /* Build list of target-relation RT indexes */ - resultRelations = lappend_int(resultRelations, appinfo->child_relid); + resultRelations = lappend_int(resultRelations, + (appinfo->child_result > 0 ? + appinfo->child_result : + appinfo->child_relid)); /* Build lists of per-relation WCO and RETURNING targetlists */ if (parse->withCheckOptions) diff --git a/src/backend/optimizer/prep/preptlist.c b/src/backend/optimizer/prep/preptlist.c index ee773b8..5e4a010 100644 --- a/src/backend/optimizer/prep/preptlist.c +++ b/src/backend/optimizer/prep/preptlist.c @@ -37,8 +37,49 @@ static List *expand_targetlist(List *tlist, int command_type, - Index result_relation, List *range_table); + Index result_relation, Index source_relation, + List *range_table); +/* + * lookup_varattno + * + * This routine returns an attribute number to reference a particular + * attribute. In case when the target relation is really relation, + * we can reference arbitrary attribute (including system column) + * without any translations. However, we have to translate varattno + * of Var that references sub-queries being originated from regular + * relations with row-level security policy due to nature of sub-query + * that has no system-column. + */ +static AttrNumber +lookup_varattno(AttrNumber attno, Index rt_index, List *rtables) +{ + RangeTblEntry *rte = rt_fetch(rt_index, rtables); + + if (rte->rtekind == RTE_SUBQUERY && + rte->subquery->querySource == QSRC_ROW_SECURITY) + { + ListCell *cell; + + foreach (cell, rte->subquery->targetList) + { + TargetEntry *tle = lfirst(cell); + Var *var; + + if (IsA(tle->expr, Const)) + continue; + + var = (Var *) tle->expr; + Assert(IsA(var, Var)); + + if (var->varattno == attno) + return tle->resno; + } + elog(ERROR, "invalid attno %d on row-security subquery target-list", + attno); + } + return attno; +} /* * preprocess_targetlist @@ -51,6 +92,7 @@ preprocess_targetlist(PlannerInfo *root, List *tlist) { Query *parse = root->parse; int result_relation = parse->resultRelation; + int source_relation = parse->sourceRelation; List *range_table = parse->rtable; CmdType command_type = parse->commandType; ListCell *lc; @@ -73,8 +115,12 @@ preprocess_targetlist(PlannerInfo *root, List *tlist) * 10/94 */ if (command_type == CMD_INSERT || command_type == CMD_UPDATE) + { tlist = expand_targetlist(tlist, command_type, - result_relation, range_table); + result_relation, + source_relation, + range_table); + } /* * Add necessary junk columns for rowmarked rels. These values are needed @@ -96,7 +142,8 @@ preprocess_targetlist(PlannerInfo *root, List *tlist) { /* It's a regular table, so fetch its TID */ var = makeVar(rc->rti, - SelfItemPointerAttributeNumber, + lookup_varattno(SelfItemPointerAttributeNumber, + rc->rti, range_table), TIDOID, -1, InvalidOid, @@ -112,7 +159,8 @@ preprocess_targetlist(PlannerInfo *root, List *tlist) if (rc->isParent) { var = makeVar(rc->rti, - TableOidAttributeNumber, + lookup_varattno(TableOidAttributeNumber, + rc->rti, range_table), OIDOID, -1, InvalidOid, @@ -195,7 +243,8 @@ preprocess_targetlist(PlannerInfo *root, List *tlist) */ static List * expand_targetlist(List *tlist, int command_type, - Index result_relation, List *range_table) + Index result_relation, Index source_relation, + List *range_table) { List *new_tlist = NIL; ListCell *tlist_item; @@ -218,6 +267,9 @@ expand_targetlist(List *tlist, int command_type, numattrs = RelationGetNumberOfAttributes(rel); + if (source_relation == 0) + source_relation = result_relation; + for (attrno = 1; attrno <= numattrs; attrno++) { Form_pg_attribute att_tup = rel->rd_att->attrs[attrno - 1]; @@ -298,8 +350,10 @@ expand_targetlist(List *tlist, int command_type, case CMD_UPDATE: if (!att_tup->attisdropped) { - new_expr = (Node *) makeVar(result_relation, - attrno, + new_expr = (Node *) makeVar(source_relation, + lookup_varattno(attrno, + source_relation, + range_table), atttype, atttypmod, attcollation, diff --git a/src/backend/optimizer/prep/prepunion.c b/src/backend/optimizer/prep/prepunion.c index 52dcc72..9bd97e7 100644 --- a/src/backend/optimizer/prep/prepunion.c +++ b/src/backend/optimizer/prep/prepunion.c @@ -55,6 +55,7 @@ typedef struct { PlannerInfo *root; AppendRelInfo *appinfo; + bool in_returning; } adjust_appendrel_attrs_context; static Plan *recurse_set_operations(Node *setOp, PlannerInfo *root, @@ -1594,6 +1595,7 @@ adjust_appendrel_attrs(PlannerInfo *root, Node *node, AppendRelInfo *appinfo) context.root = root; context.appinfo = appinfo; + context.in_returning = false; /* * Must be prepared to start with a Query or a bare expression tree. @@ -1605,10 +1607,29 @@ adjust_appendrel_attrs(PlannerInfo *root, Node *node, AppendRelInfo *appinfo) newnode = query_tree_mutator((Query *) node, adjust_appendrel_attrs_mutator, (void *) &context, - QTW_IGNORE_RC_SUBQUERIES); + QTW_IGNORE_RC_SUBQUERIES | + QTW_IGNORE_RETURNING); + /* + * Returning clause on the relation being replaced with row- + * security subquery shall be handled in a special way, because + * of no system columns on subquery. + * Var references to system column or whole-row reference need + * to be adjusted to reference pseudo columns on behalf of + * the underlying these columns, however, RETURNGIN clause is + * an exception because its Var nodes are evaluated towards + * the "raw" target relation, not a fetched tuple. + */ + context.in_returning = true; + newnode->returningList = (List *) + expression_tree_mutator((Node *) newnode->returningList, + adjust_appendrel_attrs_mutator, + (void *) &context); if (newnode->resultRelation == appinfo->parent_relid) { - newnode->resultRelation = appinfo->child_relid; + newnode->resultRelation = (appinfo->child_result > 0 ? + appinfo->child_result : + appinfo->child_relid); + newnode->sourceRelation = appinfo->child_relid; /* Fix tlist resnos too, if it's inherited UPDATE */ if (newnode->commandType == CMD_UPDATE) newnode->targetList = @@ -1624,6 +1645,49 @@ adjust_appendrel_attrs(PlannerInfo *root, Node *node, AppendRelInfo *appinfo) } static Node * +fixup_var_on_rowsec_subquery(RangeTblEntry *rte, Var *var) +{ + ListCell *cell; + + Assert(rte->rtekind == RTE_SUBQUERY && + rte->subquery->querySource == QSRC_ROW_SECURITY); + /* + * In case when row-level security policy is applied on the referenced + * table, its RangeTblEntry (RTE_RELATION) is replaced with sub-query + * to filter out unprivileged rows of underlying relation. + * Even though reference to this sub-query should perform as if ones + * to real relations, system column has to be cared in special way + * due to the nature of sub-query. + * Target-entries that reference system columns should be added on + * rowlevelsec.c, so all we need to do here is looking up underlying + * target-list that can reference underlying system column, and fix- + * up varattno of the referencing Var node with resno of TargetEntry. + */ + foreach (cell, rte->subquery->targetList) + { + TargetEntry *subtle = lfirst(cell); + + if (IsA(subtle->expr, Var)) + { + Var *subvar = (Var *) subtle->expr; + Var *newnode; + + if (subvar->varattno == var->varattno) + { + newnode = copyObject(var); + newnode->varattno = subtle->resno; + return (Node *)newnode; + } + } + else + Assert(IsA(subtle->expr, Const)); + } + elog(ERROR, "could not find pseudo column of %d, relid %u", + var->varattno, var->varno); + return NULL; +} + +static Node * adjust_appendrel_attrs_mutator(Node *node, adjust_appendrel_attrs_context *context) { @@ -1638,8 +1702,12 @@ adjust_appendrel_attrs_mutator(Node *node, if (var->varlevelsup == 0 && var->varno == appinfo->parent_relid) { - var->varno = appinfo->child_relid; + var->varno = (context->in_returning && + appinfo->child_result > 0 ? + appinfo->child_result : + appinfo->child_relid); var->varnoold = appinfo->child_relid; + if (var->varattno > 0) { Node *newnode; @@ -1664,6 +1732,14 @@ adjust_appendrel_attrs_mutator(Node *node, */ if (OidIsValid(appinfo->child_reltype)) { + Query *parse = context->root->parse; + RangeTblEntry *rte = rt_fetch(appinfo->child_relid, + parse->rtable); + if (!context->in_returning && + rte->rtekind == RTE_SUBQUERY && + rte->subquery->querySource == QSRC_ROW_SECURITY) + var = (Var *)fixup_var_on_rowsec_subquery(rte, var); + Assert(var->vartype == appinfo->parent_reltype); if (appinfo->parent_reltype != appinfo->child_reltype) { @@ -1708,7 +1784,18 @@ adjust_appendrel_attrs_mutator(Node *node, return (Node *) rowexpr; } } - /* system attributes don't need any other translation */ + else + { + Query *parse = context->root->parse; + RangeTblEntry *rte; + + rte = rt_fetch(appinfo->child_relid, parse->rtable); + + if (!context->in_returning && + rte->rtekind == RTE_SUBQUERY && + rte->subquery->querySource == QSRC_ROW_SECURITY) + return fixup_var_on_rowsec_subquery(rte, var); + } } return (Node *) var; } diff --git a/src/backend/optimizer/util/Makefile