Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1nZPVp-0001xv-8c for pgsql-hackers@arkaria.postgresql.org; Wed, 30 Mar 2022 04:00:50 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1nZPVo-0005sZ-63 for pgsql-hackers@arkaria.postgresql.org; Wed, 30 Mar 2022 04:00:48 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1nZPVn-0005sQ-B6 for pgsql-hackers@lists.postgresql.org; Wed, 30 Mar 2022 04:00:47 +0000 Received: from mail-pg1-x52a.google.com ([2607:f8b0:4864:20::52a]) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1nZPVi-0005ZK-C0 for pgsql-hackers@postgresql.org; Wed, 30 Mar 2022 04:00:46 +0000 Received: by mail-pg1-x52a.google.com with SMTP id c2so16522515pga.10 for ; Tue, 29 Mar 2022 21:00:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb.com; s=google; h=from:message-id:mime-version:subject:date:in-reply-to:cc:to :references; bh=snxcI37KDFLcXMhblJdnaiiWOCVnrsbCRAcPtnlU/p8=; b=h7WnCdkNltDbGxg3m4ITgD+9pf51JSiC3BmshVG0V4hwBSs9m/vX8Oj6FS2gZ+4FjJ elWsmMS7lsP7TM3R3hpKpGh/LvSuXqy+vkQx3jJ60UZVWMzsxDd1iOg5I1HbKC1BauIQ UUlFG3YFisBIw6R0awDEKwebzLouzWl7fXcFXvFZ+HSJY2BwEZvpF3NqaOhg5rHgzNEG o/WGwL5vbQX2M4ObY00FbaCdPaI8IjJYxrp/v205JfwPBZ3kgEPGntqUU8y3WNLIgEfw /aJRZLw4mcH6x3QGCROI6M1TY9NcCj2SdfZGXk3cSWgBi67vKbV1QyVMX3gLKXfc+R/l 3HGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:message-id:mime-version:subject:date :in-reply-to:cc:to:references; bh=snxcI37KDFLcXMhblJdnaiiWOCVnrsbCRAcPtnlU/p8=; b=5p01I2kJb/l+XOcqfLlTGLaUyZTRMSDKtJsc0FQxowMrUqQIxf1fFuvV1+qn8esWbm e15+hyUTL9IemtI8YZbxoMe+jsTlh69e0HZf3h626Si7fcXI2Hg8cNPBXUwSZ0CznSOd inkmM3P7fU+k8Gd8UBvSAT1YLpyVZJO4cZC0bIMUZSoU8wxYnLecECyoNilnLZNiVLVI At3OFMCXEsDf/rzXF+EhJjilYJIBzIizQdo5LA+zHTbG1eoRKZkU5eCxoDp4JObatUd/ bFMNEMo6HuIjAvhwWDVrayzFF+gYH6axK0HnSdQ/yflWDFJflx/mz5NmEyWmUiUCN77j YWPA== X-Gm-Message-State: AOAM532QgSdULyiklqEscYWwT05hy00UZSoifVDsZYOY3zcfCxje0Dmr SeC1aCQ4U/ejMxLu7/B8NXOvZcUXp1Bd5UkPP/0hk6J5auMAGtBCpdC3c7YQT0is+3GFp8wi1mk hGkFilS3H3nuE/UXCjPthe8vD4fMlnNDkT/LwJEUysv5ICKXmstmLVGDDqTGDlSsUKpxX7sdCND 1BtSADVCFEE3tPMnke+teVyld8k8D+b7iWhIUO4E/fY+7A X-Google-Smtp-Source: ABdhPJzIBaHpIpfG6VwkSiR5L/HMVirsGWrIYjZVZM5XzXk+yupGxVLsaPklO26icuZgsc9uoDkCJw== X-Received: by 2002:a63:7c19:0:b0:398:a5ca:2cf with SMTP id x25-20020a637c19000000b00398a5ca02cfmr1364507pgc.408.1648612839171; Tue, 29 Mar 2022 21:00:39 -0700 (PDT) Received: from laptop280-ma-us.hitronhub.home (24-113-193-150.wavecable.com. [24.113.193.150]) by smtp.gmail.com with ESMTPSA id l2-20020a637c42000000b003644cfa0dd1sm16931162pgn.79.2022.03.29.21.00.36 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 29 Mar 2022 21:00:38 -0700 (PDT) From: Mark Dilger Message-Id: Content-Type: multipart/mixed; boundary="Apple-Mail=_1F5504FD-28BA-45DF-9BE4-262FCF180738" Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\)) Subject: Re: Granting SET and ALTER SYSTE privileges for GUCs Date: Tue, 29 Mar 2022 21:00:36 -0700 In-Reply-To: <1034902.1648506662@sss.pgh.pa.us> Cc: Andrew Dunstan , Peter Eisentraut , Robert Haas , Jeff Davis , PostgreSQL-development , Joe Conway To: Tom Lane , Joshua Brindle References: <3D691E20-C1D5-4B80-8BA5-6BEB63AF3029@enterprisedb.com> <2D6C1081-DB7D-4260-8987-5B4912E95917@enterprisedb.com> <1A6DA47B-2D5F-427E-AD72-1D8BD23BF94C@enterprisedb.com> <79685.1646604824@sss.pgh.pa.us> <83814.1646607430@sss.pgh.pa.us> <78889A65-CA7A-4015-866D-33460967071D@enterprisedb.com> <92485.1646609263@sss.pgh.pa.us> <43857434-3f9b-3! 66f-0401-7aea558827e1@dunslane.net> <664799.1647456444@sss.pgh.pa.us> <771410.1647528423@sss.pgh.pa.us> <9b37fa41-a068-81! ! ! ! 66-78c3-4503a867de07@dunslane.net> <895087.1648494675@sss.pgh.pa.us> <18A291A8-362E-4AB1-833D-66410751E401@enterprisedb.com> <1011909.1648502174@sss.pgh.pa.us> <2AED7293-AB99-47CF-B3CA-C090108A8250@enterprisedb.com> <1031399.1648504468@sss.pgh.pa.us> <1034902.1648506662@sss.pgh.pa.us> X-Mailer: Apple Mail (2.3608.120.23.2.7) X-CLOUD-SEC-AV-Info: enterprisedb,google_mail,monitor X-CLOUD-SEC-AV-Sent: true X-Gm-Spam: 0 X-Gm-Phishy: 0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk --Apple-Mail=_1F5504FD-28BA-45DF-9BE4-262FCF180738 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=us-ascii > On Mar 28, 2022, at 3:31 PM, Tom Lane wrote: >=20 > This is what I meant by saying that you can't just refuse to GRANT on > unknown GUCs. It makes custom GUCs into a time bomb for dump/restore. > And that means you need a strategy for dealing with the possibility > that you don't know whether the GUC is USERSET or not. I think though > that it might work to just assume that it isn't, in which case dumps > on unrecognized GUCs that really are USERSET will end up issuing an > explicit GRANT SET TO PUBLIC that we didn't actually need to do, but = it > won't hurt anything. (Testing that assertion would be a good thing > to do.) Ok, I returned to the idea upthread for a solution to this problem. A = grant or revoke on an unrecognized custom parameter will create a SUSET = placeholder, which is not quite right in some cases. However, the = installation scripts for modules have been updated to manually grant SET = privilege on their custom USERSET parameters, which cleans up the = problem, with one exception: if the user executes a "revoke set on = parameter some.such from public" prior to loading the module which = defines parameter some.such, that revoke won't be retained. That = doesn't seem entirely wrong to me, since no privilege to set the = parameter existed when the revoke was performed, but rather was granted = along with the creation of the parameter, but it also doesn't seem = entirely right. Maybe revoke commands (but not grant commands) should = error on unrecognized custom parameters? I didn't implement that here, = but can do so if you think that makes more sense than this new behavior. =20 I changed add_placeholder_variable() to take a GucContext argument. It = previously always used PGC_USERSET, which is what all pre-existing call = sites now pass into it, but that seems a bit inappropriate where we're = creating a placeholder that we intend to treat as a SUSET variable until = such time as a module gets installed saying otherwise. Not changing = add_placeholder_variable in this fashion seems to work just fine. I = just didn't feel comfortable with doing it that way. But if you feel it = generates needless code churn, I could be talked out of doing this. I also changed the patch to use the ...HookStr functions for parameters. = I would really like a comment on this from Joshua, to be sure what I'm = doing comports with what he wanted. In particular, I'm uncertain that = simply passing the AclMode (in other words, the istmt->privileges field) = for the grant/revoke to the hook is sufficient. For one, how does the = hook want to distinguish grants from revokes? Do we want a bit for = that? And what about distinguishing WITH GRANT OPTION? I think the = hooks are usable right now, but they might be made better. --Apple-Mail=_1F5504FD-28BA-45DF-9BE4-262FCF180738 Content-Disposition: attachment; filename=v14-0001-Allow-grant-and-revoke-of-privileges-on-paramete.patch Content-Type: application/octet-stream; x-unix-mode=0644; name="v14-0001-Allow-grant-and-revoke-of-privileges-on-paramete.patch" Content-Transfer-Encoding: quoted-printable =46rom=20cb760575df80e31a91eadbab9055ce82d8aa5716=20Mon=20Sep=2017=20= 00:00:00=202001=0AFrom:=20Mark=20Dilger=20=0A= Date:=20Mon,=2028=20Mar=202022=2013:35:11=20-0700=0ASubject:=20[PATCH=20= v14]=20Allow=20grant=20and=20revoke=20of=20privileges=20on=20parameters=0A= =0AAdd=20new=20SET=20and=20ALTER=20SYSTEM=20privileges=20for=20= configuration=20parameters=0A(GUCs).=20=20Add=20new=20catalog=20= pg_parameter_acl=20for=20tracking=20grants=20on=0Aparameters,=20with=20= default=20behavior=20treating=20parameters=20without=0Aentries=20= according=20to=20their=20context=20(userset,=20suset,=20etc.),=20such=20= that=0Athe=20privilege=20to=20set=20or=20reset=20a=20userset=20parameter=20= is=20implicitly=0Agranted=20to=20public,=20but=20may=20be=20revoked.=0A= ---=0A=20contrib/pg_trgm/pg_trgm--1.3.sql=20=20=20=20=20=20=20=20=20=20=20= =20=20=20|=20=20=204=20+=0A=20contrib/postgres_fdw/postgres_fdw--1.0.sql=20= =20=20=20|=20=20=202=20+=0A=20contrib/sepgsql/sepgsql.sql.in=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20|=20=20=201=20+=0A=20= doc/src/sgml/catalogs.sgml=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20|=20=2075=20+++-=0A=20doc/src/sgml/ddl.sgml=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20|=20=2056=20++-=0A= =20doc/src/sgml/func.sgml=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20|=20=2020=20+-=0A=20doc/src/sgml/ref/grant.sgml=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20|=20=20=207=20+=0A=20= doc/src/sgml/ref/revoke.sgml=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20|=20=20=207=20+=0A=20doc/src/sgml/ref/set.sgml=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20|=20=20=208=20+-=0A=20= src/backend/catalog/Makefile=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20|=20=20=203=20+-=0A=20src/backend/catalog/aclchk.c=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20|=20280=20+++++++++++++=0A=20= src/backend/catalog/catalog.c=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20|=20=20=206=20+=0A=20src/backend/catalog/dependency.c=20=20=20=20=20= =20=20=20=20=20=20=20=20=20|=20=20=206=20+=0A=20= src/backend/catalog/objectaddress.c=20=20=20=20=20=20=20=20=20=20=20|=20=20= 46=20+++=0A=20src/backend/catalog/pg_parameter_acl.c=20=20=20=20=20=20=20= =20|=20109=20+++++=0A=20src/backend/catalog/system_views.sql=20=20=20=20=20= =20=20=20=20=20|=20=2013=20+=0A=20src/backend/commands/alter.c=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20|=20=20=201=20+=0A=20= src/backend/commands/event_trigger.c=20=20=20=20=20=20=20=20=20=20|=20=20= =206=20+=0A=20src/backend/commands/seclabel.c=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20|=20=20=201=20+=0A=20src/backend/commands/tablecmds.c=20=20= =20=20=20=20=20=20=20=20=20=20=20=20|=20=20=201=20+=0A=20= src/backend/parser/gram.y=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20|=20=2080=20+++-=0A=20src/backend/utils/adt/acl.c=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20|=20307=20++++++++++++++=0A= =20src/backend/utils/cache/lsyscache.c=20=20=20=20=20=20=20=20=20=20=20|=20= =2020=20+=0A=20src/backend/utils/cache/syscache.c=20=20=20=20=20=20=20=20= =20=20=20=20|=20=2023=20++=0A=20src/backend/utils/misc/guc-file.l=20=20=20= =20=20=20=20=20=20=20=20=20=20|=20=20=202=20+-=0A=20= src/backend/utils/misc/guc.c=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20|=20292=20+++++++++++---=0A=20src/bin/pg_dump/dumputils.c=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20|=20=20=207=20+-=0A=20= src/bin/pg_dump/pg_backup_archiver.c=20=20=20=20=20=20=20=20=20=20|=20=20= =202=20+=0A=20src/bin/pg_dump/pg_dump.c=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20|=20=20=205=20+-=0A=20= src/bin/pg_dump/pg_dumpall.c=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20|=20=2061=20+++=0A=20src/bin/psql/tab-complete.c=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20|=20178=20++++++++-=0A=20= src/include/catalog/dependency.h=20=20=20=20=20=20=20=20=20=20=20=20=20=20= |=20=20=201=20+=0A=20src/include/catalog/objectaccess.h=20=20=20=20=20=20= =20=20=20=20=20=20|=20=20=202=20+-=0A=20= src/include/catalog/pg_default_acl.h=20=20=20=20=20=20=20=20=20=20|=20=20= =201=20+=0A=20src/include/catalog/pg_parameter_acl.h=20=20=20=20=20=20=20= =20|=20=2063=20+++=0A=20src/include/catalog/pg_proc.dat=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20|=20=2023=20++=0A=20= src/include/nodes/parsenodes.h=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20|=20=20=203=20+-=0A=20src/include/parser/kwlist.h=20=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20|=20=20=201=20+=0A=20= src/include/utils/acl.h=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20=20|=20=20=209=20+-=0A=20src/include/utils/guc.h=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20|=20=20=204=20+=0A= =20src/include/utils/lsyscache.h=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20=20|=20=20=201=20+=0A=20src/include/utils/syscache.h=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20=20=20=20|=20=20=202=20+=0A=20= src/pl/plperl/plperl--1.0.sql=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20= =20=20|=20=20=202=20+=0A=20src/pl/plperl/plperlu--1.0.sql=20=20=20=20=20=20= =20=20=20=20=20=20=20=20=20=20|=20=20=202=20+=0A=20= src/pl/plpgsql/src/plpgsql--1.0.sql=20=20=20=20=20=20=20=20=20=20=20|=20=20= =205=20+=0A=20.../expected/test_oat_hooks.out=20=20=20=20=20=20=20=20=20=20= =20=20=20=20=20|=20210=20+++++++---=0A=20= .../test_oat_hooks/sql/test_oat_hooks.sql=20=20=20=20=20|=20=2045=20++-=0A= =20.../modules/test_oat_hooks/test_oat_hooks.c=20=20=20|=20=2080=20+++-=0A= =20src/test/modules/test_pg_dump/t/001_base.pl=20=20=20|=20=2060=20+++=0A= =20src/test/modules/unsafe_tests/Makefile=20=20=20=20=20=20=20=20|=20=20=20= 2=20+-=0A=20.../unsafe_tests/expected/guc_privs.out=20=20=20=20=20=20=20= |=20375=20++++++++++++++++++=0A=20= .../modules/unsafe_tests/sql/guc_privs.sql=20=20=20=20|=20174=20++++++++=0A= =20src/test/regress/expected/rules.out=20=20=20=20=20=20=20=20=20=20=20|=20= =2013=20+=0A=2053=20files=20changed,=202551=20insertions(+),=20156=20= deletions(-)=0A=20create=20mode=20100644=20= src/backend/catalog/pg_parameter_acl.c=0A=20create=20mode=20100644=20= src/include/catalog/pg_parameter_acl.h=0A=20create=20mode=20100644=20= src/test/modules/unsafe_tests/expected/guc_privs.out=0A=20create=20mode=20= 100644=20src/test/modules/unsafe_tests/sql/guc_privs.sql=0A=0Adiff=20= --git=20a/contrib/pg_trgm/pg_trgm--1.3.sql=20= b/contrib/pg_trgm/pg_trgm--1.3.sql=0Aindex=204c6edf8c24..8aac300c7e=20= 100644=0A---=20a/contrib/pg_trgm/pg_trgm--1.3.sql=0A+++=20= b/contrib/pg_trgm/pg_trgm--1.3.sql=0A@@=20-252,3=20+252,7=20@@=20= LANGUAGE=20C=20IMMUTABLE=20STRICT=20PARALLEL=20SAFE;=0A=20ALTER=20= OPERATOR=20FAMILY=20gin_trgm_ops=20USING=20gin=20ADD=0A=20=20=20=20=20=20= =20=20=20OPERATOR=20=20=20=20=20=20=20=207=20=20=20=20=20=20=20%>=20= (text,=20text),=0A=20=20=20=20=20=20=20=20=20FUNCTION=20=20=20=20=20=20=20= =206=20=20=20=20=20=20(text,text)=20gin_trgm_triconsistent=20(internal,=20= int2,=20text,=20int4,=20internal,=20internal,=20internal);=0A+=0A+GRANT=20= SET=20ON=20PARAMETER=20pg_trgm.similarity_threshold=20TO=20public;=0A= +GRANT=20SET=20ON=20PARAMETER=20pg_trgm.word_similarity_threshold=20TO=20= public;=0A+GRANT=20SET=20ON=20PARAMETER=20= pg_trgm.strict_word_similarity_threshold=20TO=20public;=0Adiff=20--git=20= a/contrib/postgres_fdw/postgres_fdw--1.0.sql=20= b/contrib/postgres_fdw/postgres_fdw--1.0.sql=0Aindex=20= a0f0fc1bf4..4ddf5d812c=20100644=0A---=20= a/contrib/postgres_fdw/postgres_fdw--1.0.sql=0A+++=20= b/contrib/postgres_fdw/postgres_fdw--1.0.sql=0A@@=20-16,3=20+16,5=20@@=20= LANGUAGE=20C=20STRICT;=0A=20CREATE=20FOREIGN=20DATA=20WRAPPER=20= postgres_fdw=0A=20=20=20HANDLER=20postgres_fdw_handler=0A=20=20=20= VALIDATOR=20postgres_fdw_validator;=0A+=0A+GRANT=20SET=20ON=20PARAMETER=20= postgres_fdw.application_name=20TO=20public;=0Adiff=20--git=20= a/contrib/sepgsql/sepgsql.sql.in=20b/contrib/sepgsql/sepgsql.sql.in=0A= index=20917d12dbbe..9b59a80b09=20100644=0A---=20= a/contrib/sepgsql/sepgsql.sql.in=0A+++=20= b/contrib/sepgsql/sepgsql.sql.in=0A@@=20-35,3=20+35,4=20@@=20CREATE=20OR=20= REPLACE=20FUNCTION=20pg_catalog.sepgsql_mcstrans_in(text)=20RETURNS=20= text=20AS=0A=20CREATE=20OR=20REPLACE=20FUNCTION=20= pg_catalog.sepgsql_mcstrans_out(text)=20RETURNS=20text=20AS=20= 'MODULE_PATHNAME',=20'sepgsql_mcstrans_out'=20LANGUAGE=20C=20STRICT;=0A=20= CREATE=20OR=20REPLACE=20FUNCTION=20pg_catalog.sepgsql_restorecon(text)=20= RETURNS=20bool=20AS=20'MODULE_PATHNAME',=20'sepgsql_restorecon'=20= LANGUAGE=20C;=0A=20SELECT=20sepgsql_restorecon(NULL);=0A+GRANT=20SET=20= ON=20PARAMETER=20sepgsql.debug_audit=20TO=20public;=0Adiff=20--git=20= a/doc/src/sgml/catalogs.sgml=20b/doc/src/sgml/catalogs.sgml=0Aindex=20= 7f4f79d1b5..0ba8523269=20100644=0A---=20a/doc/src/sgml/catalogs.sgml=0A= +++=20b/doc/src/sgml/catalogs.sgml=0A@@=20-220,6=20+220,11=20@@=0A=20=20=20= =20=20=20=20access=20method=20operator=20families=0A=20=20= =20=20=20=20=0A=20=0A+=20=20=20=20=20=0A+=20=20=20=20=20=20= pg_parameter_acl=0A+=20=20=20=20=20=20configuration=20= parameters=20which=20have=20privileges=20granted=20to=20roles=0A= +=20=20=20=20=20=0A+=0A=20=20=20=20=20=20=0A=20=20=20=20=20=20= =20pg_partitioned_table<= /structname>=0A=20=20=20=20=20=20=20information=20= about=20partition=20key=20of=20tables=0A@@=20-2432,6=20+2437,64=20= @@=20SCRAM-SHA-256$<iteration=20= count>:&l=0A=20=20=20=0A=20=20= =0A=20=0A+=20=0A+=20=20= <structname>pg_parameter_acl</structname>=0A+=0A+=20=20= =0A+=20=20=20= pg_parameter_acl=0A+=20=20=0A+=0A+=20=20= =0A+=20=20=20The=20catalog=20= pg_parameter_acl=20records=20configuration=0A+=20= =20=20parameters=20which=20have=20had=20privileges=20to=20= SET=20or=0A+=20=20=20ALTER=20= SYSTEM=20granted=20to=20one=20or=20more=20roles.=0A+=20=20= =0A+=0A+=20=20=0A+=20=20=20Unlike=20most=20system=20= catalogs,=20pg_parameter_acl=0A+=20=20=20is=20= shared=20across=20all=20databases=20of=20a=20cluster:=20there=20is=20= only=20one=0A+=20=20=20copy=20of=20= pg_parameter_acl=20per=20cluster,=20not=0A+=20=20= =20one=20per=20database.=0A+=20=20=0A+=0A+=20=20=0A+=20=20=20= <structname>pg_parameter_acl</structname>=20Columns=0A+=20= =20=20=0A+=20=20=20=20=0A+=20=20=20=20=20= =0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20Column=20Type=0A+=20=20= =20=20=20=20=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20= Description=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20= =0A+=20=20=20=20=0A+=0A+=20=20=20=20=0A+=20=20=20=20= =20=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20= parameter=20text=0A+=20=20=20=20=20= =20=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20The=20= name=20of=20the=20configuration=20parameter=20for=20which=20privileges=20= are=20granted.=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20= =0A+=0A+=20=20=20=20=20=0A+=20=20=20=20=20=20=0A+=20=20= =20=20=20=20=20setacl=20= aclitem[]=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20= =0A+=20=20=20=20=20=20=20Access=20privileges;=20see=20=20for=20details=0A+=20=20=20=20=20=20= =0A+=20=20=20=20=20=0A+=0A+=20=20=20=20=0A+=20= =20=20=0A+=20=20
=0A+=20=0A+=0A=20=20=0A=20=20=20= <structname>pg_constraint</structname>=0A=20=0A@@=20= -12779,11=20+12842,13=20@@=20SELECT=20*=20FROM=20pg_locks=20pl=20LEFT=20= JOIN=20pg_prepared_xacts=20ppx=0A=20=20=20=20=20= superuser=0A=20=20=20=20=20=0A=20= =20=20=20=20=20=0A-=20=20=20=20=20=20These=20settings=20can=20be=20= set=20from=20postgresql.conf,=0A-=20=20=20=20=20=20= or=20within=20a=20session=20via=20the=20SET=20= command;=20but=20only=20superusers=0A-=20=20=20=20=20=20can=20change=20= them=20via=20SET.=20=20Changes=20in=0A-=20=20=20=20=20= =20postgresql.conf=20will=20affect=20existing=20= sessions=0A-=20=20=20=20=20=20only=20if=20no=20session-local=20value=20= has=20been=20established=20with=20SET.=0A+=20=20=20=20= =20=20These=20parameters=20can=20be=20set=20from=20= postgresql.conf,=20or=0A+=20=20=20=20=20=20within=20= a=20session=20via=20the=20SET=20command;=20but=20only=0A= +=20=20=20=20=20=20superusers=20or=20users=20with=20= SET=20privilege=20granted=0A+=20=20=20=20=20=20on=20= the=20parameters=20can=20change=20them=20via=20SET.=20= =20Changes=20in=0A+=20=20=20=20=20=20= postgresql.conf=20will=20affect=20existing=20= sessions=20only=0A+=20=20=20=20=20=20if=20no=20session-local=20value=20= has=20been=20established=20with=0A+=20=20=20=20=20=20= SET.=0A=20=20=20=20=20=20=0A=20=20=20=20=20= =0A=20=20=20=20=0Adiff=20--git=20= a/doc/src/sgml/ddl.sgml=20b/doc/src/sgml/ddl.sgml=0Aindex=20= 166b7a352d..8240ccb23b=20100644=0A---=20a/doc/src/sgml/ddl.sgml=0A+++=20= b/doc/src/sgml/ddl.sgml=0A@@=20-1691,7=20+1691,8=20@@=20ALTER=20TABLE=20= products=20RENAME=20TO=20items;=0A=20=20=20=20INSERT,=20= UPDATE,=20DELETE,=0A=20=20=20=20= TRUNCATE,=20REFERENCES,=20= TRIGGER,=0A=20=20=20=20CREATE,=20= CONNECT,=20TEMPORARY,=0A-=20=20=20= EXECUTE,=20and=20USAGE.=0A+=20=20=20= EXECUTE,=20USAGE,=20= SET=0A+=20=20=20and=20ALTER=20= SYSTEM.=0A=20=20=20=20The=20privileges=20applicable=20to=20a=20= particular=0A=20=20=20=20object=20vary=20depending=20on=20the=20object's=20= type=20(table,=20function,=20etc).=0A=20=20=20=20More=20detail=20about=20= the=20meanings=20of=20these=20privileges=20appears=20below.=0A@@=20= -1959,6=20+1960,26=20@@=20REVOKE=20ALL=20ON=20accounts=20FROM=20PUBLIC;=0A= =20=20=20=20=20=20=20=0A=20=20=20=20=20=20=0A=20=20=20=20= =20=0A+=0A+=20=20=20=20=0A+=20=20=20=20=20= SET=0A+=20=20=20=20=20=0A+=20=20= =20=20=20=20=0A+=20=20=20=20=20=20=20Allows=20run-time=20= configuration=20parameters=20to=20be=20set=20to=20a=20new=20value=20or=0A= +=20=20=20=20=20=20=20reset=20to=20the=20default=20value.=0A+=20=20=20=20= =20=20=0A+=20=20=20=20=20=0A+=20=20=20=20= =0A+=0A+=20=20=20=20=0A+=20=20=20=20=20= ALTER=20SYSTEM=0A+=20=20=20=20=20= =0A+=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20Allows=20= server=20configuration=20parameters=20to=20be=20configured=20to=20a=20= new=20value=0A+=20=20=20=20=20=20=20or=20reset=20to=20the=20default=20= configuration=20value.=0A+=20=20=20=20=20=20=0A+=20=20=20=20=20= =0A+=20=20=20=20=0A=20=20=20=20=0A= =20=0A=20=20=20=20The=20privileges=20required=20by=20other=20commands=20= are=20listed=20on=20the=0A@@=20-1981,8=20+2002,9=20@@=20REVOKE=20ALL=20= ON=20accounts=20FROM=20PUBLIC;=0A=20=20=20=20granted=20to=20= PUBLIC=20are=20as=20follows:=0A=20=20=20=20= CONNECT=20and=20TEMPORARY=20= (create=0A=20=20=20=20temporary=20tables)=20privileges=20for=20= databases;=0A-=20=20=20EXECUTE=20privilege=20for=20= functions=20and=20procedures;=20and=0A-=20=20=20USAGE=20= privilege=20for=20languages=20and=20data=20types=0A+=20=20=20= EXECUTE=20privilege=20for=20functions=20and=20= procedures;=0A+=20=20=20SET=20privilege=20for=20= setting=20parameters=20locally=20to=20a=0A+=20=20=20session;=20and=20= USAGE=20privilege=20for=20languages=20and=20data=20= types=0A=20=20=20=20(including=20domains).=0A=20=20=20=20The=20object=20= owner=20can,=20of=20course,=20REVOKE=0A=20=20=20=20= both=20default=20and=20expressly=20granted=20privileges.=20(For=20= maximum=0A@@=20-2097,6=20+2119,16=20@@=20REVOKE=20ALL=20ON=20accounts=20= FROM=20PUBLIC;=0A=20=20=20=20=20=20=20=20TYPE=0A=20=20= =20=20=20=20=20=0A=20=20=20=20=20=20=0A+=20=20=20=20=20= =0A+=20=20=20=20=20=20SET=0A+=20=20= =20=20=20=20s=0A+=20=20=20=20=20=20= PARAMETER=0A+=20=20=20=20=20=0A+=20= =20=20=20=20=0A+=20=20=20=20=20=20ALTER=20= SYSTEM=0A+=20=20=20=20=20=20= A=0A+=20=20=20=20=20=20= PARAMETER=0A+=20=20=20=20=20=0A=20= =20=20=20=20=20=0A=20=20=20=20=0A=20=20=20=0A@@=20= -2203,6=20+2235,12=20@@=20REVOKE=20ALL=20ON=20accounts=20FROM=20PUBLIC;=0A= =20=20=20=20=20=20=20U=0A=20=20=20=20=20= =20=20\dT+=0A=20=20=20=20=20=20=0A= +=20=20=20=20=20=0A+=20=20=20=20=20=20= PARAMETER=0A+=20=20=20=20=20=20= sA=0A+=20=20=20=20=20=20= s=20or=20none=0A+=20=20=20=20=20=20= none=0A+=20=20=20=20=20=0A=20=20=20=20=20=0A= =20=20=20=20=0A=20=20=20=0A@@=20-2274,6=20+2312,18=20@@=20= GRANT=20SELECT=20(col1),=20UPDATE=20(col1)=20ON=20mytable=20TO=20= miriam_rw;=0A=20=20=20=20access=20privileges=20display.=20=20A=20= *=20will=20appear=20only=20when=0A=20=20=20=20grant=20= options=20have=20been=20explicitly=20granted=20to=20someone.=0A=20=20=20= =0A+=0A+=20=20=0A+=20=20=20The=20default=20privileges=20for=20= a=20user=20parameter=20allow=0A+=20=20=20= PUBLIC=20to=20SET=20and=0A+=20=20=20= RESET=20the=20assigned=20value.=20=20By=20default,=0A= +=20=20=20PUBLIC=20has=20no=20privileges=20on=0A+=20=20= =20postmaster,=20= superuser-backend,=0A+=20=20=20= internal,=20backend,=0A+=20=20=20= sighup,=20and=20superuser=20= parameters.=0A+=20=20=20Parameters=20are=20not=20explicitly=20owned.=20=20= All=20parameters,=20including=20those=20added=0A+=20=20=20by=20= extensions,=20implicitly=20belong=20to=20the=20bootstrap=20superuser.=0A= +=20=20=0A=20=20=0A=20=0A=20=20=0Adiff=20--git=20a/doc/src/sgml/func.sgml=20= b/doc/src/sgml/func.sgml=0Aindex=2093f11faada..34491f70d7=20100644=0A---=20= a/doc/src/sgml/func.sgml=0A+++=20b/doc/src/sgml/func.sgml=0A@@=20= -22691,8=20+22691,7=20@@=20SELECT=20*=20FROM=20pg_ls_dir('.')=20WITH=20= ORDINALITY=20AS=20t(ls,n);=0A=20=20=20=20privilege=20is=20held=20with=20= grant=20option.=20Also,=20multiple=20privilege=20types=20can=20be=0A=20=20= =20=20listed=20separated=20by=20commas,=20in=20which=20case=20the=20= result=20will=20be=20true=20if=20any=20of=0A=20=20=20=20the=20listed=20= privileges=20is=20held.=20(Case=20of=20the=20privilege=20string=20is=20= not=0A-=20=20=20significant,=20and=20extra=20whitespace=20is=20allowed=20= between=20but=20not=20within=0A-=20=20=20privilege=20names.)=0A+=20=20=20= significant,=20and=20extra=20whitespace=20is=20allowed=20between=20= privilege=20names.)=0A=20=20=20=20Some=20examples:=0A=20=0A= =20SELECT=20has_table_privilege('myschema.mytable',=20'select');=0A@@=20= -22843,6=20+22842,23=20@@=20SELECT=20has_function_privilege('joeuser',=20= 'myfunc(int,=20text)',=20'execute');=0A=20=20=20=20=20=20=20=20= =0A=20=20=20=20=20=20=20=0A=20=0A+=20=20=20=20=20=20= =0A+=20=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20=20=0A+=20=20= =20=20=20=20=20=20=20has_parameter_privilege=0A+=20=20= =20=20=20=20=20=20=0A+=20=20=20=20=20=20=20=20= has_parameter_privilege=20(=0A+=20=20=20=20=20=20=20= =20=20=20=20user=20name=20= or=20oid,=20=0A+=20=20=20=20=20=20=20=20=20=20= parameter=20text=20or=20= oid,=0A+=20=20=20=20=20=20=20=20=20=20= privilege=20text=20)=0A+=20=20=20=20=20= =20=20=20boolean=0A+=20=20=20=20=20=20=20= =0A+=20=20=20=20=20=20=20=0A+=20=20=20=20=20=20=20=20Does=20= user=20have=20privilege=20for=20parameter?=0A+=20=20=20=20=20=20=20=20= Allowable=20privilege=20types=20are=20SET=20and=20= ALTER=20SYSTEM.=0A+=20=20=20=20=20=20=20= =0A+=20=20=20=20=20=20=0A+=0A=20=20=20=20=20=20=20= =0A=20=20=20=20=20=20=20=20=0A=20=20=20=20=20=20=20=20=20=0Adiff=20= --git=20a/doc/src/sgml/ref/grant.sgml=20b/doc/src/sgml/ref/grant.sgml=0A= index=208c4edd9b0a..f86b2072f5=20100644=0A---=20= a/doc/src/sgml/ref/grant.sgml=0A+++=20b/doc/src/sgml/ref/grant.sgml=0A@@=20= -92,6=20+92,11=20@@=20GRANT=20{=20USAGE=20|=20ALL=20[=20PRIVILEGES=20]=20= }=0A=20=20=20=20=20TO=20role_specification=20[,=20...]=20[=20= WITH=20GRANT=20OPTION=20]=0A=20=20=20=20=20[=20GRANTED=20BY=20= role_specification=20]=0A= =20=0A+GRANT=20{=20{=20SET=20|=20ALTER=20SYSTEM=20}=20[,=20...=20]=20|=20= ALL=20[=20PRIVILEGES=20]=20}=0A+=20=20=20=20ON=20PARAMETER=20= configuration_parameter=20= [,=20...]=0A+=20=20=20=20TO=20role_specification=20[,=20...]=20[=20= WITH=20GRANT=20OPTION=20]=0A+=20=20=20=20[=20GRANTED=20BY=20role_specification=20]=0A+=0A=20GRANT=20= role_name=20[,=20...]=20= TO=20role_specification=20= [,=20...]=0A=20=20=20=20=20[=20WITH=20ADMIN=20OPTION=20]=0A=20=20=20=20=20= [=20GRANTED=20BY=20role_specification=20]=0A@@=20-185,6=20= +190,8=20@@=20GRANT=20role_name=20[,=20...]=20TO=20TEMPORARY=0A=20=20=20=20= =20=20EXECUTE=0A=20=20=20=20=20=20= USAGE=0A+=20=20=20=20=20= SET=0A+=20=20=20=20=20= ALTER=20SYSTEM=0A=20=20=20=20=20=20= =0A=20=20=20=20=20=20=20=0A=20=20=20=20=20=20=20=20= Specific=20types=20of=20privileges,=20as=20defined=20in=20.=0Adiff=20--git=20a/doc/src/sgml/ref/revoke.sgml=20= b/doc/src/sgml/ref/revoke.sgml=0Aindex=203014c864ea..58455c519e=20100644=0A= ---=20a/doc/src/sgml/ref/revoke.sgml=0A+++=20= b/doc/src/sgml/ref/revoke.sgml=0A@@=20-118,6=20+118,13=20@@=20REVOKE=20[=20= GRANT=20OPTION=20FOR=20]=0A=20=20=20=20=20[=20GRANTED=20BY=20= role_specification=20]=0A= =20=20=20=20=20[=20CASCADE=20|=20RESTRICT=20]=0A=20=0A+REVOKE=20[=20= GRANT=20OPTION=20FOR=20]=0A+=20=20=20=20{=20{=20SET=20|=20ALTER=20SYSTEM=20= }=20[,=20...]=20|=20ALL=20[=20PRIVILEGES=20]=20}=0A+=20=20=20=20ON=20= PARAMETER=20configuration_parameter=20[,=20...]=0A= +=20=20=20=20FROM=20role_specification=20[,=20...]=0A+=20=20= =20=20[=20GRANTED=20BY=20role_specification=20]=0A+=20=20=20=20= [=20CASCADE=20|=20RESTRICT=20]=0A+=0A=20REVOKE=20[=20ADMIN=20OPTION=20= FOR=20]=0A=20=20=20=20=20role_name=20[,=20...]=20FROM=20= role_specification=20[,=20= ...]=0A=20=20=20=20=20[=20GRANTED=20BY=20role_specification=20]=0Adiff=20--git=20= a/doc/src/sgml/ref/set.sgml=20b/doc/src/sgml/ref/set.sgml=0Aindex=20= 339ee9eec9..465edcf4fd=20100644=0A---=20a/doc/src/sgml/ref/set.sgml=0A= +++=20b/doc/src/sgml/ref/set.sgml=0A@@=20-34,10=20+34,10=20@@=20SET=20[=20= SESSION=20|=20LOCAL=20]=20TIME=20ZONE=20{=20timezone=20can=20be=20changed=20on-the-fly=20with=0A=20= =20=20=20SET.=0A-=20=20=20(But=20some=20require=20= superuser=20privileges=20to=20change,=20and=20others=20cannot=0A-=20=20=20= be=20changed=20after=20server=20or=20session=20start.)=0A-=20=20=20= SET=20only=20affects=20the=20value=20used=20by=20the=20= current=0A-=20=20=20session.=0A+=20=20=20(But=20some=20require=20either=20= superuser=20privileges=20or=20granted=0A+=20=20=20SET=20= privileges=20to=20change,=20and=20others=20cannot=20be=20changed=0A+=20=20= =20after=20server=20or=20session=20start.)=20SET=20= only=20affects=20the=0A+=20=20=20value=20used=20by=20the=20current=20= session.=0A=20=20=20=0A=20=0A=20=20=20=0Adiff=20--git=20= a/src/backend/catalog/Makefile=20b/src/backend/catalog/Makefile=0Aindex=20= 87d7386e01..d14b957c14=20100644=0A---=20a/src/backend/catalog/Makefile=0A= +++=20b/src/backend/catalog/Makefile=0A@@=20-29,6=20+29,7=20@@=20OBJS=20= =3D=20\=0A=20=09pg_cast.o=20\=0A=20=09pg_class.o=20\=0A=20=09= pg_collation.o=20\=0A+=09pg_parameter_acl.o=20\=0A=20=09pg_constraint.o=20= \=0A=20=09pg_conversion.o=20\=0A=20=09pg_db_role_setting.o=20\=0A@@=20= -55,7=20+56,7=20@@=20include=20$(top_srcdir)/src/backend/common.mk=0A=20= #=20there=20are=20reputedly=20other,=20undocumented=20ordering=20= dependencies.