b/src/backend/optimizer/util/Makefile index c54d0a6..d42a285 100644 --- a/src/backend/optimizer/util/Makefile +++ b/src/backend/optimizer/util/Makefile @@ -13,6 +13,7 @@ top_builddir = ../../../.. include $(top_builddir)/src/Makefile.global OBJS = clauses.o joininfo.o orclauses.o pathnode.o placeholder.o \ - plancat.o predtest.o relnode.o restrictinfo.o tlist.o var.o + plancat.o predtest.o relnode.o restrictinfo.o tlist.o var.o \ + rowsecurity.o include $(top_srcdir)/src/backend/common.mk diff --git a/src/backend/optimizer/util/rowsecurity.c b/src/backend/optimizer/util/rowsecurity.c new file mode 100644 index 0000000..c2e5a49 --- /dev/null +++ b/src/backend/optimizer/util/rowsecurity.c @@ -0,0 +1,744 @@ +/* + * optimizer/util/rowsecurity.c + * Routines to support row-security feature + * + * Portions Copyright (c) 1996-2012, PostgreSQL Global Development Group + * Portions Copyright (c) 1994, Regents of the University of California + */ +#include "postgres.h" + +#include "access/heapam.h" +#include "access/htup_details.h" +#include "access/sysattr.h" +#include "catalog/pg_class.h" +#include "catalog/pg_inherits_fn.h" +#include "catalog/pg_rowsecurity.h" +#include "catalog/pg_type.h" +#include "miscadmin.h" +#include "nodes/makefuncs.h" +#include "nodes/nodeFuncs.h" +#include "nodes/plannodes.h" +#include "optimizer/clauses.h" +#include "optimizer/prep.h" +#include "optimizer/rowsecurity.h" +#include "parser/parsetree.h" +#include "rewrite/rewriteHandler.h" +#include "utils/lsyscache.h" +#include "utils/rel.h" +#include "utils/syscache.h" +#include "tcop/utility.h" + +/* flags to pull row-security policy */ +#define RSEC_FLAG_HAS_SUBLINKS 0x0001 + +/* hook to allow extensions to apply their own security policy */ +row_security_policy_hook_type row_security_policy_hook = NULL; + +/* + * make_pseudo_column + * + * It makes a target-entry node that references underlying column. + * Its tle->expr is usualy Var node, but may be Const for dummy NULL + * if the supplied attribute was already dropped. + */ +static TargetEntry * +make_pseudo_column(RangeTblEntry *subrte, AttrNumber attnum) +{ + Expr *expr; + char *resname; + + Assert(subrte->rtekind == RTE_RELATION && OidIsValid(subrte->relid)); + if (attnum == InvalidAttrNumber) + { + expr = (Expr *) makeWholeRowVar(subrte, (Index) 1, 0, false); + resname = get_rel_name(subrte->relid); + } + else + { + HeapTuple tuple; + Form_pg_attribute attform; + + tuple = SearchSysCache2(ATTNUM, + ObjectIdGetDatum(subrte->relid), + Int16GetDatum(attnum)); + if (!HeapTupleIsValid(tuple)) + elog(ERROR, "cache lookup failed for attribute %d of relation %u", + attnum, subrte->relid); + attform = (Form_pg_attribute) GETSTRUCT(tuple); + + if (attform->attisdropped) + { + char namebuf[NAMEDATALEN]; + + /* Insert NULL just for a placeholder of dropped column */ + expr = (Expr *) makeConst(INT4OID, + -1, + InvalidOid, + sizeof(int32), + (Datum) 0, + true, /* isnull */ + true); /* byval */ + sprintf(namebuf, "dummy-%d", (int)attform->attnum); + resname = pstrdup(namebuf); + } + else + { + expr = (Expr *) makeVar((Index) 1, + attform->attnum, + attform->atttypid, + attform->atttypmod, + attform->attcollation, + 0); + resname = pstrdup(NameStr(attform->attname)); + } + ReleaseSysCache(tuple); + } + return makeTargetEntry(expr, -1, resname, false); +} + +/* + * lookup_pseudo_column + * + * It looks-up resource number of the target-entry relevant to the given + * Var-node that references the row-security subquery. If required column + * is not in the subquery's target-list, this function also adds new one + * and returns its resource number. + */ +static AttrNumber +lookup_pseudo_column(PlannerInfo *root, + RangeTblEntry *rte, AttrNumber varattno) +{ + Query *subqry; + RangeTblEntry *subrte; + TargetEntry *subtle; + ListCell *cell; + + Assert(rte->rtekind == RTE_SUBQUERY && + rte->subquery->querySource == QSRC_ROW_SECURITY); + + subqry = rte->subquery; + foreach (cell, subqry->targetList) + { + subtle = lfirst(cell); + + /* + * If referenced artifical column is already constructed on the + * target-list of row-security subquery, nothing to do any more. + */ + if (IsA(subtle->expr, Var)) + { + Var *subvar = (Var *)subtle->expr; + + Assert(subvar->varno == 1); + if (subvar->varattno == varattno) + return subtle->resno; + } + } + + /* + * OK, we don't have an artifical column relevant to the required ones, + * so let's create a new artifical column