=0A=20CATALOG_HEADERS=20:=3D=20\=0A=20=09pg_proc.h=20= pg_type.h=20pg_attribute.h=20pg_class.h=20\=0A-=09pg_attrdef.h=20= pg_constraint.h=20pg_inherits.h=20pg_index.h=20pg_operator.h=20\=0A+=09= pg_attrdef.h=20pg_parameter_acl.h=20pg_constraint.h=20pg_inherits.h=20= pg_index.h=20pg_operator.h=20\=0A=20=09pg_opfamily.h=20pg_opclass.h=20= pg_am.h=20pg_amop.h=20pg_amproc.h=20\=0A=20=09pg_language.h=20= pg_largeobject_metadata.h=20pg_largeobject.h=20pg_aggregate.h=20\=0A=20=09= pg_statistic.h=20pg_statistic_ext.h=20pg_statistic_ext_data.h=20\=0Adiff=20= --git=20a/src/backend/catalog/aclchk.c=20b/src/backend/catalog/aclchk.c=0A= index=201dd03a8e51..e3f1156fca=20100644=0A---=20= a/src/backend/catalog/aclchk.c=0A+++=20b/src/backend/catalog/aclchk.c=0A= @@=20-49,6=20+49,7=20@@=0A=20#include=20"catalog/pg_operator.h"=0A=20= #include=20"catalog/pg_opfamily.h"=0A=20#include=20"catalog/pg_proc.h"=0A= +#include=20"catalog/pg_parameter_acl.h"=0A=20#include=20= "catalog/pg_statistic_ext.h"=0A=20#include=20"catalog/pg_subscription.h"=0A= =20#include=20"catalog/pg_tablespace.h"=0A@@=20-112,6=20+113,7=20@@=20= static=20void=20ExecGrant_Largeobject(InternalGrant=20*grantStmt);=0A=20= static=20void=20ExecGrant_Namespace(InternalGrant=20*grantStmt);=0A=20= static=20void=20ExecGrant_Tablespace(InternalGrant=20*grantStmt);=0A=20= static=20void=20ExecGrant_Type(InternalGrant=20*grantStmt);=0A+static=20= void=20ExecGrant_Parameter(InternalGrant=20*grantStmt);=0A=20=0A=20= static=20void=20SetDefaultACLsInSchemas(InternalDefaultACL=20*iacls,=20= List=20*nspnames);=0A=20static=20void=20SetDefaultACL(InternalDefaultACL=20= *iacls);=0A@@=20-259,6=20+261,9=20@@=20restrict_and_check_grant(bool=20= is_grant,=20AclMode=20avail_goptions,=20bool=20all_privs,=0A=20=09=09= case=20OBJECT_TYPE:=0A=20=09=09=09whole_mask=20=3D=20= ACL_ALL_RIGHTS_TYPE;=0A=20=09=09=09break;=0A+=09=09case=20= OBJECT_PARAMETER:=0A+=09=09=09whole_mask=20=3D=20= ACL_ALL_RIGHTS_PARAMETER;=0A+=09=09=09break;=0A=20=09=09default:=0A=20=09= =09=09elog(ERROR,=20"unrecognized=20object=20type:=20%d",=20objtype);=0A=20= =09=09=09/*=20not=20reached,=20but=20keep=20compiler=20quiet=20*/=0A@@=20= -498,6=20+503,10=20@@=20ExecuteGrantStmt(GrantStmt=20*stmt)=0A=20=09=09=09= all_privileges=20=3D=20ACL_ALL_RIGHTS_FOREIGN_SERVER;=0A=20=09=09=09= errormsg=20=3D=20gettext_noop("invalid=20privilege=20type=20%s=20for=20= foreign=20server");=0A=20=09=09=09break;=0A+=09=09case=20= OBJECT_PARAMETER:=0A+=09=09=09all_privileges=20=3D=20= ACL_ALL_RIGHTS_PARAMETER;=0A+=09=09=09errormsg=20=3D=20= gettext_noop("invalid=20privilege=20type=20%s=20for=20parameter");=0A+=09= =09=09break;=0A=20=09=09default:=0A=20=09=09=09elog(ERROR,=20= "unrecognized=20GrantStmt.objtype:=20%d",=0A=20=09=09=09=09=20(int)=20= stmt->objtype);=0A@@=20-600,6=20+609,9=20@@=20= ExecGrantStmt_oids(InternalGrant=20*istmt)=0A=20=09=09case=20= OBJECT_TABLESPACE:=0A=20=09=09=09ExecGrant_Tablespace(istmt);=0A=20=09=09= =09break;=0A+=09=09case=20OBJECT_PARAMETER:=0A+=09=09=09= ExecGrant_Parameter(istmt);=0A+=09=09=09break;=0A=20=09=09default:=0A=20=09= =09=09elog(ERROR,=20"unrecognized=20GrantStmt.objtype:=20%d",=0A=20=09=09= =09=09=20(int)=20istmt->objtype);=0A@@=20-759,6=20+771,37=20@@=20= objectNamesToOids(ObjectType=20objtype,=20List=20*objnames)=0A=20=09=09=09= =09objects=20=3D=20lappend_oid(objects,=20srvid);=0A=20=09=09=09}=0A=20=09= =09=09break;=0A+=09=09case=20OBJECT_PARAMETER:=0A+=09=09=09foreach(cell,=20= objnames)=0A+=09=09=09{=0A+=09=09=09=09char=09=20=20=20*parameter=20=3D=20= strVal(lfirst(cell));=0A+=09=09=09=09Oid=09=09=09parameterId=20=3D=20= get_parameter_oid(parameter,=20true);=0A+=0A+=09=09=09=09if=20= (!OidIsValid(parameterId))=0A+=09=09=09=09{=0A+=09=09=09=09=09/*=0A+=09=09= =09=09=09=20*=20Lookup=20the=20existing=20entry,=20or=20if=20missing,=20= add=20a=20new=0A+=09=09=09=09=09=20*=20entry=20for=20this=20parameter.=20= =20Entries=20only=20exist=20for=0A+=09=09=09=09=09=20*=20parameters=20= which=20currently=20have,=20or=20previously=20have=20had,=0A+=09=09=09=09= =09=20*=20privileges=20assigned.=0A+=09=09=09=09=09=20*=0A+=09=09=09=09=09= =20*=20We=20do=20not=20sanity-check=20here=20the=20given=20configuration=0A= +=09=09=09=09=09=20*=20parameter=20name=20against=20known=20guc=20names=20= in=20the=20guc=0A+=09=09=09=09=09=20*=20tables.=20=20Callers=20are=20= responsible=20such=20checks,=20if=20needed.=0A+=09=09=09=09=09=20*/=0A+=09= =09=09=09=09parameterId=20=3D=20ParameterAclCreate(parameter,=20true);=0A= +=0A+=09=09=09=09=09/*=0A+=09=09=09=09=09=20*=20Prevent=20error=20when=20= processing=20duplicate=20objects,=20and=0A+=09=09=09=09=09=20*=20make=20= this=20new=20entry=20visible=20to=20our=20later=20selves=20which=0A+=09=09= =09=09=09=20*=20will=20need=20to=20update=20the=20Acl.=0A+=09=09=09=09=09= =20*/=0A+=09=09=09=09=09CommandCounterIncrement();=0A+=09=09=09=09}=0A+=0A= +=09=09=09=09objects=20=3D=20lappend_oid(objects,=20parameterId);=0A+=09=09= =09}=0A+=09=09=09break;=0A=20=09=09default:=0A=20=09=09=09elog(ERROR,=20= "unrecognized=20GrantStmt.objtype:=20%d",=0A=20=09=09=09=09=20(int)=20= objtype);=0A@@=20-1494,6=20+1537,9=20@@=20RemoveRoleFromObjectACL(Oid=20= roleid,=20Oid=20classid,=20Oid=20objid)=0A=20=09=09=09case=20= ForeignDataWrapperRelationId:=0A=20=09=09=09=09istmt.objtype=20=3D=20= OBJECT_FDW;=0A=20=09=09=09=09break;=0A+=09=09=09case=20= ParameterAclRelationId:=0A+=09=09=09=09istmt.objtype=20=3D=20= OBJECT_PARAMETER;=0A+=09=09=09=09break;=0A=20=09=09=09default:=0A=20=09=09= =09=09elog(ERROR,=20"unexpected=20object=20class=20%u",=20classid);=0A=20= =09=09=09=09break;=0A@@=20-3225,6=20+3271,158=20@@=20= ExecGrant_Type(InternalGrant=20*istmt)=0A=20=09table_close(relation,=20= RowExclusiveLock);=0A=20}=0A=20=0A+static=20void=0A= +ExecGrant_Parameter(InternalGrant=20*istmt)=0A+{=0A+=09Relation=09= relation;=0A+=09ListCell=20=20=20*cell;=0A+=0A+=09if=20(istmt->all_privs=20= &&=20istmt->privileges=20=3D=3D=20ACL_NO_RIGHTS)=0A+=09=09= istmt->privileges=20=3D=20ACL_ALL_RIGHTS_PARAMETER;=0A+=0A+=09relation=20= =3D=20table_open(ParameterAclRelationId,=20RowExclusiveLock);=0A+=0A+=09= foreach(cell,=20istmt->objects)=0A+=09{=0A+=09=09Oid=09=09=09parameterId=20= =3D=20lfirst_oid(cell);=0A+=09=09char=09=20=20=20*parameter=20=3D=20= NULL;=0A+=09=09Form_pg_parameter_acl=20pg_parameter_acl_tuple;=0A+=09=09= Datum=09=09aclDatum;=0A+=09=09bool=09=09isNull;=0A+=09=09AclMode=09=09= avail_goptions;=0A+=09=09AclMode=09=09this_privileges;=0A+=09=09Acl=09=09= =20=20=20*old_acl;=0A+=09=09Acl=09=09=20=20=20*new_acl;=0A+=09=09Oid=09=09= =09grantorId;=0A+=09=09HeapTuple=09tuple;=0A+=09=09HeapTuple=09newtuple;=0A= +=09=09Datum=09=09values[Natts_pg_parameter_acl];=0A+=09=09bool=09=09= nulls[Natts_pg_parameter_acl];=0A+=09=09bool=09=09= replaces[Natts_pg_parameter_acl];=0A+=09=09int=09=09=09noldmembers;=0A+=09= =09int=09=09=09nnewmembers;=0A+=09=09Oid=09=09=20=20=20*oldmembers;=0A+=09= =09Oid=09=09=20=20=20*newmembers;=0A+=0A+=09=09tuple=20=3D=20= SearchSysCache1(PARAMETEROID,=20ObjectIdGetDatum(parameterId));=0A+=09=09= if=20(!HeapTupleIsValid(tuple))=0A+=09=09=09elog(ERROR,=20"cache=20= lookup=20failed=20for=20parameter=20%u",=20parameterId);=0A+=0A+=09=09= pg_parameter_acl_tuple=20=3D=20(Form_pg_parameter_acl)=20= GETSTRUCT(tuple);=0A+=0A+=09=09/*=0A+=09=09=20*=20Get=20owner=20ID=20and=20= working=20copy=20of=20existing=20ACL.=20If=20there's=20no=20ACL,=0A+=09=09= =20*=20substitute=20the=20proper=20default.=0A+=09=09=20*/=0A+=09=09= aclDatum=20=3D=20SysCacheGetAttr(PARAMETERNAME,=20tuple,=20= Anum_pg_parameter_acl_setacl,=0A+=09=09=09=09=09=09=09=09=20=20=20= &isNull);=0A+=0A+=09=09parameter=20=3D=20= text_to_cstring(&pg_parameter_acl_tuple->parameter);=0A+=0A+=09=09/*=0A+=09= =09=20*=20If=20the=20acl=20is=20null,=20we=20need=20to=20create=20a=20= more=20permissive=20default=20acl=0A+=09=09=20*=20for=20userset=20= variables=20than=20for=20any=20others.=0A+=09=09=20*/=0A+=09=09if=20= (isNull)=0A+=09=09{=0A+=09=09=09GucContext=20context;=0A+=0A+=09=09=09/*=0A= +=09=09=09=20*=20If=20we're=20processing=20a=20custom=20parameter=20that=20= has=20not=20been=20created=0A+=09=09=09=20*=20yet,=20we=20want=20to=20be=20= conservative=20and=20avoid=20granting=20any=0A+=09=09=09=20*=20= privileges=20until=20module=20installation=20time,=20at=20which=20point=20= the=0A+=09=09=09=20*=20context=20will=20be=20known.=20=20We=20default=20= to=20PGC_SUSET=20here,=20and=20let=0A+=09=09=09=20*=20the=20module=20= installation=20sql=20script=20handle=20updating=20the=20Acl=20to=0A+=09=09= =09=20*=20include=20grants=20to=20public.=20=20However,=20if=20this=20= parameter=20already=0A+=09=09=09=20*=20exists,=20we=20must=20return=20= the=20appropriate=20default=20Acl=20for=20the=0A+=09=09=09=20*=20= parameter's=20context.=0A+=09=09=09=20*/=0A+=09=09=09context=20=3D=20= find_option_context(parameter,=20PGC_SUSET);=0A+=0A+=09=09=09/*=0A+=09=09= =09=20*=20We=20only=20care=20whether=20the=20context=20is=20PGC_USERSET.=20= =20All=20other=0A+=09=09=09=20*=20contexts=20have=20no=20privileges=20= granted=20to=20public=20by=20default.=0A+=09=09=09=20*/=0A+=09=09=09= old_acl=20=3D=20aclparameterdefault(context=20=3D=3D=20PGC_USERSET);=0A+=0A= +=09=09=09/*=20There=20are=20no=20old=20member=20roles=20according=20to=20= the=20catalogs=20*/=0A+=09=09=09noldmembers=20=3D=200;=0A+=09=09=09= oldmembers=20=3D=20NULL;=0A+=09=09}=0A+=09=09else=0A+=09=09{=0A+=09=09=09= old_acl=20=3D=20DatumGetAclPCopy(aclDatum);=0A+=09=09=09/*=20Get=20the=20= roles=20mentioned=20in=20the=20existing=20ACL=20*/=0A+=09=09=09= noldmembers=20=3D=20aclmembers(old_acl,=20&oldmembers);=0A+=09=09}=0A+=0A= +=09=09/*=20Determine=20ID=20to=20do=20the=20grant=20as,=20and=20= available=20grant=20options=20*/=0A+=09=09= select_best_grantor(GetUserId(),=20istmt->privileges,=0A+=09=09=09=09=09=09= =09old_acl,=20BOOTSTRAP_SUPERUSERID,=0A+=09=09=09=09=09=09=09&grantorId,=20= &avail_goptions);=0A+=0A+=09=09/*=0A+=09=09=20*=20Restrict=20the=20= privileges=20to=20what=20we=20can=20actually=20grant,=20and=20emit=20the=0A= +=09=09=20*=20standards-mandated=20warning=20and=20error=20messages.=0A+=09= =09=20*/=0A+=09=09this_privileges=20=3D=0A+=09=09=09= restrict_and_check_grant(istmt->is_grant,=20avail_goptions,=0A+=09=09=09=09= =09=09=09=09=09=20istmt->all_privs,=20istmt->privileges,=0A+=09=09=09=09=09= =09=09=09=09=20parameterId,=20grantorId,=20OBJECT_PARAMETER,=0A+=09=09=09= =09=09=09=09=09=09=20= text_to_cstring(&pg_parameter_acl_tuple->parameter),=0A+=09=09=09=09=09=09= =09=09=09=200,=20NULL);=0A+=0A+=09=09/*=0A+=09=09=20*=20Generate=20new=20= ACL.=0A+=09=09=20*/=0A+=09=09new_acl=20=3D=20= merge_acl_with_grant(old_acl,=20istmt->is_grant,=0A+=09=09=09=09=09=09=09= =09=09=20=20=20istmt->grant_option,=20istmt->behavior,=0A+=09=09=09=09=09= =09=09=09=09=20=20=20istmt->grantees,=20this_privileges,=0A+=09=09=09=09=09= =09=09=09=09=20=20=20grantorId,=20InvalidOid);=0A+=0A+=09=09/*=0A+=09=09=20= *=20We=20need=20the=20members=20of=20both=20old=20and=20new=20ACLs=20so=20= we=20can=20correct=20the=0A+=09=09=20*=20shared=20dependency=20= information.=0A+=09=09=20*/=0A+=09=09nnewmembers=20=3D=20= aclmembers(new_acl,=20&newmembers);=0A+=0A+=09=09/*=20finished=20= building=20new=20ACL=20value,=20now=20insert=20it=20*/=0A+=09=09= MemSet(values,=200,=20sizeof(values));=0A+=09=09MemSet(nulls,=20false,=20= sizeof(nulls));=0A+=09=09MemSet(replaces,=20false,=20sizeof(replaces));=0A= +=0A+=09=09replaces[Anum_pg_parameter_acl_setacl=20-=201]=20=3D=20true;=0A= +=09=09values[Anum_pg_parameter_acl_setacl=20-=201]=20=3D=20= PointerGetDatum(new_acl);=0A+=0A+=09=09newtuple=20=3D=20= heap_modify_tuple(tuple,=20RelationGetDescr(relation),=20values,=0A+=09=09= =09=09=09=09=09=09=09=20nulls,=20replaces);=0A+=0A+=09=09= CatalogTupleUpdate(relation,=20&newtuple->t_self,=20newtuple);=0A+=0A+=09= =09/*=20Update=20initial=20privileges=20for=20extensions=20*/=0A+=09=09= recordExtensionInitPriv(parameterId,=20ParameterAclRelationId,=200,=20= new_acl);=0A+=0A+=09=09/*=20Update=20the=20shared=20dependency=20ACL=20= info=20*/=0A+=09=09updateAclDependencies(ParameterAclRelationId,=0A+=09=09= =09=09=09=09=09=20=20pg_parameter_acl_tuple->oid,=200,=0A+=09=09=09=09=09= =09=09=20=20InvalidOid,=0A+=09=09=09=09=09=09=09=20=20noldmembers,=20= oldmembers,=0A+=09=09=09=09=09=09=09=20=20nnewmembers,=20newmembers);=0A= +=0A+=09=09ReleaseSysCache(tuple);=0A+=0A+=09=09pfree(new_acl);=0A+=0A+=09= =09/*=20Post=20alter=20hook=20called=20for=20grant=20and=20revoke=20*/=0A= +=09=09InvokeObjectPostAlterHookStr(ParameterAclRelationId,=20parameter,=20= istmt->privileges);=0A+=0A+=09=09/*=20prevent=20error=20when=20= processing=20duplicate=20objects=20*/=0A+=09=09= CommandCounterIncrement();=0A+=09}=0A+=0A+=09table_close(relation,=20= RowExclusiveLock);=0A+}=0A+=0A=20=0A=20static=20AclMode=0A=20= string_to_privilege(const=20char=20*privname)=0A@@=20-3255,6=20+3453,10=20= @@=20string_to_privilege(const=20char=20*privname)=0A=20=09=09return=20= ACL_CREATE_TEMP;=0A=20=09if=20(strcmp(privname,=20"connect")=20=3D=3D=20= 0)=0A=20=09=09return=20ACL_CONNECT;=0A+=09if=20(strcmp(privname,=20= "set")=20=3D=3D=200)=0A+=09=09return=20ACL_SET;=0A+=09if=20= (strcmp(privname,=20"alter=20system")=20=3D=3D=200)=0A+=09=09return=20= ACL_ALTER_SYSTEM;=0A=20=09if=20(strcmp(privname,=20"rule")=20=3D=3D=200)=0A= =20=09=09return=200;=09=09=09=09/*=20ignore=20old=20RULE=20privileges=20= */=0A=20=09ereport(ERROR,=0A@@=20-3292,6=20+3494,10=20@@=20= privilege_to_string(AclMode=20privilege)=0A=20=09=09=09return=20"TEMP";=0A= =20=09=09case=20ACL_CONNECT:=0A=20=09=09=09return=20"CONNECT";=0A+=09=09= case=20ACL_SET:=0A+=09=09=09return=20"SET";=0A+=09=09case=20= ACL_ALTER_SYSTEM:=0A+=09=09=09return=20"ALTER=20SYSTEM";=0A=20=09=09= default:=0A=20=09=09=09elog(ERROR,=20"unrecognized=20privilege:=20%d",=20= (int)=20privilege);=0A=20=09}=0A@@=20-3328,6=20+3534,13=20@@=20= aclcheck_error(AclResult=20aclerr,=20ObjectType=20objtype,=0A=20=09=09=09= =09=09case=20OBJECT_COLUMN:=0A=20=09=09=09=09=09=09msg=20=3D=20= gettext_noop("permission=20denied=20for=20column=20%s");=0A=20=09=09=09=09= =09=09break;=0A+=09=09=09=09=09case=20OBJECT_PARAMETER:=0A+=09=09=09=09=09= =09/*=0A+=09=09=09=09=09=09=20*=20Quote=20the=20object=20name=20for=20= backward=20compatibility=0A+=09=09=09=09=09=09=20*=20with=20behavior=20= before=20SET=20was=20handled=20here.=0A+=09=09=09=09=09=09=20*/=0A+=09=09= =09=09=09=09msg=20=3D=20gettext_noop("permission=20denied=20to=20set=20= parameter=20\"%s\"");=0A+=09=09=09=09=09=09break;=0A=20=09=09=09=09=09= case=20OBJECT_CONVERSION:=0A=20=09=09=09=09=09=09msg=20=3D=20= gettext_noop("permission=20denied=20for=20conversion=20%s");=0A=20=09=09=09= =09=09=09break;=0A@@=20-3564,6=20+3777,7=20@@=20aclcheck_error(AclResult=20= aclerr,=20ObjectType=20objtype,=0A=20=09=09=09=09=09case=20= OBJECT_AMPROC:=0A=20=09=09=09=09=09case=20OBJECT_ATTRIBUTE:=0A=20=09=09=09= =09=09case=20OBJECT_CAST:=0A+=09=09=09=09=09case=20OBJECT_PARAMETER:=0A=20= =09=09=09=09=09case=20OBJECT_DEFAULT:=0A=20=09=09=09=09=09case=20= OBJECT_DEFACL:=0A=20=09=09=09=09=09case=20OBJECT_DOMCONSTRAINT:=0A@@=20= -4000,6=20+4214,59=20@@=20pg_database_aclmask(Oid=20db_oid,=20Oid=20= roleid,=0A=20=09return=20result;=0A=20}=0A=20=0A+/*=0A+=20*=20Exported=20= routine=20for=20examining=20a=20user's=20privileges=20for=20a=20= configuration=0A+=20*=20parameter=20(GUC)=0A+=20*/=0A+AclMode=0A= +pg_parameter_acl_aclmask(Oid=20config_oid,=20Oid=20roleid,=0A+=09=09=09=09= =09=09AclMode=20mask,=20AclMaskHow=20how)=0A+{=0A+=09AclMode=09=09= result;=0A+=09HeapTuple=09tuple;=0A+=09Datum=09=09aclDatum;=0A+=09bool=09= =09isNull;=0A+=09Acl=09=09=20=20=20*acl;=0A+=0A+=09/*=20Superusers=20= bypass=20all=20permission=20checking.