on demand. + */ + subrte = rt_fetch((Index) 1, subqry->rtable); + subtle = make_pseudo_column(subrte, varattno); + subtle->resno = list_length(subqry->targetList) + 1; + + subqry->targetList = lappend(subqry->targetList, subtle); + rte->eref->colnames = lappend(rte->eref->colnames, + makeString(pstrdup(subtle->resname))); + return subtle->resno; +} + +/* + * fixup_varnode_walker + * + * It recursively fixes up references to the relation to be replaced by + * row-security sub-query, and adds pseudo columns relevant to the + * underlying system columns or whole row-reference on demand. + */ +typedef struct { + PlannerInfo *root; + int varlevelsup; + Index *vartrans; +} fixup_varnode_context; + +static bool +fixup_varnode_walker(Node *node, fixup_varnode_context *context) +{ + if (node == NULL) + return false; + + if (IsA(node, Var)) + { + Var *var = (Var *) node; + List *rtable = context->root->parse->rtable; + RangeTblEntry *rte; + ListCell *cell; + + /* + * Ignore it, if Var node does not reference the Query currently + * we focus on. + */ + if (var->varlevelsup != context->varlevelsup) + return false; + + if (context->vartrans[var->varno] > 0) + { + Index rtindex_trans = context->vartrans[var->varno]; + + rte = rt_fetch(rtindex_trans, rtable); + Assert(rte->rtekind == RTE_SUBQUERY && + rte->subquery->querySource == QSRC_ROW_SECURITY); + + var->varno = var->varnoold = rtindex_trans; + var->varattno = lookup_pseudo_column(context->root, rte, + var->varattno); + } + else + { + rte = rt_fetch(var->varno, rtable); + if (rte->rtekind == RTE_RELATION && rte->inh) + { + foreach (cell, context->root->append_rel_list) + { + AppendRelInfo *appinfo = lfirst(cell); + RangeTblEntry *child_rte; + + if (appinfo->parent_relid != var->varno) + continue; + + child_rte = rt_fetch(appinfo->child_relid, rtable); + if (child_rte->rtekind == RTE_SUBQUERY && + child_rte->subquery->querySource == QSRC_ROW_SECURITY) + (void) lookup_pseudo_column(context->root, + child_rte, + var->varattno); + } + } + } + } + else if (IsA(node, RangeTblRef)) + { + RangeTblRef *rtr = (RangeTblRef *) node; + + if (context->varlevelsup == 0 && + context->vartrans[rtr->rtindex] != 0) + rtr->rtindex = context->vartrans[rtr->rtindex]; + } + else if (IsA(node, Query)) + { + bool result; + + context->varlevelsup++; + result = query_tree_walker((Query *) node, + fixup_varnode_walker, + (void *) context, 0); + context->varlevelsup--; + + return result; + } + return expression_tree_walker(node, + fixup_varnode_walker, + (void *) context); +} + +/* + * check_infinite_recursion + * + * It is a wrong row-security configuration, if we try to expand + * the relation inside of row-security subquery originated from + * same relation! + */ +static void +check_infinite_recursion(PlannerInfo *root, Oid relid) +{ + PlannerInfo *parent = root->parent_root; + + if (parent && parent->parse->querySource == QSRC_ROW_SECURITY) + { + RangeTblEntry *rte = rt_fetch(1, parent->parse->rtable); + + Assert(rte->rtekind == RTE_RELATION && OidIsValid(rte->relid)); + + if (relid == rte->relid) + ereport(ERROR, + (errcode(ERRCODE_INVALID_OBJECT_DEFINITION), + errmsg("infinite recursion detected for relation \"%s\"", + get_rel_name(relid)))); + check_infinite_recursion(parent, relid); + } +} + +/* + * expand_rtentry_with_policy + * + * It extends a range-table entry of row-security sub-query with supplied + * security policy, and append it on the parse->rtable. + * This sub-query contains pseudo columns that reference underlying + * regular columns (at least, references to system column or whole of + * table reference shall be added on demand), and simple scan on the + * target relation. + * Any Var nodes that referenced the relation pointed by rtindex shall + * be adjusted to reference this sub-query instead. walker + */ +static Index +expand_rtentry_with_policy(PlannerInfo *root, Index rtindex, + Expr *qual, int flags) +{ + Query *parse = root->parse; + RangeTblEntry *rte = rt_fetch(rtindex, parse->rtable); + Query *subqry; + RangeTblEntry *subrte; + RangeTblRef *subrtr; + TargetEntry *subtle; + RangeTblEntry *newrte; + HeapTuple tuple; + AttrNumber nattrs; + AttrNumber attnum; + List *targetList = NIL; + List *colNameList = NIL; + PlanRowMark *rowmark; + + Assert(rte->rtekind == RTE_RELATION && !rte->inh); + + /* check recursion to prevent infinite loop */ + check_infinite_recursion(root, rte->relid); + + /* Expand views inside SubLink