=20*/=0A+=09if=20= (superuser_arg(roleid))=0A+=09=09return=20mask;=0A+=0A+=09/*=0A+=09=20*=20= Get=20the=20parameter's=20ACL=20from=20pg_parameter_acl=0A+=09=20*/=0A+=09= tuple=20=3D=20SearchSysCache1(PARAMETEROID,=20= ObjectIdGetDatum(config_oid));=0A+=09if=20(!HeapTupleIsValid(tuple))=0A+=09= =09ereport(ERROR,=0A+=09=09=09=09(errcode(ERRCODE_UNDEFINED_DATABASE),=0A= +=09=09=09=09=20errmsg("parameter=20with=20OID=20%u=20does=20not=20= exist",=0A+=09=09=09=09=09=09config_oid)));=0A+=0A+=09aclDatum=20=3D=20= SysCacheGetAttr(PARAMETEROID,=20tuple,=20Anum_pg_parameter_acl_setacl,=0A= +=09=09=09=09=09=09=09=20=20=20&isNull);=0A+=09if=20(isNull)=0A+=09{=0A+=09= =09/*=20No=20ACL,=20so=20build=20default=20ACL=20*/=0A+=09=09acl=20=3D=20= acldefault(OBJECT_PARAMETER,=20InvalidOid);=0A+=09=09aclDatum=20=3D=20= (Datum)=200;=0A+=09}=0A+=09else=0A+=09{=0A+=09=09/*=20detoast=20ACL=20if=20= necessary=20*/=0A+=09=09acl=20=3D=20DatumGetAclP(aclDatum);=0A+=09}=0A+=0A= +=09result=20=3D=20aclmask(acl,=20roleid,=20InvalidOid,=20mask,=20how);=0A= +=0A+=09/*=20if=20we=20have=20a=20detoasted=20copy,=20free=20it=20*/=0A+=09= if=20(acl=20&&=20(Pointer)=20acl=20!=3D=20DatumGetPointer(aclDatum))=0A+=09= =09pfree(acl);=0A+=0A+=09ReleaseSysCache(tuple);=0A+=0A+=09return=20= result;=0A+}=0A+=0A=20/*=0A=20=20*=20Exported=20routine=20for=20= examining=20a=20user's=20privileges=20for=20a=20function=0A=20=20*/=0A@@=20= -4713,6=20+4980,19=20@@=20pg_database_aclcheck(Oid=20db_oid,=20Oid=20= roleid,=20AclMode=20mode)=0A=20=09=09return=20ACLCHECK_NO_PRIV;=0A=20}=0A= =20=0A+/*=0A+=20*=20Exported=20routine=20for=20checking=20a=20user's=20= access=20privileges=20to=20a=20configuration=0A+=20*=20parameter=0A+=20= */=0A+AclResult=0A+pg_parameter_acl_aclcheck(Oid=20config_oid,=20Oid=20= roleid,=20AclMode=20mode)=0A+{=0A+=09if=20= (pg_parameter_acl_aclmask(config_oid,=20roleid,=20mode,=20ACLMASK_ANY)=20= !=3D=200)=0A+=09=09return=20ACLCHECK_OK;=0A+=09else=0A+=09=09return=20= ACLCHECK_NO_PRIV;=0A+}=0A+=0A=20/*=0A=20=20*=20Exported=20routine=20for=20= checking=20a=20user's=20access=20privileges=20to=20a=20function=0A=20=20= */=0Adiff=20--git=20a/src/backend/catalog/catalog.c=20= b/src/backend/catalog/catalog.c=0Aindex=20dfd5fb669e..f91924cae3=20= 100644=0A---=20a/src/backend/catalog/catalog.c=0A+++=20= b/src/backend/catalog/catalog.c=0A@@=20-34,6=20+34,7=20@@=0A=20#include=20= "catalog/pg_largeobject.h"=0A=20#include=20"catalog/pg_namespace.h"=0A=20= #include=20"catalog/pg_replication_origin.h"=0A+#include=20= "catalog/pg_parameter_acl.h"=0A=20#include=20"catalog/pg_shdepend.h"=0A=20= #include=20"catalog/pg_shdescription.h"=0A=20#include=20= "catalog/pg_shseclabel.h"=0A@@=20-246,6=20+247,7=20@@=20= IsSharedRelation(Oid=20relationId)=0A=20=09/*=20These=20are=20the=20= shared=20catalogs=20(look=20for=20BKI_SHARED_RELATION)=20*/=0A=20=09if=20= (relationId=20=3D=3D=20AuthIdRelationId=20||=0A=20=09=09relationId=20=3D=3D= =20AuthMemRelationId=20||=0A+=09=09relationId=20=3D=3D=20= ParameterAclRelationId=20||=0A=20=09=09relationId=20=3D=3D=20= DatabaseRelationId=20||=0A=20=09=09relationId=20=3D=3D=20= SharedDescriptionRelationId=20||=0A=20=09=09relationId=20=3D=3D=20= SharedDependRelationId=20||=0A@@=20-260,6=20+262,8=20@@=20= IsSharedRelation(Oid=20relationId)=0A=20=09=09relationId=20=3D=3D=20= AuthIdOidIndexId=20||=0A=20=09=09relationId=20=3D=3D=20= AuthMemRoleMemIndexId=20||=0A=20=09=09relationId=20=3D=3D=20= AuthMemMemRoleIndexId=20||=0A+=09=09relationId=20=3D=3D=20= ParameterAclParameterIndexId=20||=0A+=09=09relationId=20=3D=3D=20= ParameterAclOidIndexId=20||=0A=20=09=09relationId=20=3D=3D=20= DatabaseNameIndexId=20||=0A=20=09=09relationId=20=3D=3D=20= DatabaseOidIndexId=20||=0A=20=09=09relationId=20=3D=3D=20= SharedDescriptionObjIndexId=20||=0A@@=20-277,6=20+281,8=20@@=20= IsSharedRelation(Oid=20relationId)=0A=20=09/*=20These=20are=20their=20= toast=20tables=20and=20toast=20indexes=20*/=0A=20=09if=20(relationId=20= =3D=3D=20PgAuthidToastTable=20||=0A=20=09=09relationId=20=3D=3D=20= PgAuthidToastIndex=20||=0A+=09=09relationId=20=3D=3D=20= PgParameterAclToastTable=20||=0A+=09=09relationId=20=3D=3D=20= PgParameterAclToastIndex=20||=0A=20=09=09relationId=20=3D=3D=20= PgDatabaseToastTable=20||=0A=20=09=09relationId=20=3D=3D=20= PgDatabaseToastIndex=20||=0A=20=09=09relationId=20=3D=3D=20= PgDbRoleSettingToastTable=20||=0Adiff=20--git=20= a/src/backend/catalog/dependency.c=20b/src/backend/catalog/dependency.c=0A= index=2025fe56d310..013fc6ee7d=20100644=0A---=20= a/src/backend/catalog/dependency.c=0A+++=20= b/src/backend/catalog/dependency.c=0A@@=20-52,6=20+52,7=20@@=0A=20= #include=20"catalog/pg_publication_namespace.h"=0A=20#include=20= "catalog/pg_publication_rel.h"=0A=20#include=20"catalog/pg_rewrite.h"=0A= +#include=20"catalog/pg_parameter_acl.h"=0A=20#include=20= "catalog/pg_statistic_ext.h"=0A=20#include=20"catalog/pg_subscription.h"=0A= =20#include=20"catalog/pg_tablespace.h"=0A@@=20-178,6=20+179,7=20@@=20= static=20const=20Oid=20object_classes[]=20=3D=20{=0A=20=09= DefaultAclRelationId,=09=09/*=20OCLASS_DEFACL=20*/=0A=20=09= ExtensionRelationId,=09=09/*=20OCLASS_EXTENSION=20*/=0A=20=09= EventTriggerRelationId,=09=09/*=20OCLASS_EVENT_TRIGGER=20*/=0A+=09= ParameterAclRelationId,=09=09/*=20OCLASS_PARAMETER=20*/=0A=20=09= PolicyRelationId,=09=09=09/*=20OCLASS_POLICY=20*/=0A=20=09= PublicationNamespaceRelationId,=20/*=20OCLASS_PUBLICATION_NAMESPACE=20*/=0A= =20=09PublicationRelationId,=09=09/*=20OCLASS_PUBLICATION=20*/=0A@@=20= -1503,6=20+1505,7=20@@=20doDeletion(const=20ObjectAddress=20*object,=20= int=20flags)=0A=20=09=09=09/*=0A=20=09=09=09=20*=20These=20global=20= object=20types=20are=20not=20supported=20here.=0A=20=09=09=09=20*/=0A+=09= =09case=20OCLASS_PARAMETER:=0A=20=09=09case=20OCLASS_ROLE:=0A=20=09=09= case=20OCLASS_DATABASE:=0A=20=09=09case=20OCLASS_TBLSPACE:=0A@@=20= -2861,6=20+2864,9=20@@=20getObjectClass(const=20ObjectAddress=20*object)=0A= =20=09=09case=20EventTriggerRelationId:=0A=20=09=09=09return=20= OCLASS_EVENT_TRIGGER;=0A=20=0A+=09=09case=20ParameterAclRelationId:=0A+=09= =09=09return=20OCLASS_PARAMETER;=0A+=0A=20=09=09case=20PolicyRelationId:=0A= =20=09=09=09return=20OCLASS_POLICY;=0A=20=0Adiff=20--git=20= a/src/backend/catalog/objectaddress.c=20= b/src/backend/catalog/objectaddress.c=0Aindex=203fd17ea64f..4754d15c81=20= 100644=0A---=20a/src/backend/catalog/objectaddress.c=0A+++=20= b/src/backend/catalog/objectaddress.c=0A@@=20-51,6=20+51,7=20@@=0A=20= #include=20"catalog/pg_publication_namespace.h"=0A=20#include=20= "catalog/pg_publication_rel.h"=0A=20#include=20"catalog/pg_rewrite.h"=0A= +#include=20"catalog/pg_parameter_acl.h"=0A=20#include=20= "catalog/pg_statistic_ext.h"=0A=20#include=20"catalog/pg_subscription.h"=0A= =20#include=20"catalog/pg_tablespace.h"=0A@@=20-2285,6=20+2286,7=20@@=20= pg_get_object_address(PG_FUNCTION_ARGS)=0A=20=09=09case=20OBJECT_COLUMN:=0A= =20=09=09case=20OBJECT_ATTRIBUTE:=0A=20=09=09case=20OBJECT_COLLATION:=0A= +=09=09case=20OBJECT_PARAMETER:=0A=20=09=09case=20OBJECT_CONVERSION:=0A=20= =09=09case=20OBJECT_STATISTIC_EXT:=0A=20=09=09case=20OBJECT_TSPARSER:=0A= @@=20-3880,6=20+3882,22=20@@=20getObjectDescription(const=20= ObjectAddress=20*object,=20bool=20missing_ok)=0A=20=09=09=09=09break;=0A=20= =09=09=09}=0A=20=0A+=09=09case=20OCLASS_PARAMETER:=0A+=09=09=09{=0A+=09=09= =09=09char=09=20=20=20*parameter;=0A+=0A+=09=09=09=09parameter=20=3D=20= get_parameter_name(object->objectId);=0A+=09=09=09=09if=20(!parameter)=0A= +=09=09=09=09{=0A+=09=09=09=09=09if=20(!missing_ok)=0A+=09=09=09=09=09=09= elog(ERROR,=20"cache=20lookup=20failed=20for=20parameter=20%u",=0A+=09=09= =09=09=09=09=09=20object->objectId);=0A+=09=09=09=09=09break;=0A+=09=09=09= =09}=0A+=09=09=09=09appendStringInfo(&buffer,=20_("parameter=20%s"),=20= parameter);=0A+=09=09=09=09break;=0A+=09=09=09}=0A+=0A=20=09=09case=20= OCLASS_POLICY:=0A=20=09=09=09{=0A=20=09=09=09=09Relation=09policy_rel;=0A= @@=20-4547,6=20+4565,10=20@@=20getObjectTypeDescription(const=20= ObjectAddress=20*object,=20bool=20missing_ok)=0A=20=09=09=09= appendStringInfoString(&buffer,=20"event=20trigger");=0A=20=09=09=09= break;=0A=20=0A+=09=09case=20OCLASS_PARAMETER:=0A+=09=09=09= appendStringInfoString(&buffer,=20"parameter");=0A+=09=09=09break;=0A+=0A= =20=09=09case=20OCLASS_POLICY:=0A=20=09=09=09= appendStringInfoString(&buffer,=20"policy");=0A=20=09=09=09break;=0A@@=20= -5693,6=20+5715,30=20@@=20getObjectIdentityParts(const=20ObjectAddress=20= *object,=0A=20=09=09=09=09break;=0A=20=09=09=09}=0A=20=0A+=09=09case=20= OCLASS_PARAMETER:=0A+=09=09=09{=0A+=09=09=09=09HeapTuple=09configTup;=0A= +=09=09=09=09Form_pg_parameter_acl=20configForm;=0A+=09=09=09=09char=09=20= =20=20*namestr;=0A+=0A+=09=09=09=09configTup=20=3D=20= SearchSysCache1(PARAMETEROID,=0A+=09=09=09=09=09=09=09=09=09=09=09= ObjectIdGetDatum(object->objectId));=0A+=09=09=09=09if=20= (!HeapTupleIsValid(configTup))=0A+=09=09=09=09{=0A+=09=09=09=09=09if=20= (!missing_ok)=0A+=09=09=09=09=09=09elog(ERROR,=20"cache=20lookup=20= failed=20for=20parameter=20%u",=0A+=09=09=09=09=09=09=09=20= object->objectId);=0A+=09=09=09=09=09break;=0A+=09=09=09=09}=0A+=09=09=09= =09configForm=20=3D=20(Form_pg_parameter_acl)=20GETSTRUCT(configTup);=0A= +=09=09=09=09namestr=20=3D=20text_to_cstring(&configForm->parameter);=0A= +=09=09=09=09appendStringInfoString(&buffer,=20namestr);=0A+=09=09=09=09= if=20(objname)=0A+=09=09=09=09=09*objname=20=3D=20list_make1(namestr);=0A= +=09=09=09=09ReleaseSysCache(configTup);=0A+=09=09=09=09break;=0A+=09=09=09= }=0A+=0A=20=09=09case=20OCLASS_POLICY:=0A=20=09=09=09{=0A=20=09=09=09=09= Relation=09polDesc;=0Adiff=20--git=20= a/src/backend/catalog/pg_parameter_acl.c=20= b/src/backend/catalog/pg_parameter_acl.c=0Anew=20file=20mode=20100644=0A= index=200000000000..d5aa998a59=0A---=20/dev/null=0A+++=20= b/src/backend/catalog/pg_parameter_acl.c=0A@@=20-0,0=20+1,109=20@@=0A= +/*-----------------------------------------------------------------------= --=0A+=20*=0A+=20*=20pg_parameter_acl.c=0A+=20*=09=20=20routines=20to=20= support=20manipulation=20of=20the=20pg_parameter_acl=20relation=0A+=20*=0A= +=20*=20Portions=20Copyright=20(c)=201996-2021,=20PostgreSQL=20Global=20= Development=20Group=0A+=20*=20Portions=20Copyright=20(c)=201994,=20= Regents=20of=20the=20University=20of=20California=0A+=20*=0A+=20*=0A+=20= *=20IDENTIFICATION=0A+=20*=09=20=20= src/backend/catalog/pg_parameter_acl.c=0A+=20*=0A+=20= *-------------------------------------------------------------------------= =0A+=20*/=0A+#include=20"postgres.h"=0A+=0A+#include=20"access/table.h"=0A= +#include=20"catalog/catalog.h"=0A+#include=20"catalog/indexing.h"=0A= +#include=20"catalog/objectaccess.h"=0A+#include=20= "catalog/pg_namespace.h"=0A+#include=20"catalog/pg_parameter_acl.h"=0A= +#include=20"utils/builtins.h"=0A+#include=20"utils/pg_locale.h"=0A= +#include=20"utils/rel.h"=0A+=0A+=0A+/*=0A+=20*=20ParameterAclCreate=0A+=20= *=0A+=20*=20Add=20a=20new=20tuple=20to=20pg_parameter_acl.=0A+=20*=0A+=20= *=20parameter:=20the=20parameter=20name=20to=20create.=0A+=20*=20= if_not_exists:=20if=20true,=20don't=20fail=20on=20duplicate=20name,=20= but=20rather=20return=0A+=20*=20the=20existing=20entry's=20Oid.=0A+=20*/=0A= +Oid=0A+ParameterAclCreate(const=20char=20*parameter,=20bool=20= if_not_exists)=0A+{=0A+=09Relation=09rel;=0A+=09TupleDesc=09tupDesc;=0A+=09= HeapTuple=09tuple;=0A+=09Datum=09=09values[Natts_pg_parameter_acl];=0A+=09= bool=09=09nulls[Natts_pg_parameter_acl];=0A+=09Oid=09=09=09parameterId;=0A= +=09const=20char=20*canonical;=0A+=0A+=09/*=0A+=09=20*=20Check=20whether=20= a=20parameter=20ACL=20(by=20the=20given=20name=20or=20alias)=20already=0A= +=09=20*=20exists.=0A+=09=20*/=0A+=09parameterId=20=3D=20= get_parameter_oid(parameter,=20true);=0A+=09if=20= (OidIsValid(parameterId))=0A+=09{=0A+=09=09if=20(if_not_exists)=0A+=09=09= =09return=20parameterId;=0A+=09=09ereport(ERROR,=0A+=09=09=09=09= (errcode(ERRCODE_DUPLICATE_OBJECT),=0A+=09=09=09=09=20errmsg("parameter=20= \"%s\"=20already=20exists",=0A+=09=09=09=09=09=09parameter)));=0A+=09}=0A= +=0A+=09/*=0A+=09=20*=20Perform=20a=20basic=20sanity=20check=20of=20the=20= parameter=20name,=20and=20translate=20old=0A+=09=20*=20forms=20of=20= known=20names=20to=20their=20canonical=20forms.=0A+=09=20*=0A+=09=20*=20= If=20you=20deprecate=20a=20configuration=20name=20in=20favor=20of=20a=20= new=20spelling,=20be=0A+=09=20*=20sure=20to=20consider=20whether=20to=20= also=20upgrade=20pg_parameter_acl=20entries.=0A+=09=20*/=0A+=09if=20= (!valid_variable_name(parameter,=20NULL))=0A+=09=09ereport(ERROR,=0A+=09=09= =09=09(errcode(ERRCODE_INVALID_NAME),=0A+=09=09=09=09=20errmsg("invalid=20= parameter=20name=20\"%s\"",=0A+=09=09=09=09=09=09parameter)));=0A+=09= canonical=20=3D=20GetConfigOptionCanonicalName(parameter);=0A+=09if=20= (!canonical)=0A+=09=09canonical=20=3D=20parameter;=0A+=0A+=09/*=0A+=09=20= *=20Create=20and=20insert=20a=20new=20record,=20starting=20with=20a=20= blank=20Acl.=0A+=09=20*=0A+=09=20*=20We=20don't=20take=20a=20strong=20= enough=20lock=20to=20prevent=20concurrent=20insertions,=0A+=09=20*=20= relying=20instead=20on=20the=20unique=20index.=0A+=09=20*/=0A+=09rel=20=3D= =20table_open(ParameterAclRelationId,=20RowExclusiveLock);=0A+=09tupDesc=20= =3D=20RelationGetDescr(rel);=0A+=09MemSet(values,=200,=20= sizeof(values));=0A+=09MemSet(nulls,=20false,=20sizeof(nulls));=0A+=09= values[Anum_pg_parameter_acl_parameter=20-=201]=20=3D=0A+=09=09= DirectFunctionCall1(textin,=20CStringGetDatum(canonical));=0A+=09= parameterId=20=3D=20GetNewOidWithIndex(rel,=0A+=09=09=09=09=09=09=09=09=09= =20=20=20ParameterAclOidIndexId,=0A+=09=09=09=09=09=09=09=09=09=20=20=20= Anum_pg_parameter_acl_oid);=0A+=09values[Anum_pg_parameter_acl_oid=20-=20= 1]=20=3D=20ObjectIdGetDatum(parameterId);=0A+=09= nulls[Anum_pg_parameter_acl_setacl=20-=201]=20=3D=20true;=0A+=09tuple=20= =3D=20heap_form_tuple(tupDesc,=20values,=20nulls);=0A+=09= CatalogTupleInsert(rel,=20tuple);=0A+=0A+=09/*=20Post=20creation=20hook=20= for=20new=20parameter=20*/=0A+=09= InvokeObjectPostCreateHookStr(ParameterAclRelationId,=20parameter,=200);=0A= +=0A+=09/*=0A+=09=20*=20Close=20pg_parameter_acl,=20but=20keep=20lock=20= till=20commit.