node */ + if (flags & RSEC_FLAG_HAS_SUBLINKS) + QueryRewriteExpr((Node *)qual, list_make1_oid(rte->relid)); + + /* + * Construction of sub-query + */ + subqry = (Query *) makeNode(Query); + subqry->commandType = CMD_SELECT; + subqry->querySource = QSRC_ROW_SECURITY; + + subrte = copyObject(rte); + subqry->rtable = list_make1(subrte); + + subrtr = makeNode(RangeTblRef); + subrtr->rtindex = 1; + subqry->jointree = makeFromExpr(list_make1(subrtr), (Node *) qual); + if (flags & RSEC_FLAG_HAS_SUBLINKS) + subqry->hasSubLinks = true; + + /* + * Construction of TargetEntries that reference underlying columns. + */ + tuple = SearchSysCache1(RELOID, ObjectIdGetDatum(rte->relid)); + if (!HeapTupleIsValid(tuple)) + elog(ERROR, "cache lookup failed for relation %u", rte->relid); + nattrs = ((Form_pg_class) GETSTRUCT(tuple))->relnatts; + ReleaseSysCache(tuple); + + for (attnum = 1; attnum <= nattrs; attnum++) + { + subtle = make_pseudo_column(subrte, attnum); + subtle->resno = list_length(targetList) + 1; + Assert(subtle->resno == attnum); + + targetList = lappend(targetList, subtle); + colNameList = lappend(colNameList, + makeString(pstrdup(subtle->resname))); + } + subqry->targetList = targetList; + + /* Expand RengeTblEntry with this sub-query */ + newrte = makeNode(RangeTblEntry); + newrte->rtekind = RTE_SUBQUERY; + newrte->subquery = subqry; + newrte->security_barrier = true; + newrte->rowsec_relid = rte->relid; + newrte->eref = makeAlias(get_rel_name(rte->relid), colNameList); + + parse->rtable = lappend(parse->rtable, newrte); + + /* + * Fix up PlanRowMark if needed, then add references to 'tableoid' and + * 'ctid' that shall be added to handle row-level locking. + * Also see preprocess_targetlist() that adds some junk attributes. + */ + rowmark = get_plan_rowmark(root->rowMarks, rtindex); + if (rowmark) + { + if (rowmark->rti == rowmark->prti) + rowmark->rti = rowmark->prti = list_length(parse->rtable); + else + rowmark->rti = list_length(parse->rtable); + + lookup_pseudo_column(root, newrte, SelfItemPointerAttributeNumber); + lookup_pseudo_column(root, newrte, TableOidAttributeNumber); + } + return list_length(parse->rtable); +} + +/* + * pull_row_security_policy + * + * It pulls the configured row-security policy of both built-in and + * extensions. If any, it returns expression tree. + */ +static Expr * +pull_row_security_policy(CmdType cmd, Relation relation, int *p_flags) +{ + Expr *quals = NULL; + int flags = 0; + + /* + * Pull the row-security policy configured with built-in features, + * if unprivileged users. Please note that superuser can bypass it. + */ + if (relation->rsdesc && !superuser()) + { + RowSecurityDesc *rsdesc = relation->rsdesc; + + quals = copyObject(rsdesc->rsall.qual); + if (rsdesc->rsall.hassublinks) + flags |= RSEC_FLAG_HAS_SUBLINKS; + } + + /* + * Also, ask extensions whether they want to apply their own + * row-security policy. If both built-in and extension has + * their own policy, it shall be merged. + */ + if (row_security_policy_hook) + { + List *temp; + + temp = (*row_security_policy_hook)(cmd, relation); + if (temp != NIL) + { + if ((flags & RSEC_FLAG_HAS_SUBLINKS) == 0 && + contain_subplans((Node *) temp)) + flags |= RSEC_FLAG_HAS_SUBLINKS; + + if (quals != NULL) + temp = lappend(temp, quals); + + if (list_length(temp) == 1) + quals = (Expr *)list_head(temp); + else if (list_length(temp) > 1) + quals = makeBoolExpr(AND_EXPR, temp, -1); + } + } + *p_flags = flags; + return quals; +} + +/* + * copy_row_security_policy + * + * It construct a row-security subquery instead of raw COPY TO statement, + * if target relation has a row-level security policy + */ +bool +copy_row_security_policy(CopyStmt *stmt, Relation rel, List *attnums) +{ + Expr *quals; + int flags; + Query *parse; + RangeTblEntry *rte; + RangeTblRef *rtr; + TargetEntry *tle; + Var *var; + ListCell *cell; + + if (stmt->is_from) + return false; + + quals = pull_row_security_policy(CMD_SELECT, rel, &flags); + if (!quals) + return false; + + parse = (Query *) makeNode(Query); + parse->commandType = CMD_SELECT; + parse->querySource = QSRC_ROW_SECURITY; + + rte = makeNode(RangeTblEntry); + rte->rtekind = RTE_RELATION; + rte->relid = RelationGetRelid(rel); + rte->relkind = RelationGetForm(rel)->relkind; + + foreach (cell, attnums) + { + HeapTuple tuple; + Form_pg_attribute attform; + AttrNumber attno = lfirst_int(cell); + + tuple = SearchSysCache2(ATTNUM, + ObjectIdGetDatum(RelationGetRelid(rel)), + Int16GetDatum(attno)); + if (!HeapTupleIsValid(tuple)) + elog(ERROR, "cache lookup failed for attribute %d of relation %s", + attno, RelationGetRelationName(rel)); + attform = (Form_pg_attribute) GETSTRUCT(tuple); + + var = makeVar((Index) 1, + attform->attnum, + attform->atttypid, + attform->atttypmod, + attform->attcollation, + 0); + tle = makeTargetEntry((Expr *) var, + list_length(parse->targetList) + 1, + pstrdup(NameStr(attform->attname)), + false); + parse->targetList = lappend(parse->targetList, tle); + + ReleaseSysCache(tuple); + + rte->selectedCols = bms_add_member(rte->selectedCols, + attno - FirstLowInvalidHeapAttributeNumber); + } + rte->inFromCl = true; + rte->requiredPerms = ACL_SELECT; + + rtr = makeNode(RangeTblRef); + rtr->rtindex = 1; + + parse->jointree = makeFromExpr(list_make1(rtr), (Node *) quals); + parse->rtable = list_make1(rte); + if (flags & RSEC_FLAG_HAS_SUBLINKS) + parse->hasSubLinks = true; + + stmt->query = (Node *) parse; + + return true; +} + +/* + * apply_row_security_relation + * + * It applies row-security policy on a particular relation being specified. + * If this relation is top of the inheritance tree, it also checks inherited + * children. + */ +static bool +apply_row_security_relation(PlannerInfo *root, Index *vartrans, + CmdType cmd, Index rtindex) +{ + Query *parse = root->parse; + RangeTblEntry *rte = rt_fetch(rtindex, parse->rtable); + Relation rel; + Expr *qual; + int flags; + bool result = false; + + if (!rte->inh) + { + rel = heap_open(rte->relid, NoLock); + qual = pull_row_security_policy(cmd, rel, &flags); + if (qual) + { + vartrans[rtindex] + = expand_rtentry_with_policy(root, rtindex, qual, flags); + if (parse->resultRelation == rtindex) + parse->sourceRelation = vartrans[rtindex]; + result = true; + } + heap_close(rel, NoLock); + } + else + { + /* + * In case when relation has inherited children, we try to apply + * row-level security policy of them if configured. + * In addition to regular replacement with a sub-query, we need + * to adjust rtindex of AppendRelInfo and varno of translated_vars. + * It makes sub-queries perform like regular relations being + * inherited from a particular parent relation. So, a table scan + * may have underlying a relation scan and two sub-query scans for + * instance. If it is result relation of UPDATE or DELETE command, + * rtindex to the original relation (regular relation) has to be + * kept because sub-query cannot perform as an updatable relation. + * So, we save it on child_result of AppendRelInfo; that shall be + * used to track relations to be modified at inheritance_planner(). + */ + ListCell *lc1, *lc2; + + foreach (lc1, root->append_rel_list) + { + AppendRelInfo *apinfo = lfirst(lc1); + + if (apinfo->parent_relid != rtindex) + continue; + + if (apply_row_security_relation(root, vartrans, cmd, + apinfo->child_relid)) + { + /* + * Save the rtindex of actual relation to be modified, + * if parent relation is result relation of this query. + */ + if (parse->resultRelation == rtindex) + apinfo->child_result = apinfo->child_relid; + + apinfo->child_relid = vartrans[apinfo->child_relid]; + /* Adjust varno to reference pseudo columns */ + foreach (lc2, apinfo->translated_vars) + { + Var *var = lfirst(lc2); + + if (var) + var->varno = apinfo->child_relid; + } + result = true; + } + } + } + return result; +} + +/* + * apply_row_security_recursive + * + * It walks on the given join-tree to replace relations with row-level + * security policy by a simple sub-query. + */ +static bool +apply_row_security_recursive(PlannerInfo *root, Index *vartrans, Node *jtnode) +{ + bool result = false; + + if (jtnode == NULL) + return false; + if (IsA(jtnode, RangeTblRef)) + { + Index rtindex = ((RangeTblRef *) jtnode)->rtindex; + Query *parse = root->parse; + RangeTblEntry *rte = rt_fetch(rtindex, parse->rtable); + CmdType cmd; + + /* Only relation can have row-security policy */ + if (rte->rtekind != RTE_RELATION) + return false; + + /* + * Prevents infinite recursion. Please note that rtindex == 1 + * of the row-security subquery is a relation being already + * processed on the upper level. + */ + if (parse->querySource == QSRC_ROW_SECURITY && rtindex == 1) + return false; + + /* Is it a result relation of UPDATE or DELETE command? */ + if (parse->resultRelation == rtindex) + cmd = parse->commandType; + else + cmd = CMD_SELECT; + + /* Try to apply