=0A+=09=20*/=0A+=09heap_freetuple(tuple);=0A+=09= table_close(rel,=20NoLock);=0A+=0A+=09return=20parameterId;=0A+}=0Adiff=20= --git=20a/src/backend/catalog/system_views.sql=20= b/src/backend/catalog/system_views.sql=0Aindex=209eaa51df29..9229d56c8e=20= 100644=0A---=20a/src/backend/catalog/system_views.sql=0A+++=20= b/src/backend/catalog/system_views.sql=0A@@=20-605,6=20+605,19=20@@=20= CREATE=20RULE=20pg_settings_n=20AS=0A=20=0A=20GRANT=20SELECT,=20UPDATE=20= ON=20pg_settings=20TO=20PUBLIC;=0A=20=0A+CREATE=20VIEW=20= pg_parameter_privileges=20AS=0A+=09SELECT=20grantor.rolname=20AS=20= grantor,=0A+=09=09=20=20=20grantee.rolname=20AS=20grantee,=0A+=09=09=20=20= =20set_acl.parameter=20AS=20parameter,=0A+=09=09=20=20=20= acl.privilege_type=20AS=20privilege_type,=0A+=09=09=20=20=20= acl.is_grantable=0A+=09=09FROM=20pg_catalog.pg_parameter_acl=20set_acl,=0A= +=09=09LATERAL=20(SELECT=20*=20FROM=20aclexplode(set_acl.setacl))=20acl=0A= +=09=09LEFT=20JOIN=20pg_catalog.pg_authid=20grantee=20ON=20acl.grantee=20= =3D=20grantee.oid=0A+=09=09LEFT=20JOIN=20pg_catalog.pg_authid=20grantor=20= ON=20acl.grantor=20=3D=20grantor.oid;=0A+=0A+GRANT=20SELECT=20ON=20= pg_parameter_privileges=20TO=20PUBLIC;=0A+=0A=20CREATE=20VIEW=20= pg_file_settings=20AS=0A=20=20=20=20SELECT=20*=20FROM=20= pg_show_all_file_settings()=20AS=20A;=0A=20=0Adiff=20--git=20= a/src/backend/commands/alter.c=20b/src/backend/commands/alter.c=0Aindex=20= 1f64c8aa51..e457cd8816=20100644=0A---=20a/src/backend/commands/alter.c=0A= +++=20b/src/backend/commands/alter.c=0A@@=20-658,6=20+658,7=20@@=20= AlterObjectNamespace_oid(Oid=20classId,=20Oid=20objid,=20Oid=20nspOid,=0A= =20=09=09case=20OCLASS_DEFACL:=0A=20=09=09case=20OCLASS_EXTENSION:=0A=20=09= =09case=20OCLASS_EVENT_TRIGGER:=0A+=09=09case=20OCLASS_PARAMETER:=0A=20=09= =09case=20OCLASS_POLICY:=0A=20=09=09case=20OCLASS_PUBLICATION:=0A=20=09=09= case=20OCLASS_PUBLICATION_NAMESPACE:=0Adiff=20--git=20= a/src/backend/commands/event_trigger.c=20= b/src/backend/commands/event_trigger.c=0Aindex=203c3fc2515b..e02b839421=20= 100644=0A---=20a/src/backend/commands/event_trigger.c=0A+++=20= b/src/backend/commands/event_trigger.c=0A@@=20-937,6=20+937,7=20@@=20= EventTriggerSupportsObjectType(ObjectType=20obtype)=0A=20{=0A=20=09= switch=20(obtype)=0A=20=09{=0A+=09=09case=20OBJECT_PARAMETER:=0A=20=09=09= case=20OBJECT_DATABASE:=0A=20=09=09case=20OBJECT_TABLESPACE:=0A=20=09=09= case=20OBJECT_ROLE:=0A@@=20-1012,6=20+1013,7=20@@=20= EventTriggerSupportsObjectClass(ObjectClass=20objclass)=0A=20{=0A=20=09= switch=20(objclass)=0A=20=09{=0A+=09=09case=20OCLASS_PARAMETER:=0A=20=09=09= case=20OCLASS_DATABASE:=0A=20=09=09case=20OCLASS_TBLSPACE:=0A=20=09=09= case=20OCLASS_ROLE:=0A@@=20-2022,6=20+2024,8=20@@=20= stringify_grant_objtype(ObjectType=20objtype)=0A=20=09{=0A=20=09=09case=20= OBJECT_COLUMN:=0A=20=09=09=09return=20"COLUMN";=0A+=09=09case=20= OBJECT_PARAMETER:=0A+=09=09=09return=20"PARAMETER";=0A=20=09=09case=20= OBJECT_TABLE:=0A=20=09=09=09return=20"TABLE";=0A=20=09=09case=20= OBJECT_SEQUENCE:=0A@@=20-2105,6=20+2109,8=20@@=20= stringify_adefprivs_objtype(ObjectType=20objtype)=0A=20=09{=0A=20=09=09= case=20OBJECT_COLUMN:=0A=20=09=09=09return=20"COLUMNS";=0A+=09=09case=20= OBJECT_PARAMETER:=0A+=09=09=09return=20"PARAMETERS";=0A=20=09=09case=20= OBJECT_TABLE:=0A=20=09=09=09return=20"TABLES";=0A=20=09=09case=20= OBJECT_SEQUENCE:=0Adiff=20--git=20a/src/backend/commands/seclabel.c=20= b/src/backend/commands/seclabel.c=0Aindex=207a62d547e2..73933c5d07=20= 100644=0A---=20a/src/backend/commands/seclabel.c=0A+++=20= b/src/backend/commands/seclabel.c=0A@@=20-67,6=20+67,7=20@@=20= SecLabelSupportsObjectType(ObjectType=20objtype)=0A=20=09=09case=20= OBJECT_ATTRIBUTE:=0A=20=09=09case=20OBJECT_CAST:=0A=20=09=09case=20= OBJECT_COLLATION:=0A+=09=09case=20OBJECT_PARAMETER:=0A=20=09=09case=20= OBJECT_CONVERSION:=0A=20=09=09case=20OBJECT_DEFAULT:=0A=20=09=09case=20= OBJECT_DEFACL:=0Adiff=20--git=20a/src/backend/commands/tablecmds.c=20= b/src/backend/commands/tablecmds.c=0Aindex=2051b4a00d50..9ab5d1b107=20= 100644=0A---=20a/src/backend/commands/tablecmds.c=0A+++=20= b/src/backend/commands/tablecmds.c=0A@@=20-12655,6=20+12655,7=20@@=20= ATExecAlterColumnType(AlteredTableInfo=20*tab,=20Relation=20rel,=0A=20=09= =09=09case=20OCLASS_DEFACL:=0A=20=09=09=09case=20OCLASS_EXTENSION:=0A=20=09= =09=09case=20OCLASS_EVENT_TRIGGER:=0A+=09=09=09case=20OCLASS_PARAMETER:=0A= =20=09=09=09case=20OCLASS_PUBLICATION:=0A=20=09=09=09case=20= OCLASS_PUBLICATION_NAMESPACE:=0A=20=09=09=09case=20= OCLASS_PUBLICATION_REL:=0Adiff=20--git=20a/src/backend/parser/gram.y=20= b/src/backend/parser/gram.y=0Aindex=208ad8512e4c..05d0485576=20100644=0A= ---=20a/src/backend/parser/gram.y=0A+++=20b/src/backend/parser/gram.y=0A= @@=20-371,8=20+371,8=20@@=20static=20Node=20= *makeRecursiveViewSelect(char=20*relname,=20List=20*aliases,=20Node=20= *query);=0A=20%type=20=09=09foreign_server_version=20= opt_foreign_server_version=0A=20%type=20=09=09opt_in_database=0A=20=0A= -%type=20=09=09OptSchemaName=0A-%type=20=09OptSchemaEltList=0A= +%type=20=09=09OptSchemaName=20parameter_name=0A+%type=20=09= OptSchemaEltList=20parameter_target=0A=20=0A=20%type=20=09=09= am_type=0A=20=0A@@=20-796,7=20+796,7=20@@=20static=20Node=20= *makeRecursiveViewSelect(char=20*relname,=20List=20*aliases,=20Node=20= *query);=0A=20=09ORDER=20ORDINALITY=20OTHERS=20OUT_P=20OUTER_P=0A=20=09= OVER=20OVERLAPS=20OVERLAY=20OVERRIDING=20OWNED=20OWNER=0A=20=0A-=09= PARALLEL=20PARSER=20PARTIAL=20PARTITION=20PASSING=20PASSWORD=20PLACING=20= PLANS=20POLICY=0A+=09PARALLEL=20PARAMETER=20PARSER=20PARTIAL=20PARTITION=20= PASSING=20PASSWORD=20PLACING=20PLANS=20POLICY=0A=20=09POSITION=20= PRECEDING=20PRECISION=20PRESERVE=20PREPARE=20PREPARED=20PRIMARY=0A=20=09= PRIOR=20PRIVILEGES=20PROCEDURAL=20PROCEDURE=20PROCEDURES=20PROGRAM=20= PUBLICATION=0A=20=0A@@=20-7070,6=20+7070,20=20@@=20GrantStmt:=09GRANT=20= privileges=20ON=20privilege_target=20TO=20grantee_list=0A=20=09=09=09=09=09= n->grantor=20=3D=20$8;=0A=20=09=09=09=09=09$$=20=3D=20(Node*)n;=0A=20=09=09= =09=09}=0A+=09=09=09|=20GRANT=20privileges=20ON=20PARAMETER=20= parameter_target=20TO=20grantee_list=0A+=09=09=09opt_grant_grant_option=20= opt_granted_by=0A+=09=09=09=09{=0A+=09=09=09=09=09GrantStmt=20*n=20=3D=20= makeNode(GrantStmt);=0A+=09=09=09=09=09n->is_grant=20=3D=20true;=0A+=09=09= =09=09=09n->privileges=20=3D=20$2;=0A+=09=09=09=09=09n->targtype=20=3D=20= ACL_TARGET_OBJECT;=0A+=09=09=09=09=09n->objtype=20=3D=20= OBJECT_PARAMETER;=0A+=09=09=09=09=09n->objects=20=3D=20$5;=0A+=09=09=09=09= =09n->grantees=20=3D=20$7;=0A+=09=09=09=09=09n->grant_option=20=3D=20$8;=0A= +=09=09=09=09=09n->grantor=20=3D=20$9;=0A+=09=09=09=09=09$$=20=3D=20= (Node*)n;=0A+=09=09=09=09}=0A=20=09=09;=0A=20=0A=20RevokeStmt:=0A@@=20= -7103,6=20+7117,36=20@@=20RevokeStmt:=0A=20=09=09=09=09=09n->behavior=20= =3D=20$11;=0A=20=09=09=09=09=09$$=20=3D=20(Node=20*)n;=0A=20=09=09=09=09= }=0A+=09=09=09|=20REVOKE=20privileges=20ON=20PARAMETER=20= parameter_target=20FROM=20grantee_list=0A+=09=09=09opt_granted_by=20= opt_drop_behavior=0A+=09=09=09=09{=0A+=09=09=09=09=09GrantStmt=20*n=20=3D=20= makeNode(GrantStmt);=0A+=09=09=09=09=09n->is_grant=20=3D=20false;=0A+=09=09= =09=09=09n->grant_option=20=3D=20false;=0A+=09=09=09=09=09n->privileges=20= =3D=20$2;=0A+=09=09=09=09=09n->targtype=20=3D=20ACL_TARGET_OBJECT;=0A+=09= =09=09=09=09n->objtype=20=3D=20OBJECT_PARAMETER;=0A+=09=09=09=09=09= n->objects=20=3D=20$5;=0A+=09=09=09=09=09n->grantees=20=3D=20$7;=0A+=09=09= =09=09=09n->grantor=20=3D=20$8;=0A+=09=09=09=09=09n->behavior=20=3D=20= $9;=0A+=09=09=09=09=09$$=20=3D=20(Node=20*)n;=0A+=09=09=09=09}=0A+=09=09=09= |=20REVOKE=20GRANT=20OPTION=20FOR=20privileges=20ON=20PARAMETER=20= parameter_target=0A+=09=09=09FROM=20grantee_list=20opt_granted_by=20= opt_drop_behavior=0A+=09=09=09=09{=0A+=09=09=09=09=09GrantStmt=20*n=20=3D=20= makeNode(GrantStmt);=0A+=09=09=09=09=09n->is_grant=20=3D=20false;=0A+=09=09= =09=09=09n->grant_option=20=3D=20true;=0A+=09=09=09=09=09n->privileges=20= =3D=20$5;=0A+=09=09=09=09=09n->targtype=20=3D=20ACL_TARGET_OBJECT;=0A+=09= =09=09=09=09n->objtype=20=3D=20OBJECT_PARAMETER;=0A+=09=09=09=09=09= n->objects=20=3D=20$8;=0A+=09=09=09=09=09n->grantees=20=3D=20$10;=0A+=09=09= =09=09=09n->grantor=20=3D=20$11;=0A+=09=09=09=09=09n->behavior=20=3D=20= $12;=0A+=09=09=09=09=09$$=20=3D=20(Node=20*)n;=0A+=09=09=09=09}=0A=20=09=09= ;=0A=20=0A=20=0A@@=20-7162,6=20+7206,13=20@@=20privilege:=09SELECT=20= opt_column_list=0A=20=09=09=09=09n->cols=20=3D=20$2;=0A=20=09=09=09=09$$=20= =3D=20n;=0A=20=09=09=09}=0A+=09=09|=20ALTER=20SYSTEM_P=0A+=09=09=09{=0A+=09= =09=09=09AccessPriv=20*n=20=3D=20makeNode(AccessPriv);=0A+=09=09=09=09= n->priv_name=20=3D=20pstrdup("alter=20system");=0A+=09=09=09=09n->cols=20= =3D=20NULL;=0A+=09=09=09=09$$=20=3D=20n;=0A+=09=09=09}=0A=20=09=09|=20= ColId=20opt_column_list=0A=20=09=09=09{=0A=20=09=09=09=09AccessPriv=20*n=20= =3D=20makeNode(AccessPriv);=0A@@=20-7171,6=20+7222,27=20@@=20privilege:=09= SELECT=20opt_column_list=0A=20=09=09=09}=0A=20=09=09;=0A=20=0A= +parameter_target:=0A+=09=09=09parameter_name=0A+=09=09=09=09{=0A+=09=09=09= =09=09$$=20=3D=20list_make1(makeString($1));=0A+=09=09=09=09}=0A+=09=09=09= |=20parameter_target=20','=20parameter_name=0A+=09=09=09=09{=0A+=09=09=09= =09=09$$=20=3D=20lappend($1,=20makeString($3));=0A+=09=09=09=09}=0A+=09=09= ;=0A+=0A+parameter_name:=0A+=09=09=09ColId=0A+=09=09=09=09{=0A+=09=09=09=09= =09$$=20=3D=20$1;=0A+=09=09=09=09}=0A+=09=09=09|=20parameter_name=20'.'=20= ColId=0A+=09=09=09=09{=0A+=09=09=09=09=09$$=20=3D=20psprintf("%s.%s",=20= $1,=20$3);=0A+=09=09=09=09}=0A+=09=09;=0A=20=0A=20/*=20Don't=20bother=20= trying=20to=20fold=20the=20first=20two=20rules=20into=20one=20using=0A=20= =20*=20opt_table.=20=20You're=20going=20to=20get=20conflicts.=0A@@=20= -16713,6=20+16785,7=20@@=20unreserved_keyword:=0A=20=09=09=09|=20OWNED=0A= =20=09=09=09|=20OWNER=0A=20=09=09=09|=20PARALLEL=0A+=09=09=09|=20= PARAMETER=0A=20=09=09=09|=20PARSER=0A=20=09=09=09|=20PARTIAL=0A=20=09=09=09= |=20PARTITION=0A@@=20-17320,6=20+17393,7=20@@=20bare_label_keyword:=0A=20= =09=09=09|=20OWNED=0A=20=09=09=09|=20OWNER=0A=20=09=09=09|=20PARALLEL=0A= +=09=09=09|=20PARAMETER=0A=20=09=09=09|=20PARSER=0A=20=09=09=09|=20= PARTIAL=0A=20=09=09=09|=20PARTITION=0Adiff=20--git=20= a/src/backend/utils/adt/acl.c=20b/src/backend/utils/adt/acl.c=0Aindex=20= 83cf7ac9ff..205bb5f805=20100644=0A---=20a/src/backend/utils/adt/acl.c=0A= +++=20b/src/backend/utils/adt/acl.c=0A@@=20-23,6=20+23,7=20@@=0A=20= #include=20"catalog/pg_authid.h"=0A=20#include=20"catalog/pg_class.h"=0A=20= #include=20"catalog/pg_database.h"=0A+#include=20= "catalog/pg_parameter_acl.h"=0A=20#include=20"catalog/pg_type.h"=0A=20= #include=20"commands/dbcommands.h"=0A=20#include=20"commands/proclang.h"=0A= @@=20-36,6=20+37,7=20@@=0A=20#include=20"utils/array.h"=0A=20#include=20= "utils/builtins.h"=0A=20#include=20"utils/catcache.h"=0A+#include=20= "utils/guc.h"=0A=20#include=20"utils/inval.h"=0A=20#include=20= "utils/lsyscache.h"=0A=20#include=20"utils/memutils.h"=0A@@=20-109,6=20= +111,7=20@@=20static=20Oid=09convert_tablespace_name(text=20= *tablespacename);=0A=20static=20AclMode=20= convert_tablespace_priv_string(text=20*priv_type_text);=0A=20static=20= Oid=09convert_type_name(text=20*typename);=0A=20static=20AclMode=20= convert_type_priv_string(text=20*priv_type_text);=0A+static=20AclMode=20= convert_parameter_priv_string(text=20*priv_parameter_text);=0A=20static=20= AclMode=20convert_role_priv_string(text=20*priv_type_text);=0A=20static=20= AclResult=20pg_role_aclcheck(Oid=20role_oid,=20Oid=20roleid,=20AclMode=20= mode);=0A=20=0A@@=20-306,6=20+309,12=20@@=20aclparse(const=20char=20*s,=20= AclItem=20*aip)=0A=20=09=09=09case=20ACL_CONNECT_CHR:=0A=20=09=09=09=09= read=20=3D=20ACL_CONNECT;=0A=20=09=09=09=09break;=0A+=09=09=09case=20= ACL_SET_CHR:=0A+=09=09=09=09read=20=3D=20ACL_SET;=0A+=09=09=09=09break;=0A= +=09=09=09case=20ACL_ALTER_SYSTEM_CHR:=0A+=09=09=09=09read=20=3D=20= ACL_ALTER_SYSTEM;=0A+=09=09=09=09break;=0A=20=09=09=09case=20'R':=09=09=09= /*=20ignore=20old=20RULE=20privileges=20*/=0A=20=09=09=09=09read=20=3D=20= 0;=0A=20=09=09=09=09break;=0A@@=20-794,6=20+803,10=20@@=20= acldefault(ObjectType=20objtype,=20Oid=20ownerId)=0A=20=09=09=09= world_default=20=3D=20ACL_USAGE;=0A=20=09=09=09owner_default=20=3D=20= ACL_ALL_RIGHTS_TYPE;=0A=20=09=09=09break;=0A+=09=09case=20= OBJECT_PARAMETER:=0A+=09=09=09world_default=20=3D=20ACL_NO_RIGHTS;=0A+=09= =09=09owner_default=20=3D=20ACL_ALL_RIGHTS_PARAMETER;=0A+=09=09=09break;=0A= =20=09=09default:=0A=20=09=09=09elog(ERROR,=20"unrecognized=20objtype:=20= %d",=20(int)=20objtype);=0A=20=09=09=09world_default=20=3D=20= ACL_NO_RIGHTS;=09/*=20keep=20compiler=20quiet=20*/=0A@@=20-838,6=20= +851,41=20@@=20acldefault(ObjectType=20objtype,=20Oid=20ownerId)=0A=20=09= return=20acl;=0A=20}=0A=20=0A+/*=0A+=20*=20aclparameterdefault()=0A+=20*=0A= +=20*=20Creates=20and=20returns=20an=20ACL=20describing=20the=20default=20= access=20permissions=20for=20a=0A+=20*=20parameter,=20taking=20into=20= account=20whether=20it=20is=20a=20PGC_USERSET=20GUC=20parameter.=0A+=20= */=0A+Acl=20*=0A+aclparameterdefault(bool=20is_userset)=0A+{=0A+=09Acl=09= =09=20=20=20*acl;=0A+=0A+=09/*=0A+=09=20*=20Treat=20all=20parameters=20= as=20belonging=20to=20the=20bootstrap=20user.=20=20This=20works=0A+=09=20= *=20better=20than=20passing=20InvalidOid,=20as=20we=20want=20the=20= bootstrap=20user=20to=20retain=0A+=09=20*=20privileges=20even=20after=20= running=20a=20REVOKE=20..=20FROM=20PUBLIC=20on=20a=20default=20ACL.=0A+=09= =20*/=0A+=09acl=20=3D=20acldefault(OBJECT_PARAMETER,=20= BOOTSTRAP_SUPERUSERID);=0A+=0A+=09/*=0A+=09=20*=20Special=20case=20for=20= USERSET=20gucs.=20=20By=20default,=20public=20can=20SET.=0A+=09=20*/=0A+=09= if=20(is_userset)=0A+=09{=0A+=09=09AclItem=20item;=0A+=0A+=09=09= item.ai_grantee=20=3D=20ACL_ID_PUBLIC;=0A+=09=09item.ai_grantor=20=3D=20= BOOTSTRAP_SUPERUSERID;=0A+=09=09item.ai_privs=20=3D=20ACL_SET;=0A+=0A+=09= =09acl=20=3D=20aclupdate(acl,=20&item,=20ACL_MODECHG_ADD,=20= BOOTSTRAP_SUPERUSERID,=0A+=09=09=09=09=09=09DROP_RESTRICT);=0A+=09}=0A+=0A= +=09return=20acl;=0A+}=0A=20=0A=20/*=0A=20=20*=20SQL-accessible=20= version=20of=20acldefault().=20=20Hackish=20mapping=20from=20"char"=20= type=20to=0A@@=20-895,6=20+943,35=20@@=20= acldefault_sql(PG_FUNCTION_ARGS)=0A=20=09= PG_RETURN_ACL_P(acldefault(objtype,=20owner));=0A=20}=0A=20=0A+/*=0A+=20= *=20SQL-accessible=20version=20of=20aclparameterdefault().=0A+=20*/=0A= +Datum=0A+aclparameterdefault_sql(PG_FUNCTION_ARGS)=0A+{=0A+=09const=20= char=20*parameter;=0A+=09GucContext=20context;=0A+=0A+=09parameter=20=3D=20= text_to_cstring(PG_GETARG_TEXT_P(0));=0A+=0A+=09/*=0A+=09=20*=20Look=20= up=20the=20context=20of=20the=20given=20parameter=20so=20we=20know=20= what=20kind=20of=0A+=09=20*=20default=20Acl=20to=20generate.=20=20If=20= we're=20processing=20a=20custom=20parameter=20that=0A+=09=20*=20has=20= not=20been=20created=20yet,=20we=20want=20to=20be=20conservative=20and=20= avoid=20granting=0A+=09=20*=20any=20privileges=20until=20parameter=20= creation=20time,=20at=20which=20point=20the=20context=0A+=09=20*=20will=20= be=20known.=20=20We=20default=20to=20PGC_SUSET=20here,=20and=20let=20the=20= parameter=0A+=09=20*=20creation=20code=20handle=20updating=20the=20Acl=20= to=20include=20grants=20to=20public.=0A+=09=20*=20However,=20if=20this=20= parameter=20already=20exists,=20we=20must=20return=20the=0A+=09=20*=20= appropriate=20default=20Acl=20for=20the=20parameter's=20context.=0A+=09=20= */=0A+=09context=20=3D=20find_option_context(parameter,=20PGC_SUSET);=0A= +=0A+=09/*=0A+=09=20*=20We=20only=20care=20whether=20the=20context=20is=20= PGC_USERSET.=20=20All=20other=20contexts=0A+=09=20*=20have=20no=20= privileges=20granted=20to=20public=20by=20default.=0A+=09=20*/=0A+=09= PG_RETURN_ACL_P(aclparameterdefault(context=20=3D=3D=20PGC_USERSET));=0A= +}=0A=20=0A=20/*=0A=20=20*=20Update=20an=20ACL=20array=20to=20add=20or=20= remove=20specified=20privileges.=0A@@=20-1602,6=20+1679,10=20@@=20= convert_priv_string(text=20*priv_type_text)=0A=20=09=09return=20= ACL_CREATE_TEMP;=0A=20=09if=20(pg_strcasecmp(priv_type,=20"CONNECT")=20= =3D=3D=200)=0A=20=09=09return=20ACL_CONNECT;=0A+=09if=20= (pg_strcasecmp(priv_type,=20"SET")=20=3D=3D=200)=0A+=09=09return=20= ACL_SET;=0A+=09if=20(pg_strcasecmp(priv_type,=20"ALTER=20SYSTEM")=20=3D=3D= =200)=0A+=09=09return=20ACL_ALTER_SYSTEM;=0A=20=09if=20= (pg_strcasecmp(priv_type,=20"RULE")=20=3D=3D=200)=0A=20=09=09return=200;=09= =09=09=09/*=20ignore=20old=20RULE=20privileges=20*/=0A=20=0A@@=20-1698,6=20= +1779,10=20@@=20convert_aclright_to_string(int=20aclright)=0A=20=09=09=09= return=20"TEMPORARY";=0A=20=09=09case=20ACL_CONNECT:=0A=20=09=09=09= return=20"CONNECT";=0A+=09=09case=20ACL_SET:=0A+=09=09=09return=20"SET";=0A= +=09=09case=20ACL_ALTER_SYSTEM:=0A+=09=09=09return=20"ALTER=20SYSTEM";=0A= =20=09=09default:=0A=20=09=09=09elog(ERROR,=20"unrecognized=20aclright:=20= %d",=20aclright);=0A=20=09=09=09return=20NULL;=0A@@=20-4429,6=20= +4514,191=20@@=20convert_type_priv_string(text=20*priv_type_text)=0A=20=09= return=20convert_any_priv_string(priv_type_text,=20type_priv_map);=0A=20= }=0A=20=0A+/*=0A+=20*=20has_parameter_privilege=20variants=0A+=20*=09=09= These=20are=20all=20named=20"has_parameter_privilege"=20at=20the=20SQL=20= level.=0A+=20*=09=09They=20take=20various=20combinations=20of=20= parameter=20name,=20parameter=20OID,=0A+=20*=09=09user=20name,=20user=20= OID,=20or=20implicit=20user=20=3D=20current_user.=0A+=20*=0A+=20*=09=09= The=20result=20is=20a=20boolean=20value:=20true=20if=20user=20has=20the=20= indicated=0A+=20*=09=09privilege,=20false=20if=20not,=20or=20NULL=20if=20= object=20doesn't=20exist.=0A+=20*/=0A+=0A+/*=0A+=20*=20= has_parameter_privilege_name_name=0A+=20*=09=09Check=20user=20privileges=20= on=20a=20parameter=20given=20name=20username,=20text=0A+=20*=09=09= parameter,=20and=20text=20priv=20name.=0A+=20*/=0A+Datum=0A= +has_parameter_privilege_name_name(PG_FUNCTION_ARGS)=0A+{=0A+=09Name=09=09= username=20=3D=20PG_GETARG_NAME(0);=0A+=09text=09=20=20=20*parameter=20=3D= =20PG_GETARG_TEXT_PP(1);=0A+=09text=09=20=20=20*priv_parameter_text=20=3D=20= PG_GETARG_TEXT_PP(2);=0A+=09Oid=09=09=09roleid;=0A+=09Oid=09=09=09= parameteroid;=0A+=09AclMode=09=09mode;=0A+=09AclResult=09aclresult;=0A+=0A= +=09roleid=20=3D=20get_role_oid_or_public(NameStr(*username));=0A+=0A+=09= parameteroid=20=3D=20get_parameter_oid(text_to_cstring(parameter),=20= true);=0A+=09if=20(!OidIsValid(parameteroid))=0A+=09=09PG_RETURN_NULL();=0A= +=09mode=20=3D=20convert_parameter_priv_string(priv_parameter_text);=0A+=0A= +=09aclresult=20=3D=20pg_parameter_acl_aclcheck(parameteroid,=20roleid,=20= mode);=0A+=0A+=09PG_RETURN_BOOL(aclresult=20=3D=3D=20ACLCHECK_OK);=0A+}=0A= +=0A+/*=0A+=20*=20has_parameter_privilege_name=0A+=20*=09=09Check=20user=20= privileges=20on=20a=20parameter=20given=20text=20parameter=20and=20text=20= priv=0A+=20*=09=09name.=20=20current_user=20is=20assumed=0A+=20*/=0A= +Datum=0A+has_parameter_privilege_name(PG_FUNCTION_ARGS)=0A+{=0A+=09text=09= =20=20=20*parameter=20=3D=20PG_GETARG_TEXT_PP(0);=0A+=09text=09=20=20=20= *priv_parameter_text=20=3D=20PG_GETARG_TEXT_PP(1);=0A+=09Oid=09=09=09= roleid;=0A+=09Oid=09=09=09parameteroid;=0A+=09AclMode=09=09mode;=0A+=09= AclResult=09aclresult;=0A+=0A+=09roleid=20=3D=20GetUserId();=0A+=09= parameteroid=20=3D=20get_parameter_oid(text_to_cstring(parameter),=20= true);=0A+=09if=20(!OidIsValid(parameteroid))=0A+=09=09PG_RETURN_NULL();=0A= +=09mode=20=3D=20convert_parameter_priv_string(priv_parameter_text);=0A+=0A= +=09aclresult=20=3D=20pg_parameter_acl_aclcheck(parameteroid,=20roleid,=20= mode);=0A+=0A+=09PG_RETURN_BOOL(aclresult=20=3D=3D=20ACLCHECK_OK);=0A+}=0A= +=0A+/*=0A+=20*=20has_parameter_privilege_name_id=0A+=20*=09=09Check=20= user=20privileges=20on=20a=20parameter=20given=20name=20usename,=20= parameter=20oid,=0A+=20*=09=09and=20text=20priv=20name.=0A+=20*/=0A= +Datum=0A+has_parameter_privilege_name_id(PG_FUNCTION_ARGS)=0A+{=0A+=09= Name=09=09username=20=3D=20PG_GETARG_NAME(0);=0A+=09Oid=09=09=09= parameteroid=20=3D=20PG_GETARG_OID(1);=0A+=09text=09=20=20=20= *priv_parameter_text=20=3D=20PG_GETARG_TEXT_PP(2);=0A+=09Oid=09=09=09= roleid;=0A+=09AclMode=09=09mode;=0A+=09AclResult=09aclresult;=0A+=0A+=09= roleid=20=3D=20get_role_oid_or_public(NameStr(*username));=0A+=09mode=20= =3D=20convert_parameter_priv_string(priv_parameter_text);=0A+=0A+=09if=20= (!SearchSysCacheExists1(PARAMETEROID,=20ObjectIdGetDatum(parameteroid)))=0A= +=09=09PG_RETURN_NULL();=0A+=0A+=09aclresult=20=3D=20= pg_parameter_acl_aclcheck(parameteroid,=20roleid,=20mode);=0A+=0A+=09= PG_RETURN_BOOL(aclresult=20=3D=3D=20ACLCHECK_OK);=0A+}=0A+=0A+/*=0A+=20*=20= has_parameter_privilege_id=0A+=20*=09=09Check=20user=20privileges=20on=20= a=20parameter=20given=20parameter=20oid,=20and=20text=20priv=0A+=20*=09=09= name.=20=20current_user=20is=20assumed.=0A+=20*/=0A+Datum=0A= +has_parameter_privilege_id(PG_FUNCTION_ARGS)=0A+{=0A+=09Oid=09=09=09= parameteroid=20=3D=20PG_GETARG_OID(0);=0A+=09text=09=20=20=20= *priv_parameter_text=20=3D=20PG_GETARG_TEXT_PP(1);=0A+=09Oid=09=09=09= roleid;=0A+=09AclMode=09=09mode;=0A+=09AclResult=09aclresult;=0A+=0A+=09= roleid=20=3D=20GetUserId();=0A+=09mode=20=3D=20= convert_parameter_priv_string(priv_parameter_text);=0A+=0A+=09if=20= (!SearchSysCacheExists1(PARAMETEROID,=20ObjectIdGetDatum(parameteroid)))=0A= +=09=09PG_RETURN_NULL();=0A+=0A+=09aclresult=20=3D=20= pg_parameter_acl_aclcheck(parameteroid,=20roleid,=20mode);=0A+=0A+=09= PG_RETURN_BOOL(aclresult=20=3D=3D=20ACLCHECK_OK);=0A+}=0A+=0A+/*=0A+=20*=20= has_parameter_privilege_id_name=0A+=20*=09=09Check=20user=20privileges=20= on=20a=20parameter=20given=20roleid,=20text=20parameter,=20and=0A+=20*=09= =09text=20priv=20name.=0A+=20*/=0A+Datum=0A= +has_parameter_privilege_id_name(PG_FUNCTION_ARGS)=0A+{=0A+=09Oid=09=09=09= roleid=20=3D=20PG_GETARG_OID(0);=0A+=09text=09=20=20=20*parameter=20=3D=20= PG_GETARG_TEXT_PP(1);=0A+=09text=09=20=20=20*priv_parameter_text=20=3D=20= PG_GETARG_TEXT_PP(2);=0A+=09Oid=09=09=09parameteroid;=0A+=09AclMode=09=09= mode;=0A+=09AclResult=09aclresult;=0A+=0A+=09parameteroid=20=3D=20= get_parameter_oid(text_to_cstring(parameter),=20true);=0A+=09if=20= (!OidIsValid(parameteroid))=0A+=09=09PG_RETURN_NULL();=0A+=09mode=20=3D=20= convert_parameter_priv_string(priv_parameter_text);=0A+=0A+=09aclresult=20= =3D=20pg_parameter_acl_aclcheck(parameteroid,=20roleid,=20mode);=0A+=0A+=09= PG_RETURN_BOOL(aclresult=20=3D=3D=20ACLCHECK_OK);=0A+}=0A+=0A+/*=0A+=20*=20= has_parameter_privilege_id_id=0A+=20*=09=09Check=20user=20privileges=20= on=20a=20parameter=20given=20roleid,=20parameter=20oid,=20and=0A+=20*=09=09= text=20priv=20name.=0A+=20*/=0A+Datum=0A= +has_parameter_privilege_id_id(PG_FUNCTION_ARGS)=0A+{=0A+=09Oid=09=09=09= roleid=20=3D=20PG_GETARG_OID(0);=0A+=09Oid=09=09=09parameteroid=20=3D=20= PG_GETARG_OID(1);=0A+=09text=09=20=20=20*priv_parameter_text=20=3D=20= PG_GETARG_TEXT_PP(2);=0A+=09AclMode=09=09mode;=0A+=09AclResult=09= aclresult;=0A+=0A+=09mode=20=3D=20= convert_parameter_priv_string(priv_parameter_text);=0A+=0A+=09if=20= (!SearchSysCacheExists1(PARAMETEROID,=20ObjectIdGetDatum(parameteroid)))=0A= +=09=09PG_RETURN_NULL();=0A+=0A+=09aclresult=20=3D=20= pg_parameter_acl_aclcheck(parameteroid,=20roleid,=20mode);=0A+=0A+=09= PG_RETURN_BOOL(aclresult=20=3D=3D=20ACLCHECK_OK);=0A+}=0A+=0A+/*=0A+=20*=09= =09Support=20routines=20for=20has_parameter_privilege=20family.=0A+=20*/=0A= +=0A+/*=0A+=20*=20convert_parameter_priv_string=0A+=20*=09=09Convert=20= text=20string=20to=20AclMode=20value.=0A+=20*/=0A+static=20AclMode=0A= +convert_parameter_priv_string(text=20*priv_parameter_text)=0A+{=0A+=09= static=20const=20priv_map=20parameter_priv_map[]=20=3D=20{=0A+=09=09= {"SET",=20ACL_SET},=0A+=09=09{"SET=20WITH=20GRANT=20OPTION",=20= ACL_GRANT_OPTION_FOR(ACL_SET)},=0A+=09=09{"ALTER=20SYSTEM",=20= ACL_ALTER_SYSTEM},=0A+=09=09{"ALTER=20SYSTEM=20WITH=20GRANT=20OPTION",=20= ACL_GRANT_OPTION_FOR(ACL_ALTER_SYSTEM)},=0A+=09=09{NULL,=200}=0A+=09};=0A= +=0A+=09return=20convert_any_priv_string(priv_parameter_text,=20= parameter_priv_map);=0A+}=0A=20=0A=20/*=0A=20=20*=20pg_has_role=20= variants=0A@@=20-4665,6=20+4935,43=20@@=20initialize_acl(void)=0A=20=09}=0A= =20}=0A=20=0A+/*=0A+=20*=20get_parameter_oid=20-=20Given=20a=20= configuration=20parameter=20name,=20look=20up=20the=0A+=20*=20= configuration=20parameter's=20OID.=20=20Note=20that=20names=20which=20= are=20aliases=20for=0A+=20*=20a=20canonical=20name=20will=20be=20= translated=20automatically=20and=20the=20OID=20found.=0A+=20*=0A+=20*=20= If=20missing_ok=20is=20false,=20throw=20an=20error=20if=20the=20= configuration=20parameter=20name=0A+=20*=20is=20not=20found.=0A+=20*=0A+=20= *=20Returns=20the=20Oid=20of=20the=20configuration=20parameter.=0A+=20*/=0A= +Oid=0A+get_parameter_oid(const=20char=20*parameter,=20bool=20= missing_ok)=0A+{=0A+=09Oid=09=09=09oid;=0A+=0A+=09/*=20Check=20for=20the=20= variable=20by=20the=20name=20we=20were=20given=20*/=0A+=09oid=20=3D=20= GetSysCacheOid1(PARAMETERNAME,=20Anum_pg_parameter_acl_oid,=0A+=09=09=09=09= =09=09=20=20PointerGetDatum(cstring_to_text(parameter)));=0A+=09if=20= (!OidIsValid(oid))=0A+=09{=0A+=09=09const=20char=20*canonical;=0A+=0A+=09= =09/*=20Check=20if=20the=20variable=20has=20a=20different=20canonical=20= spelling=20*/=0A+=09=09canonical=20=3D=20= GetConfigOptionCanonicalName(parameter);=0A+=09=09if=20(canonical=20!=3D=20= NULL)=0A+=09=09=09oid=20=3D=20GetSysCacheOid1(PARAMETERNAME,=20= Anum_pg_parameter_acl_oid,=0A+=09=09=09=09=09=09=09=09=20=20= PointerGetDatum(cstring_to_text(canonical)));=0A+=0A+=09=09if=20= (!OidIsValid(oid)=20&&=20!missing_ok)=0A+=09=09=09ereport(ERROR,=0A+=09=09= =09=09=09(errcode(ERRCODE_UNDEFINED_OBJECT),=0A+=09=09=09=09=09=20= errmsg("parameter=20\"%s\"=20does=20not=20exist",=20parameter)));=0A+=09= }=0A+=0A+=09return=20oid;=0A+}=0A+=0A=20/*=0A=20=20*=20= RoleMembershipCacheCallback=0A=20=20*=09=09Syscache=20inval=20callback=20= function=0Adiff=20--git=20a/src/backend/utils/cache/lsyscache.c=20= b/src/backend/utils/cache/lsyscache.c=0Aindex=201b7e11b93e..8c669680e3=20= 100644=0A---=20a/src/backend/utils/cache/lsyscache.c=0A+++=20= b/src/backend/utils/cache/lsyscache.c=0A@@=20-32,6=20+32,7=20@@=0A=20= #include=20"catalog/pg_operator.h"=0A=20#include=20"catalog/pg_proc.h"=0A= =20#include=20"catalog/pg_range.h"=0A+#include=20= "catalog/pg_parameter_acl.h"=0A=20#include=20"catalog/pg_statistic.h"=0A=20= #include=20"catalog/pg_transform.h"=0A=20#include=20"catalog/pg_type.h"=0A= @@=20-3314,6=20+3315,25=20@@=20free_attstatsslot(AttStatsSlot=20*sslot)=0A= =20=09=09pfree(sslot->numbers_arr);=0A=20}=0A=20=0A+char=20*=0A= +get_parameter_name(Oid=20configid)=0A+{=0A+=09HeapTuple=09tp;=0A+=0A+=09= tp=20=3D=20SearchSysCache1(PARAMETEROID,=20ObjectIdGetDatum(configid));=0A= +=09if=20(HeapTupleIsValid(tp))=0A+=09{=0A+=09=09Form_pg_parameter_acl=20= configtup=20=3D=20(Form_pg_parameter_acl)=20GETSTRUCT(tp);=0A+=09=09char=09= =20=20=20*result;=0A+=0A+=09=09result=20=3D=20= pstrdup(text_to_cstring(&configtup->parameter));=0A+=09=09= ReleaseSysCache(tp);=0A+=09=09return=20result;=0A+=09}=0A+=09else=0A+=09=09= return=20NULL;=0A+}=0A+=0A=20/*=09=09=09=09----------=20PG_NAMESPACE=20= CACHE=20----------=09=09=09=09=20*/=0A=20=0A=20/*=0Adiff=20--git=20= a/src/backend/utils/cache/syscache.c=20= b/src/backend/utils/cache/syscache.c=0Aindex=20a675877d19..0fe94e8339=20= 100644=0A---=20a/src/backend/utils/cache/syscache.c=0A+++=20= b/src/backend/utils/cache/syscache.c=0A@@=20-57,6=20+57,7=20@@=0A=20= #include=20"catalog/pg_rewrite.h"=0A=20#include=20= "catalog/pg_seclabel.h"=0A=20#include=20"catalog/pg_sequence.h"=0A= +#include=20"catalog/pg_parameter_acl.h"=0A=20#include=20= "catalog/pg_shdepend.h"=0A=20#include=20"catalog/pg_shdescription.h"=0A=20= #include=20"catalog/pg_shseclabel.h"=0A@@=20-574,6=20+575,28=20@@=20= static=20const=20struct=20cachedesc=20cacheinfo[]=20=3D=20{=0A=20=09=09= },=0A=20=09=098=0A=20=09},=0A+=09{ParameterAclRelationId,=09=09/*=20= PARAMETERNAME=20*/=0A+=09=09ParameterAclParameterIndexId,=0A+=09=091,=0A= +=09=09{=0A+=09=09=09Anum_pg_parameter_acl_parameter,=0A+=09=09=090,=0A+=09= =09=090,=0A+=09=09=090=0A+=09=09},=0A+=09=094=0A+=09},=0A+=09= {ParameterAclRelationId,=09=09/*=20PARAMETEROID=20*/=0A+=09=09= ParameterAclOidIndexId,=0A+=09=091,=0A+=09=09{=0A+=09=09=09= Anum_pg_parameter_acl_oid,=0A+=09=09=090,=0A+=09=09=090,=0A+=09=09=090=0A= +=09=09},=0A+=09=094=0A+=09},=0A=20=09{PartitionedRelationId,=09=09/*=20= PARTRELID=20*/=0A=20=09=09PartitionedRelidIndexId,=0A=20=09=091,=0Adiff=20= --git=20a/src/backend/utils/misc/guc-file.l=20= b/src/backend/utils/misc/guc-file.l=0Aindex=20c70543fa74..a61fec4b40=20= 100644=0A---=20a/src/backend/utils/misc/guc-file.l=0A+++=20= b/src/backend/utils/misc/guc-file.l=0A@@=20-282,7=20+282,7=20@@=20= ProcessConfigFileInternal(GucContext=20context,=20bool=20applySettings,=20= int=20elevel)=0A=20=09=09=20*=20Try=20to=20find=20the=20variable;=20but=20= do=20not=20create=20a=20custom=20placeholder=20if=0A=20=09=09=20*=20it's=20= not=20there=20already.=0A=20=09=09=20*/=0A-=09=09record=20=3D=20= find_option(item->name,=20false,=20true,=20elevel);=0A+=09=09record=20=3D=20= find_option(item->name,=20true,=20elevel);=0A=20=0A=20=09=09if=20= (record)=0A=20=09=09{=0Adiff=20--git=20a/src/backend/utils/misc/guc.c=20= b/src/backend/utils/misc/guc.c=0Aindex=20eb3a03b976..4b49449937=20100644=0A= ---=20a/src/backend/utils/misc/guc.c=0A+++=20= b/src/backend/utils/misc/guc.c=0A@@=20-45,6=20+45,7=20@@=0A=20#include=20= "catalog/namespace.h"=0A=20#include=20"catalog/objectaccess.h"=0A=20= #include=20"catalog/pg_authid.h"=0A+#include=20= "catalog/pg_parameter_acl.h"=0A=20#include=20"catalog/storage.h"=0A=20= #include=20"commands/async.h"=0A=20#include=20"commands/prepare.h"=0A@@=20= -5069,6=20+5070,10=20@@=20static=20struct=20config_enum=20= ConfigureNamesEnum[]=20=3D=0A=20=20*=20the=20following=20mappings=20to=20= any=20unrecognized=20name.=20=20Note=20that=20an=20old=20name=0A=20=20*=20= should=20be=20mapped=20to=20a=20new=20one=20only=20if=20the=20new=20= variable=20has=20very=20similar=0A=20=20*=20semantics=20to=20the=20old.=0A= +=20*=0A+=20*=20If=20you=20deprecate=20a=20name=20in=20favor=20of=20a=20= new=20spelling,=20be=20sure=20to=20consider=20what=0A+=20*=20upgrade=20= support=20will=20be=20needed,=20if=20any,=20for=20existing=20= pg_parameter_acl=0A+=20*=20entries.=0A=20=20*/=0A=20static=20const=20= char=20*const=20map_old_guc_names[]=20=3D=20{=0A=20=09"sort_mem",=20= "work_mem",=0A@@=20-5468,25=20+5473,29=20@@=20add_guc_variable(struct=20= config_generic=20*var,=20int=20elevel)=0A=20}=0A=20=0A=20/*=0A-=20*=20= Decide=20whether=20a=20proposed=20custom=20variable=20name=20is=20= allowed.=0A+=20*=20Decide=20whether=20a=20proposed=20variable=20name=20= is=20allowed.