row-security policy, if configured */ + result = apply_row_security_relation(root, vartrans, cmd, rtindex); + } + else if (IsA(jtnode, FromExpr)) + { + FromExpr *f = (FromExpr *) jtnode; + ListCell *l; + + foreach (l, f->fromlist) + { + if (apply_row_security_recursive(root, vartrans, lfirst(l))) + result = true; + } + } + else if (IsA(jtnode, JoinExpr)) + { + JoinExpr *j = (JoinExpr *) jtnode; + + if (apply_row_security_recursive(root, vartrans, j->larg)) + result = true; + if (apply_row_security_recursive(root, vartrans, j->rarg)) + result = true; + } + else + elog(ERROR, "unexpected node type: %d", (int) nodeTag(jtnode)); + + return result; +} + +/* + * apply_row_security_policy + * + * Entrypoint to apply configured row-security policy of the relation. + * + * In case when the supplied query references relations with row-security + * policy, its RangeTblEntry shall be replaced by a row-security subquery + * that has simple scan on the referenced table with policy qualifiers. + * Of course, security-barrier shall be set on the subquery to prevent + * unexpected push-down of functions without leakproof flag. + * + * For example, when table t1 has a security policy "(x % 2 = 0)", the + * following query: + * SELECT * FROM t1 WHERE f_leak(y) + * performs as if + * SELECT * FROM ( + * SELECT x, y FROM t1 WHERE (x % 2 = 0) + * ) AS t1 WHERE f_leak(y) + * would be given. Because the sub-query has security barrier flag, + * configured security policy qualifier is always executed prior to + * user given functions. + */ +void +apply_row_security_policy(PlannerInfo *root) +{ + Query *parse = root->parse; + Oid curr_userid; + int curr_seccxt; + Index *vartrans; + + /* + * Mode checks. In case when SECURITY_ROW_LEVEL_DISABLED is set, + * no row-level security policy should be applied regardless + * whether it is built-in or extension. + */ + GetUserIdAndSecContext(&curr_userid, &curr_seccxt); + if (curr_seccxt & SECURITY_ROW_LEVEL_DISABLED) + return; + + vartrans = palloc0(sizeof(Index) * (list_length(parse->rtable) + 1)); + if (apply_row_security_recursive(root, vartrans, (Node *)parse->jointree)) + { + PlannerGlobal *glob = root->glob; + PlanInvalItem *pi_item; + fixup_varnode_context context; + + /* + * Constructed Plan with row-level security policy depends on + * properties of current user (database superuser can bypass + * configured row-security policy!), thus, it has to be + * invalidated when its assumption was changed. + */ + if (!OidIsValid(glob->planUserId)) + { + /* Plan invalidation on session user-id */ + glob->planUserId = GetUserId(); + + /* Plan invalidation on catalog updates of pg_authid */ + pi_item = makeNode(PlanInvalItem); + pi_item->cacheId = AUTHOID; + pi_item->hashValue = + GetSysCacheHashValue1(AUTHOID, + ObjectIdGetDatum(glob->planUserId)); + glob->invalItems = lappend(glob->invalItems, pi_item); + } + else + Assert(glob->planUserId == GetUserId()); + + /* + * Var-nodes that referenced RangeTblEntry to be replaced by + * row-security sub-query have to be adjusted for appropriate + * reference to the underlying pseudo column of the relation. + */ + context.root = root; + context.varlevelsup = 0; + context.vartrans = vartrans; + query_tree_walker(parse, + fixup_varnode_walker, + (void *) &context, + QTW_IGNORE_RETURNING); + } + pfree(vartrans); +} diff --git a/src/backend/rewrite/rewriteHandler.c b/src/backend/rewrite/rewriteHandler.c index 0b13645..2f56211 100644 --- a/src/backend/rewrite/rewriteHandler.c +++ b/src/backend/rewrite/rewriteHandler.c @@ -3282,3 +3282,19 @@ QueryRewrite(Query *parsetree) return results; } + +/* + * QueryRewriteExpr + * + * This routine provides an entry point of query rewriter towards + * a certain expression tree with SubLink node; being added after + * the top level query rewrite. + * It primarily intends to expand views appeared in the qualifiers + * appended with row-level security which needs to modify query + * tree at head of the planner stage. + */ +void +QueryRewriteExpr(Node *node, List *activeRIRs) +{ + fireRIRonSubLink(node, activeRIRs); +} diff --git a/src/backend/utils/adt/ri_triggers.c b/src/backend/utils/adt/ri_triggers.c index 1e1e616..68be040 100644 --- a/src/backend/utils/adt/ri_triggers.c +++ b/src/backend/utils/adt/ri_triggers.c @@ -3008,6 +3008,7 @@ ri_PerformCheck(const RI_ConstraintInfo *riinfo, int spi_result; Oid save_userid; int save_sec_context; + int temp_sec_context; Datum