=0A=20=20*=0A-=20*=20It=20must=20be=20two=20or=20more=20= identifiers=20separated=20by=20dots,=20where=20the=20rules=0A-=20*=20for=20= what=20is=20an=20identifier=20agree=20with=20scan.l.=20=20(If=20you=20= change=20this=20rule,=0A-=20*=20adjust=20the=20errdetail=20in=20= find_option().)=0A+=20*=20It=20must=20be=20one=20or=20more=20identifiers=20= separated=20by=20zero=20or=20more=20dots,=20where=20the=0A+=20*=20rules=20= for=20what=20is=20an=20identifier=20agree=20with=20scan.l.=20=20(If=20= you=20change=20this=0A+=20*=20rule,=20adjust=20the=20errdetail=20in=20= find_option_internal().)=0A+=20*=0A+=20*=20partcnt:=20returns=20by=20= reference=20the=20number=20of=20dot=20separated=20identifiers.=0A=20=20= */=0A-static=20bool=0A-valid_custom_variable_name(const=20char=20*name)=0A= +bool=0A+valid_variable_name(const=20char=20*name,=20int=20*partcnt)=0A=20= {=0A-=09bool=09=09saw_sep=20=3D=20false;=0A+=09int=09=09=09parts=20=3D=20= 1;=0A=20=09bool=09=09name_start=20=3D=20true;=0A=20=0A+=09if=20(partcnt)=0A= +=09=09*partcnt=20=3D=20-1;=0A=20=09for=20(const=20char=20*p=20=3D=20= name;=20*p;=20p++)=0A=20=09{=0A=20=09=09if=20(*p=20=3D=3D=20= GUC_QUALIFIER_SEPARATOR)=0A=20=09=09{=0A=20=09=09=09if=20(name_start)=0A=20= =09=09=09=09return=20false;=09/*=20empty=20name=20component=20*/=0A-=09=09= =09saw_sep=20=3D=20true;=0A+=09=09=09parts++;=0A=20=09=09=09name_start=20= =3D=20true;=0A=20=09=09}=0A=20=09=09else=20if=20= (strchr("ABCDEFGHIJKLMNOPQRSTUVWXYZ"=0A@@=20-5503,15=20+5512,34=20@@=20= valid_custom_variable_name(const=20char=20*name)=0A=20=09}=0A=20=09if=20= (name_start)=0A=20=09=09return=20false;=09=09=09/*=20empty=20name=20= component=20*/=0A-=09/*=20OK=20if=20we=20found=20at=20least=20one=20= separator=20*/=0A-=09return=20saw_sep;=0A+=09if=20(partcnt)=0A+=09=09= *partcnt=20=3D=20parts;=0A+=09return=20true;=0A=20}=0A=20=0A+=0A=20/*=0A= -=20*=20Create=20and=20add=20a=20placeholder=20variable=20for=20a=20= custom=20variable=20name.=0A+=20*=20Decide=20whether=20a=20proposed=20= custom=20variable=20name=20is=20allowed.=0A+=20*=0A+=20*=20It=20must=20= be=20two=20or=20more=20identifiers=20separated=20by=20dots,=20where=20= the=20rules=0A+=20*=20for=20what=20is=20an=20identifier=20agree=20with=20= scan.l.=20=20(If=20you=20change=20this=20rule,=0A+=20*=20adjust=20the=20= errdetail=20in=20find_option_internal().)=0A+=20*/=0A+static=20bool=0A= +valid_custom_variable_name(const=20char=20*name)=0A+{=0A+=09int=09=09=09= partcnt;=0A+=0A+=09return=20(valid_variable_name(name,=20&partcnt)=20&&=20= partcnt=20>=201);=0A+}=0A+=0A+/*=0A+=20*=20Create=20and=20add=20a=20= placeholder=20variable=20for=20a=20custom=20variable=20name=0A+=20*=20in=20= the=20given=20context.=0A=20=20*/=0A=20static=20struct=20config_generic=20= *=0A-add_placeholder_variable(const=20char=20*name,=20int=20elevel)=0A= +add_placeholder_variable(const=20char=20*name,=20GucContext=20= placeholder_context,=0A+=09=09=09=09=09=09=20int=20elevel)=0A=20{=0A=20=09= size_t=09=09sz=20=3D=20sizeof(struct=20config_string)=20+=20sizeof(char=20= *);=0A=20=09struct=20config_string=20*var;=0A@@=20-5530,7=20+5558,7=20@@=20= add_placeholder_variable(const=20char=20*name,=20int=20elevel)=0A=20=09=09= return=20NULL;=0A=20=09}=0A=20=0A-=09gen->context=20=3D=20PGC_USERSET;=0A= +=09gen->context=20=3D=20placeholder_context;=0A=20=09gen->group=20=3D=20= CUSTOM_OPTIONS;=0A=20=09gen->short_desc=20=3D=20"GUC=20placeholder=20= variable";=0A=20=09gen->flags=20=3D=20GUC_NO_SHOW_ALL=20|=20= GUC_NOT_IN_SAMPLE=20|=20GUC_CUSTOM_PLACEHOLDER;=0A@@=20-5555,11=20= +5583,12=20@@=20add_placeholder_variable(const=20char=20*name,=20int=20= elevel)=0A=20=0A=20/*=0A=20=20*=20Look=20up=20option=20"name".=20=20If=20= it=20exists,=20return=20a=20pointer=20to=20its=20record.=0A-=20*=20= Otherwise,=20if=20create_placeholders=20is=20true=20and=20name=20is=20a=20= valid-looking=0A-=20*=20custom=20variable=20name,=20we'll=20create=20and=20= return=20a=20placeholder=20record.=0A-=20*=20Otherwise,=20if=20= skip_errors=20is=20true,=20then=20we=20silently=20return=20NULL=20for=0A= -=20*=20an=20unrecognized=20or=20invalid=20name.=20=20Otherwise,=20the=20= error=20is=20reported=20at=0A-=20*=20error=20level=20elevel=20(and=20we=20= return=20NULL=20if=20that's=20less=20than=20ERROR).=0A+=20*=20Otherwise,=20= if=20create_placeholders=20is=20true=20and=20name=20is=20a=20= valid-looking=20custom=0A+=20*=20variable=20name,=20we'll=20create=20and=20= return=20a=20placeholder=20record=20with=20the=20given=0A+=20*=20= placeholder=20context.=20=20Otherwise,=20if=20skip_errors=20is=20true,=20= then=20we=20silently=0A+=20*=20return=20NULL=20for=20an=20unrecognized=20= or=20invalid=20name.=20=20Otherwise,=20the=20error=20is=0A+=20*=20= reported=20at=20error=20level=20elevel=20(and=20we=20return=20NULL=20if=20= that's=20less=20than=0A+=20*=20ERROR).=0A=20=20*=0A=20=20*=20Note:=20= internal=20errors,=20primarily=20out-of-memory,=20draw=20an=20= elevel-level=0A=20=20*=20report=20and=20NULL=20return=20regardless=20of=20= skip_errors.=20=20Hence,=20callers=20must=0A@@=20-5569,8=20+5598,9=20@@=20= add_placeholder_variable(const=20char=20*name,=20int=20elevel)=0A=20=20*=20= false=20need=20not=20think=20terribly=20hard=20about=20this.)=0A=20=20*/=0A= =20static=20struct=20config_generic=20*=0A-find_option(const=20char=20= *name,=20bool=20create_placeholders,=20bool=20skip_errors,=0A-=09=09=09= int=20elevel)=0A+find_option_internal(const=20char=20*name,=20bool=20= create_placeholders,=0A+=09=09=09=09=09=20GucContext=20= placeholder_context,=20bool=20skip_errors,=0A+=09=09=09=09=09=20int=20= elevel)=0A=20{=0A=20=09const=20char=20**key=20=3D=20&name;=0A=20=09= struct=20config_generic=20**res;=0A@@=20-5598,8=20+5628,8=20@@=20= find_option(const=20char=20*name,=20bool=20create_placeholders,=20bool=20= skip_errors,=0A=20=09for=20(i=20=3D=200;=20map_old_guc_names[i]=20!=3D=20= NULL;=20i=20+=3D=202)=0A=20=09{=0A=20=09=09if=20(guc_name_compare(name,=20= map_old_guc_names[i])=20=3D=3D=200)=0A-=09=09=09return=20= find_option(map_old_guc_names[i=20+=201],=20false,=0A-=09=09=09=09=09=09=09= =20=20=20skip_errors,=20elevel);=0A+=09=09=09return=20= find_option_internal(map_old_guc_names[i=20+=201],=20false,=0A+=09=09=09=09= =09=09=09=20=20=20placeholder_context,=20skip_errors,=20elevel);=0A=20=09= }=0A=20=0A=20=09if=20(create_placeholders)=0A@@=20-5646,7=20+5676,7=20@@=20= find_option(const=20char=20*name,=20bool=20create_placeholders,=20bool=20= skip_errors,=0A=20=09=09=09=09}=0A=20=09=09=09}=0A=20=09=09=09/*=20OK,=20= create=20it=20*/=0A-=09=09=09return=20add_placeholder_variable(name,=20= elevel);=0A+=09=09=09return=20add_placeholder_variable(name,=20= placeholder_context,=20elevel);=0A=20=09=09}=0A=20=09}=0A=20=0A@@=20= -5659,6=20+5689,19=20@@=20find_option(const=20char=20*name,=20bool=20= create_placeholders,=20bool=20skip_errors,=0A=20=09return=20NULL;=0A=20}=0A= =20=0A+static=20struct=20config_generic=20*=0A+find_option(const=20char=20= *name,=20bool=20skip_errors,=20int=20elevel)=0A+{=0A+=09return=20= find_option_internal(name,=20false,=20PGC_USERSET,=20skip_errors,=20= elevel);=0A+}=0A+=0A+static=20struct=20config_generic=20*=0A= +find_or_create_option(const=20char=20*name,=20GucContext=20= placeholder_context,=0A+=09=09=09=09=09=20=20bool=20skip_errors,=20int=20= elevel)=0A+{=0A+=09return=20find_option_internal(name,=20true,=20= placeholder_context,=20skip_errors,=0A+=09=09=09=09=09=09=09=09elevel);=0A= +}=0A=20=0A=20/*=0A=20=20*=20comparator=20for=20qsorting=20and=20= bsearching=20guc_variables=20array=0A@@=20-6673,7=20+6716,7=20@@=20= ReportChangedGUCOptions(void)=0A=20=09{=0A=20=09=09struct=20= config_generic=20*record;=0A=20=0A-=09=09record=20=3D=20= find_option("in_hot_standby",=20false,=20false,=20ERROR);=0A+=09=09= record=20=3D=20find_option("in_hot_standby",=20false,=20ERROR);=0A=20=09=09= Assert(record=20!=3D=20NULL);=0A=20=09=09record->status=20|=3D=20= GUC_NEEDS_REPORT;=0A=20=09=09report_needed=20=3D=20true;=0A@@=20-7447,7=20= +7490,7=20@@=20set_config_option(const=20char=20*name,=20const=20char=20= *value,=0A=20=09=09=09=09(errcode(ERRCODE_INVALID_TRANSACTION_STATE),=0A=20= =09=09=09=09=20errmsg("cannot=20set=20parameters=20during=20a=20parallel=20= operation")));=0A=20=0A-=09record=20=3D=20find_option(name,=20true,=20= false,=20elevel);=0A+=09record=20=3D=20find_or_create_option(name,=20= PGC_USERSET,=20false,=20elevel);=0A=20=09if=20(record=20=3D=3D=20NULL)=0A= =20=09=09return=200;=0A=20=0A@@=20-7558,6=20+7601,24=20@@=20= set_config_option(const=20char=20*name,=20const=20char=20*value,=0A=20=09= =09case=20PGC_SUSET:=0A=20=09=09=09if=20(context=20=3D=3D=20PGC_USERSET=20= ||=20context=20=3D=3D=20PGC_BACKEND)=0A=20=09=09=09{=0A+=09=09=09=09/*=0A= +=09=09=09=09=20*=20Check=20whether=20the=20current=20user=20has=20= granted=20privilege=20to=20set=0A+=09=09=09=09=20*=20this=20GUC.=0A+=09=09= =09=09=20*/=0A+=09=09=09=09Oid=09=09=09parameterId=20=3D=20= get_parameter_oid(name,=20true);=0A+=0A+=09=09=09=09if=20= (OidIsValid(parameterId))=0A+=09=09=09=09{=0A+=09=09=09=09=09AclResult=09= aclresult;=0A+=0A+=09=09=09=09=09aclresult=20=3D=20= pg_parameter_acl_aclcheck(parameterId,=20GetUserId(),=0A+=09=09=09=09=09=09= =09=09=09=09=09=09=09=09ACL_SET);=0A+=0A+=09=09=09=09=09if=20(aclresult=20= =3D=3D=20ACLCHECK_OK)=0A+=09=09=09=09=09=09break;=09=09/*=20okay=20*/=0A= +=09=09=09=09}=0A+=0A+=09=09=09=09/*=20No=20granted=20privilege=20*/=0A=20= =09=09=09=09ereport(elevel,=0A=20=09=09=09=09=09=09= (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),=0A=20=09=09=09=09=09=09=20= errmsg("permission=20denied=20to=20set=20parameter=20\"%s\"",=0A@@=20= -7566,7=20+7627,35=20@@=20set_config_option(const=20char=20*name,=20= const=20char=20*value,=0A=20=09=09=09}=0A=20=09=09=09break;=0A=20=09=09= case=20PGC_USERSET:=0A-=09=09=09/*=20always=20okay=20*/=0A+=09=09=09if=20= (context=20=3D=3D=20PGC_USERSET)=0A+=09=09=09{=0A+=09=09=09=09/*=0A+=09=09= =09=09=20*=20If=20this=20GUC=20parameter=20has=20an=20entry=20in=20= pg_parameter_acl,=20then=20the=0A+=09=09=09=09=20*=20current=20user=20= must=20have=20privileges=20per=20the=20acl=20to=20set=20this=20guc.=0A+=09= =09=09=09=20*=20Otherwise,=20all=20users=20are=20implicitly=20allowed=20= to=20set=20it.=0A+=09=09=09=09=20*/=0A+=09=09=09=09Oid=09=09=09= parameterId=20=3D=20get_parameter_oid(name,=20true);=0A+=0A+=09=09=09=09= if=20(OidIsValid(parameterId))=0A+=09=09=09=09{=0A+=09=09=09=09=09= AclResult=09aclresult;=0A+=0A+=09=09=09=09=09aclresult=20=3D=20= pg_parameter_acl_aclcheck(parameterId,=20GetUserId(),=0A+=09=09=09=09=09=09= =09=09=09=09=09=09=09=09ACL_SET);=0A+=0A+=09=09=09=09=09if=20(aclresult=20= =3D=3D=20ACLCHECK_OK)=0A+=09=09=09=09=09=09break;=09=09/*=20okay=20*/=0A= +=0A+=09=09=09=09=09/*=20No=20granted=20privilege=20*/=0A+=09=09=09=09=09= ereport(elevel,=0A+=09=09=09=09=09=09=09= (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),=0A+=09=09=09=09=09=09=09=20= errmsg("permission=20denied=20to=20set=20parameter=20\"%s\"",=0A+=09=09=09= =09=09=09=09=09=09name)));=0A+=09=09=09=09=09return=200;=0A+=09=09=09=09= }=0A+=0A+=09=09=09=09/*=20No=20pg_parameter_acl=20entry,=20okay=20*/=0A+=09= =09=09}=0A=20=09=09=09break;=0A=20=09}=0A=20=0A@@=20-8156,6=20+8245,49=20= @@=20set_config_option(const=20char=20*name,=20const=20char=20*value,=0A=20= }=0A=20=0A=20=0A+/*=0A+=20*=20Get=20the=20context=20required=20to=20set=20= the=20parameter,=20or=20the=20given=20default=20context=0A+=20*=20if=20= the=20named=20parameter=20cannot=20be=20found.=0A+=20*/=0A+GucContext=0A= +find_option_context(const=20char=20*name,=20GucContext=20= default_context)=0A+{=0A+=09struct=20config_generic=20*conf;=0A+=0A+=09= /*=0A+=09=20*=20Find=20the=20option=20if=20it=20exists,=20but=20do=20not=20= error=20nor=20create=20a=20placeholder=0A+=09=20*=20for=20missing=20= options.=0A+=09=20*/=0A+=09conf=20=3D=20find_option(name,=20true,=20= ERROR);=0A+=09if=20(conf)=0A+=09=09return=20conf->context;=0A+=0A+=09/*=0A= +=09=20*=20If=20the=20given=20name=20does=20not=20contain=20a=20= separator,=20then=20we=20should=20not=20treat=0A+=09=20*=20it=20as=20a=20= custom=20parameter=20name.=20=20Emit=20an=20error=20about=20the=20= parameter=20being=0A+=09=20*=20unrecognized.=0A+=09=20*/=0A+=09if=20= (strchr(name,=20GUC_QUALIFIER_SEPARATOR)=20=3D=3D=20NULL)=0A+=09=09= ereport(ERROR,=0A+=09=09=09=09(errcode(ERRCODE_UNDEFINED_OBJECT),=0A+=09=09= =09=09=20errmsg("unrecognized=20configuration=20parameter=20\"%s\"",=0A+=09= =09=09=09=09=09name)));=0A+=0A+=09/*=0A+=09=20*=20Otherwise,=20assume=20= the=20user=20intends=20this=20as=20a=20placeholder=20for=20a=20custom=0A= +=09=20*=20parameter=20name,=20and=20only=20insist=20that=20the=20name=20= by=20syntactically=20valid.=0A+=09=20*/=0A+=09if=20= (!valid_custom_variable_name(name))=0A+=09=09ereport(ERROR,=0A+=09=09=09=09= (errcode(ERRCODE_INVALID_NAME),=0A+=09=09=09=09=20errmsg("invalid=20= configuration=20parameter=20name=20\"%s\"",=0A+=09=09=09=09=09=09name),=0A= +=09=09=09=09=20errdetail("Custom=20parameter=20names=20must=20be=20two=20= or=20more=20simple=20identifiers=20separated=20by=20dots.")));=0A+=0A+=09= return=20default_context;=0A+}=0A+=0A+=0A=20/*=0A=20=20*=20Set=20the=20= fields=20for=20source=20file=20and=20line=20number=20the=20setting=20= came=20from.=0A=20=20*/=0A@@=20-8171,7=20+8303,7=20@@=20= set_config_sourcefile(const=20char=20*name,=20char=20*sourcefile,=20int=20= sourceline)=0A=20=09=20*/=0A=20=09elevel=20=3D=20IsUnderPostmaster=20?=20= DEBUG3=20:=20LOG;=0A=20=0A-=09record=20=3D=20find_option(name,=20true,=20= false,=20elevel);=0A+=09record=20=3D=20find_or_create_option(name,=20= PGC_USERSET,=20false,=20elevel);=0A=20=09/*=20should=20not=20happen=20*/=0A= =20=09if=20(record=20=3D=3D=20NULL)=0A=20=09=09return;=0A@@=20-8223,7=20= +8355,7=20@@=20GetConfigOption(const=20char=20*name,=20bool=20= missing_ok,=20bool=20restrict_privileged)=0A=20=09struct=20= config_generic=20*record;=0A=20=09static=20char=20buffer[256];=0A=20=0A-=09= record=20=3D=20find_option(name,=20false,=20missing_ok,=20ERROR);=0A+=09= record=20=3D=20find_option(name,=20missing_ok,=20ERROR);=0A=20=09if=20= (record=20=3D=3D=20NULL)=0A=20=09=09return=20NULL;=0A=20=09if=20= (restrict_privileged=20&&=0A@@=20-8272,7=20+8404,7=20@@=20= GetConfigOptionResetString(const=20char=20*name)=0A=20=09struct=20= config_generic=20*record;=0A=20=09static=20char=20buffer[256];=0A=20=0A-=09= record=20=3D=20find_option(name,=20false,=20false,=20ERROR);=0A+=09= record=20=3D=20find_option(name,=20false,=20ERROR);=0A=20=09= Assert(record=20!=3D=20NULL);=0A=20=09if=20((record->flags=20&=20= GUC_SUPERUSER_ONLY)=20&&=0A=20=09=09!has_privs_of_role(GetUserId(),=20= ROLE_PG_READ_ALL_SETTINGS))=0A@@=20-8317,7=20+8449,7=20@@=20= GetConfigOptionFlags(const=20char=20*name,=20bool=20missing_ok)=0A=20{=0A= =20=09struct=20config_generic=20*record;=0A=20=0A-=09record=20=3D=20= find_option(name,=20false,=20missing_ok,=20ERROR);=0A+=09record=20=3D=20= find_option(name,=20missing_ok,=20ERROR);=0A=20=09if=20(record=20=3D=3D=20= NULL)=0A=20=09=09return=200;=0A=20=09return=20record->flags;=0A@@=20= -8351,7=20+8483,7=20@@=20flatten_set_variable_args(const=20char=20*name,=20= List=20*args)=0A=20=09=20*=20Get=20flags=20for=20the=20variable;=20if=20= it's=20not=20known,=20use=20default=20flags.