vals[RI_MAX_NUMKEYS * 2]; char nulls[RI_MAX_NUMKEYS * 2]; @@ -3087,8 +3088,18 @@ ri_PerformCheck(const RI_ConstraintInfo *riinfo, /* Switch to proper UID to perform check as */ GetUserIdAndSecContext(&save_userid, &save_sec_context); + + /* + * Row-level security should be disabled in case when foreign-key + * relation is queried to check existence of tuples that references + * the primary-key being modified. + */ + temp_sec_context = save_sec_context | SECURITY_LOCAL_USERID_CHANGE; + if (source_is_pk) + temp_sec_context |= SECURITY_ROW_LEVEL_DISABLED; + SetUserIdAndSecContext(RelationGetForm(query_rel)->relowner, - save_sec_context | SECURITY_LOCAL_USERID_CHANGE); + temp_sec_context); /* Finally we can run the query. */ spi_result = SPI_execute_snapshot(qplan, diff --git a/src/include/miscadmin.h b/src/include/miscadmin.h index f133e5f..1c97bd9 100644 --- a/src/include/miscadmin.h +++ b/src/include/miscadmin.h @@ -272,6 +272,7 @@ extern int trace_recovery(int trace_level); /* flags to be OR'd to form sec_context */ #define SECURITY_LOCAL_USERID_CHANGE 0x0001 #define SECURITY_RESTRICTED_OPERATION 0x0002 +#define SECURITY_ROW_LEVEL_DISABLED 0x0004 extern char *DatabasePath; diff --git a/src/include/nodes/nodeFuncs.h b/src/include/nodes/nodeFuncs.h index f9afdb6..9ed3796 100644 --- a/src/include/nodes/nodeFuncs.h +++ b/src/include/nodes/nodeFuncs.h @@ -24,6 +24,7 @@ #define QTW_IGNORE_RANGE_TABLE 0x08 /* skip rangetable entirely */ #define QTW_EXAMINE_RTES 0x10 /* examine RTEs */ #define QTW_DONT_COPY_QUERY 0x20 /* do not copy top Query */ +#define QTW_IGNORE_RETURNING 0x40 /* skip returning clause */ extern Oid exprType(const Node *expr); diff --git a/src/include/nodes/parsenodes.h b/src/include/nodes/parsenodes.h index 3a918bb..c8ce32a 100644 --- a/src/include/nodes/parsenodes.h +++ b/src/include/nodes/parsenodes.h @@ -113,7 +113,9 @@ typedef struct Query int resultRelation; /* rtable index of target relation for * INSERT/UPDATE/DELETE; 0 for SELECT */ - + int sourceRelation; /* rtable index of source relation for + * UPDATE/DELETE, if not identical with + * resultRelation; 0 for elsewhere */ bool hasAggs; /* has aggregates in tlist or havingQual */ bool hasWindowFuncs; /* has window functions in tlist */ bool hasSubLinks; /* has subquery SubLink */ diff --git a/src/include/nodes/relation.h b/src/include/nodes/relation.h index 74d0e12..252e45f 100644 --- a/src/include/nodes/relation.h +++ b/src/include/nodes/relation.h @@ -1438,6 +1438,10 @@ typedef struct AppendRelInfo */ Index parent_relid; /* RT index of append parent rel */ Index child_relid; /* RT index of append child rel */ + Index child_result; /* RT index of append child rel's source, + * if source of result relation is not + * identical. Elsewhere, 0. + */ /* * For an inheritance appendrel, the parent and child are both regular diff --git a/src/include/optimizer/rowsecurity.h b/src/include/optimizer/rowsecurity.h new file mode 100644 index 0000000..ff4dd9a --- /dev/null +++ b/src/include/optimizer/rowsecurity.h @@ -0,0 +1,27 @@ +/* ------------------------------------------------------------------------- + * + * rowsecurity.h + * prototypes for optimizer/rowsecurity.c + * + * Portions Copyright (c) 1996-2012, PostgreSQL Global Development Group + * Portions Copyright (c) 1994, Regents of the University of California + * + * ------------------------------------------------------------------------- + */ +#ifndef ROWSECURITY_H +#define ROWSECURITY_H + +#include "nodes/execnodes.h" +#include "nodes/parsenodes.h" +#include "nodes/relation.h" +#include "utils/rel.h" + +typedef List *(*row_security_policy_hook_type)(CmdType cmdtype, + Relation relation); +extern PGDLLIMPORT row_security_policy_hook_type row_security_policy_hook; + +extern bool copy_row_security_policy(CopyStmt *stmt, + Relation relation, List *attnums); +extern void apply_row_security_policy(PlannerInfo *root); + +#endif /* ROWSECURITY_H */ diff --git a/src/include/rewrite/rewriteHandler.h b/src/include/rewrite/rewriteHandler.h index e4027bd..7bd334c 100644 --- a/src/include/rewrite/rewriteHandler.h +++ b/src/include/rewrite/rewriteHandler.h @@ -18,6 +18,7 @@ #include "nodes/parsenodes.h" extern List *QueryRewrite(Query *parsetree); +extern void QueryRewriteExpr(Node *node, List *activeRIRs); extern void AcquireRewriteLocks(Query *parsetree, bool forUpdatePushedDown); extern Node *build_column_default(Relation rel, int attrno); -- 1.8.3.1