=0A=20=09=20*=20(Caller=20= might=20throw=20error=20later,=20but=20not=20our=20business=20to=20do=20= so=20here.)=0A=20=09=20*/=0A-=09record=20=3D=20find_option(name,=20= false,=20true,=20WARNING);=0A+=09record=20=3D=20find_option(name,=20= true,=20WARNING);=0A=20=09if=20(record)=0A=20=09=09flags=20=3D=20= record->flags;=0A=20=09else=0A@@=20-8600,6=20+8732,7=20@@=20= AlterSystemSetConfigFile(AlterSystemStmt=20*altersysstmt)=0A=20{=0A=20=09= char=09=20=20=20*name;=0A=20=09char=09=20=20=20*value;=0A+=09Oid=09=09=09= parameterId=20=3D=20InvalidOid;=0A=20=09bool=09=09resetall=20=3D=20= false;=0A=20=09ConfigVariable=20*head=20=3D=20NULL;=0A=20=09= ConfigVariable=20*tail=20=3D=20NULL;=0A@@=20-8607,16=20+8740,31=20@@=20= AlterSystemSetConfigFile(AlterSystemStmt=20*altersysstmt)=0A=20=09char=09= =09AutoConfFileName[MAXPGPATH];=0A=20=09char=09=09= AutoConfTmpFileName[MAXPGPATH];=0A=20=0A-=09if=20(!superuser())=0A-=09=09= ereport(ERROR,=0A-=09=09=09=09(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),=0A= -=09=09=09=09=20errmsg("must=20be=20superuser=20to=20execute=20ALTER=20= SYSTEM=20command")));=0A-=0A=20=09/*=0A=20=09=20*=20Extract=20statement=20= arguments=0A=20=09=20*/=0A=20=09name=20=3D=20= altersysstmt->setstmt->name;=0A=20=0A+=09/*=0A+=09=20*=20Check=20= permission=20to=20run=20ALTER=20SYSTEM=20on=20the=20target=20variable=20= registered.=0A+=09=20*/=0A+=09if=20(!superuser())=0A+=09{=0A+=09=09= AclResult=09aclresult;=0A+=0A+=09=09parameterId=20=3D=20= get_parameter_oid(name,=20true);=0A+=09=09if=20= (!OidIsValid(parameterId))=0A+=09=09=09ereport(ERROR,=0A+=09=09=09=09=09= (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),=0A+=09=09=09=09=09=20= errmsg("permission=20denied=20to=20set=20parameter=20\"%s\"",=0A+=09=09=09= =09=09=09=09name)));=0A+=0A+=09=09aclresult=20=3D=20= pg_parameter_acl_aclcheck(parameterId,=20GetUserId(),=0A+=09=09=09=09=09=09= =09=09=09=09=09=20ACL_ALTER_SYSTEM);=0A+=09=09if=20(aclresult=20!=3D=20= ACLCHECK_OK)=0A+=09=09=09aclcheck_error(aclresult,=20OBJECT_PARAMETER,=20= name);=0A+=09}=0A+=0A=20=09switch=20(altersysstmt->setstmt->kind)=0A=20=09= {=0A=20=09=09case=20VAR_SET_VALUE:=0A@@=20-8646,7=20+8794,7=20@@=20= AlterSystemSetConfigFile(AlterSystemStmt=20*altersysstmt)=0A=20=09{=0A=20= =09=09struct=20config_generic=20*record;=0A=20=0A-=09=09record=20=3D=20= find_option(name,=20false,=20false,=20ERROR);=0A+=09=09record=20=3D=20= find_option(name,=20false,=20ERROR);=0A=20=09=09Assert(record=20!=3D=20= NULL);=0A=20=0A=20=09=09/*=0A@@=20-8750,16=20+8898,17=20@@=20= AlterSystemSetConfigFile(AlterSystemStmt=20*altersysstmt)=0A=20=09}=0A=20= =0A=20=09/*=0A-=09=20*=20Invoke=20the=20post-alter=20hook=20for=20= altering=20this=20GUC=20variable.=0A+=09=20*=20Invoke=20the=20post-alter=20= hook=20for=20setting=20this=20GUC=20variable.=20=20Guc=20variables=0A+=09= =20*=20do=20not=20always=20have=20corresponding=20entries=20in=20= pg_parameter_acl,=20so=20we=20call=0A+=09=20*=20the=20hook=20using=20the=20= name=20rather=20than=20an=20Oid=20that=20might=20not=20be=20assigned.=0A=20= =09=20*=0A=20=09=20*=20We=20do=20this=20here=20rather=20than=20at=20the=20= end,=20because=20ALTER=20SYSTEM=20is=20not=0A=20=09=20*=20transactional.=20= =20If=20the=20hook=20aborts=20our=20transaction,=20it=20will=20be=20= cleaner=0A=20=09=20*=20to=20do=20so=20before=20we=20touch=20any=20files.=0A= =20=09=20*/=0A-=09InvokeObjectPostAlterHookArgStr(InvalidOid,=20name,=0A= -=09=09=09=09=09=09=09=09=09ACL_ALTER_SYSTEM,=0A-=09=09=09=09=09=09=09=09= =09altersysstmt->setstmt->kind,=0A-=09=09=09=09=09=09=09=09=09false);=0A= +=09InvokeObjectPostAlterHookArgStr(ParameterAclRelationId,=20name,=0A+=09= =09=09=09=09=09=09=09=20ACL_ALTER_SYSTEM,=20altersysstmt->setstmt->kind,=0A= +=09=09=09=09=09=09=09=09=20false);=0A=20=0A=20=09/*=0A=20=09=20*=20To=20= ensure=20crash=20safety,=20first=20write=20the=20new=20file=20data=20to=20= a=20temp=20file,=0A@@=20-8821,6=20+8970,9=20@@=20void=0A=20= ExecSetVariableStmt(VariableSetStmt=20*stmt,=20bool=20isTopLevel)=0A=20{=0A= =20=09GucAction=09action=20=3D=20stmt->is_local=20?=20GUC_ACTION_LOCAL=20= :=20GUC_ACTION_SET;=0A+=09GucContext=09context;=0A+=09AclResult=09= aclresult;=0A+=09Oid=09=09=09parameterId;=0A=20=0A=20=09/*=0A=20=09=20*=20= Workers=20synchronize=20these=20parameters=20at=20the=20start=20of=20the=20= parallel=0A@@=20-8831,6=20+8983,24=20@@=20= ExecSetVariableStmt(VariableSetStmt=20*stmt,=20bool=20isTopLevel)=0A=20=09= =09=09=09(errcode(ERRCODE_INVALID_TRANSACTION_STATE),=0A=20=09=09=09=09=20= errmsg("cannot=20set=20parameters=20during=20a=20parallel=20= operation")));=0A=20=0A+=09/*=20Get=20the=20Oid=20of=20this=20parameter,=20= or=20InvalidOid=20if=20none.=20*/=0A+=09parameterId=20=3D=20= get_parameter_oid(stmt->name,=20true);=0A+=0A+=09/*=0A+=09=20*=20= Superusers=20and=20users=20who=20have=20been=20granted=20SET=20privilege=20= can=20set=20with=0A+=09=20*=20PGC_SUSET=20context.=20=20All=20others=20= have=20only=20PGC_USERSET.=0A+=09=20*/=0A+=09context=20=3D=20= PGC_USERSET;=0A+=09if=20(superuser())=0A+=09=09context=20=3D=20= PGC_SUSET;=0A+=09else=20if=20(OidIsValid(parameterId))=0A+=09{=0A+=09=09= aclresult=20=3D=20pg_parameter_acl_aclcheck(parameterId,=20GetUserId(),=0A= +=09=09=09=09=09=09=09=09=09=09=09ACL_SET);=0A+=09=09if=20(aclresult=20= =3D=3D=20ACLCHECK_OK)=0A+=09=09=09context=20=3D=20PGC_SUSET;=0A+=09}=0A+=0A= =20=09switch=20(stmt->kind)=0A=20=09{=0A=20=09=09case=20VAR_SET_VALUE:=0A= @@=20-8839,7=20+9009,7=20@@=20ExecSetVariableStmt(VariableSetStmt=20= *stmt,=20bool=20isTopLevel)=0A=20=09=09=09=09= WarnNoTransactionBlock(isTopLevel,=20"SET=20LOCAL");=0A=20=09=09=09= (void)=20set_config_option(stmt->name,=0A=20=09=09=09=09=09=09=09=09=09=20= ExtractSetVariableArgs(stmt),=0A-=09=09=09=09=09=09=09=09=09=20= (superuser()=20?=20PGC_SUSET=20:=20PGC_USERSET),=0A+=09=09=09=09=09=09=09= =09=09=20context,=0A=20=09=09=09=09=09=09=09=09=09=20PGC_S_SESSION,=0A=20= =09=09=09=09=09=09=09=09=09=20action,=20true,=200,=20false);=0A=20=09=09=09= break;=0A@@=20-8924,7=20+9094,7=20@@=20= ExecSetVariableStmt(VariableSetStmt=20*stmt,=20bool=20isTopLevel)=0A=20=0A= =20=09=09=09(void)=20set_config_option(stmt->name,=0A=20=09=09=09=09=09=09= =09=09=09=20NULL,=0A-=09=09=09=09=09=09=09=09=09=20(superuser()=20?=20= PGC_SUSET=20:=20PGC_USERSET),=0A+=09=09=09=09=09=09=09=09=09=20context,=0A= =20=09=09=09=09=09=09=09=09=09=20PGC_S_SESSION,=0A=20=09=09=09=09=09=09=09= =09=09=20action,=20true,=200,=20false);=0A=20=09=09=09break;=0A@@=20= -8933,9=20+9103,9=20@@=20ExecSetVariableStmt(VariableSetStmt=20*stmt,=20= bool=20isTopLevel)=0A=20=09=09=09break;=0A=20=09}=0A=20=0A-=09/*=20= Invoke=20the=20post-alter=20hook=20for=20setting=20this=20GUC=20= variable.=20*/=0A-=09InvokeObjectPostAlterHookArgStr(InvalidOid,=20= stmt->name,=0A-=09=09=09=09=09=09=09=09=09ACL_SET_VALUE,=20stmt->kind,=20= false);=0A+=09/*=20Invoke=20the=20post-alter=20hook=20for=20setting=20= this=20GUC=20variable,=20by=20name.=20*/=0A+=09= InvokeObjectPostAlterHookArgStr(ParameterAclRelationId,=20stmt->name,=0A= +=09=09=09=09=09=09=09=09=20ACL_SET,=20stmt->kind,=20false);=0A=20}=0A=20= =0A=20/*=0A@@=20-9696,6=20+9866,22=20@@=20get_explain_guc_options(int=20= *num)=0A=20=09return=20result;=0A=20}=0A=20=0A+/*=0A+=20*=20Return=20GUC=20= variable=20canonical=20name,=20or=20NULL=20if=20no=20variable=20by=20the=20= given=0A+=20*=20name=20or=20alias=20exists.=0A+=20*/=0A+const=20char=20*=0A= +GetConfigOptionCanonicalName(const=20char=20*alias)=0A+{=0A+=09struct=20= config_generic=20*record;=0A+=0A+=09record=20=3D=20find_option(alias,=20= true,=20LOG);=0A+=09if=20(record=20=3D=3D=20NULL)=0A+=09=09return=20= NULL;=0A+=0A+=09return=20record->name;=0A+}=0A+=0A=20/*=0A=20=20*=20= Return=20GUC=20variable=20value=20by=20name;=20optionally=20return=20= canonical=20form=20of=0A=20=20*=20name.=20=20If=20the=20GUC=20is=20= unset,=20then=20throw=20an=20error=20unless=20missing_ok=20is=20true,=0A= @@=20-9706,7=20+9892,7=20@@=20GetConfigOptionByName(const=20char=20= *name,=20const=20char=20**varname,=20bool=20missing_ok)=0A=20{=0A=20=09= struct=20config_generic=20*record;=0A=20=0A-=09record=20=3D=20= find_option(name,=20false,=20missing_ok,=20ERROR);=0A+=09record=20=3D=20= find_option(name,=20missing_ok,=20ERROR);=0A=20=09if=20(record=20=3D=3D=20= NULL)=0A=20=09{=0A=20=09=09if=20(varname)=0A@@=20-9742,7=20+9928,7=20@@=20= pg_settings_get_flags(PG_FUNCTION_ARGS)=0A=20=09Datum=09=09= flags[MAX_GUC_FLAGS];=0A=20=09ArrayType=20=20*a;=0A=20=0A-=09record=20=3D=20= find_option(varname,=20false,=20true,=20ERROR);=0A+=09record=20=3D=20= find_option(varname,=20true,=20ERROR);=0A=20=0A=20=09/*=20return=20NULL=20= if=20no=20such=20variable=20*/=0A=20=09if=20(record=20=3D=3D=20NULL)=0A= @@=20-10553,7=20+10739,7=20@@=20read_nondefault_variables(void)=0A=20=09=09= if=20((varname=20=3D=20read_string_with_null(fp))=20=3D=3D=20NULL)=0A=20=09= =09=09break;=0A=20=0A-=09=09if=20((record=20=3D=20find_option(varname,=20= true,=20false,=20FATAL))=20=3D=3D=20NULL)=0A+=09=09if=20((record=20=3D=20= find_or_create_option(varname,=20PGC_USERSET,=20false,=20FATAL))=20=3D=3D=20= NULL)=0A=20=09=09=09elog(FATAL,=20"failed=20to=20locate=20variable=20= \"%s\"=20in=20exec=20config=20params=20file",=20varname);=0A=20=0A=20=09=09= if=20((varvalue=20=3D=20read_string_with_null(fp))=20=3D=3D=20NULL)=0A@@=20= -11243,7=20+11429,7=20@@=20GUCArrayAdd(ArrayType=20*array,=20const=20= char=20*name,=20const=20char=20*value)=0A=20=09(void)=20= validate_option_array_item(name,=20value,=20false);=0A=20=0A=20=09/*=20= normalize=20name=20(converts=20obsolete=20GUC=20names=20to=20modern=20= spellings)=20*/=0A-=09record=20=3D=20find_option(name,=20false,=20true,=20= WARNING);=0A+=09record=20=3D=20find_option(name,=20true,=20WARNING);=0A=20= =09if=20(record)=0A=20=09=09name=20=3D=20record->name;=0A=20=0A@@=20= -11322,7=20+11508,7=20@@=20GUCArrayDelete(ArrayType=20*array,=20const=20= char=20*name)=0A=20=09(void)=20validate_option_array_item(name,=20NULL,=20= false);=0A=20=0A=20=09/*=20normalize=20name=20(converts=20obsolete=20GUC=20= names=20to=20modern=20spellings)=20*/=0A-=09record=20=3D=20= find_option(name,=20false,=20true,=20WARNING);=0A+=09record=20=3D=20= find_option(name,=20true,=20WARNING);=0A=20=09if=20(record)=0A=20=09=09= name=20=3D=20record->name;=0A=20=0A@@=20-11478,7=20+11664,7=20@@=20= validate_option_array_item(const=20char=20*name,=20const=20char=20= *value,=0A=20=09=20*=20name=20is=20not=20known=20and=20can't=20be=20= created=20as=20a=20placeholder.=20=20Throw=20error,=0A=20=09=20*=20= unless=20skipIfNoPermissions=20is=20true,=20in=20which=20case=20return=20= false.=0A=20=09=20*/=0A-=09gconf=20=3D=20find_option(name,=20true,=20= skipIfNoPermissions,=20ERROR);=0A+=09gconf=20=3D=20= find_or_create_option(name,=20PGC_USERSET,=20skipIfNoPermissions,=20= ERROR);=0A=20=09if=20(!gconf)=0A=20=09{=0A=20=09=09/*=20not=20known,=20= failed=20to=20make=20a=20placeholder=20*/=0Adiff=20--git=20= a/src/bin/pg_dump/dumputils.c=20b/src/bin/pg_dump/dumputils.c=0Aindex=20= 6086d57cf3..3e68dfc78f=20100644=0A---=20a/src/bin/pg_dump/dumputils.c=0A= +++=20b/src/bin/pg_dump/dumputils.c=0A@@=20-37,7=20+37,7=20@@=20static=20= void=20AddAcl(PQExpBuffer=20aclbuf,=20const=20char=20*keyword,=0A=20=20*=09= nspname:=20the=20namespace=20the=20object=20is=20in=20(NULL=20if=20= none);=20not=20pre-quoted=0A=20=20*=09type:=20the=20object=20type=20(as=20= seen=20in=20GRANT=20command:=20must=20be=20one=20of=0A=20=20*=09=09= TABLE,=20SEQUENCE,=20FUNCTION,=20PROCEDURE,=20LANGUAGE,=20SCHEMA,=20= DATABASE,=20TABLESPACE,=0A-=20*=09=09FOREIGN=20DATA=20WRAPPER,=20SERVER,=20= or=20LARGE=20OBJECT)=0A+=20*=09=09FOREIGN=20DATA=20WRAPPER,=20SERVER,=20= PARAMETER=20or=20LARGE=20OBJECT)=0A=20=20*=09acls:=20the=20ACL=20string=20= fetched=20from=20the=20database=0A=20=20*=09baseacls:=20the=20initial=20= ACL=20string=20for=20this=20object=0A=20=20*=09owner:=20username=20of=20= object=20owner=20(will=20be=20passed=20through=20fmtId);=20can=20be=0A@@=20= -501,6=20+501,11=20@@=20do=20{=20\=0A=20=09=09CONVERT_PRIV('U',=20= "USAGE");=0A=20=09else=20if=20(strcmp(type,=20"FOREIGN=20TABLE")=20=3D=3D=20= 0)=0A=20=09=09CONVERT_PRIV('r',=20"SELECT");=0A+=09else=20if=20= (strcmp(type,=20"PARAMETER")=20=3D=3D=200)=0A+=09{=0A+=09=09= CONVERT_PRIV('s',=20"SET");=0A+=09=09CONVERT_PRIV('A',=20"ALTER=20= SYSTEM");=0A+=09}=0A=20=09else=20if=20(strcmp(type,=20"LARGE=20OBJECT")=20= =3D=3D=200)=0A=20=09{=0A=20=09=09CONVERT_PRIV('r',=20"SELECT");=0Adiff=20= --git=20a/src/bin/pg_dump/pg_backup_archiver.c=20= b/src/bin/pg_dump/pg_backup_archiver.c=0Aindex=20d41a99d6ea..c5ab50ad28=20= 100644=0A---=20a/src/bin/pg_dump/pg_backup_archiver.c=0A+++=20= b/src/bin/pg_dump/pg_backup_archiver.c=0A@@=20-3435,6=20+3435,7=20@@=20= _getObjectDescription(PQExpBuffer=20buf,=20TocEntry=20*te)=0A=20=09=09= strcmp(type,=20"SCHEMA")=20=3D=3D=200=20||=0A=20=09=09strcmp(type,=20= "EVENT=20TRIGGER")=20=3D=3D=200=20||=0A=20=09=09strcmp(type,=20"FOREIGN=20= DATA=20WRAPPER")=20=3D=3D=200=20||=0A+=09=09strcmp(type,=20"PARAMETER")=20= =3D=3D=200=20||=0A=20=09=09strcmp(type,=20"SERVER")=20=3D=3D=200=20||=0A=20= =09=09strcmp(type,=20"PUBLICATION")=20=3D=3D=200=20||=0A=20=09=09= strcmp(type,=20"SUBSCRIPTION")=20=3D=3D=200=20||=0A@@=20-3618,6=20= +3619,7=20@@=20_printTocEntry(ArchiveHandle=20*AH,=20TocEntry=20*te,=20= bool=20isData)=0A=20=09=09=09strcmp(te->desc,=20"TEXT=20SEARCH=20= DICTIONARY")=20=3D=3D=200=20||=0A=20=09=09=09strcmp(te->desc,=20"TEXT=20= SEARCH=20CONFIGURATION")=20=3D=3D=200=20||=0A=20=09=09=09= strcmp(te->desc,=20"FOREIGN=20DATA=20WRAPPER")=20=3D=3D=200=20||=0A+=09=09= =09strcmp(te->desc,=20"PARAMETER")=20=3D=3D=200=20||=0A=20=09=09=09= strcmp(te->desc,=20"SERVER")=20=3D=3D=200=20||=0A=20=09=09=09= strcmp(te->desc,=20"STATISTICS")=20=3D=3D=200=20||=0A=20=09=09=09= strcmp(te->desc,=20"PUBLICATION")=20=3D=3D=200=20||=0Adiff=20--git=20= a/src/bin/pg_dump/pg_dump.c=20b/src/bin/pg_dump/pg_dump.c=0Aindex=20= 535b160165..139c20c155=20100644=0A---=20a/src/bin/pg_dump/pg_dump.c=0A= +++=20b/src/bin/pg_dump/pg_dump.c=0A@@=20-14288,6=20+14288,9=20@@=20= dumpDefaultACL(Archive=20*fout,=20const=20DefaultACLInfo=20*daclinfo)=0A=20= =09=09case=20DEFACLOBJ_NAMESPACE:=0A=20=09=09=09type=20=3D=20"SCHEMAS";=0A= =20=09=09=09break;=0A+=09=09case=20DEFACLOBJ_PARAMETER:=0A+=09=09=09type=20= =3D=20"PARAMETERS";=0A+=09=09=09break;=0A=20=09=09default:=0A=20=09=09=09= /*=20shouldn't=20get=20here=20*/=0A=20=09=09=09fatal("unrecognized=20= object=20type=20in=20default=20privileges:=20%d",=0A@@=20-14331,7=20= +14334,7=20@@=20dumpDefaultACL(Archive=20*fout,=20const=20DefaultACLInfo=20= *daclinfo)=0A=20=20*=09=09or=20InvalidDumpId=20if=20there=20is=20no=20= need=20for=20a=20second=20dependency.=0A=20=20*=20'type'=20must=20be=20= one=20of=0A=20=20*=09=09TABLE,=20SEQUENCE,=20FUNCTION,=20LANGUAGE,=20= SCHEMA,=20DATABASE,=20TABLESPACE,=0A-=20*=09=09FOREIGN=20DATA=20WRAPPER,=20= SERVER,=20or=20LARGE=20OBJECT.=0A+=20*=09=09FOREIGN=20DATA=20WRAPPER,=20= SERVER,=20PARAMETER=20or=20LARGE=20OBJECT.=0A=20=20*=20'name'=20is=20the=20= formatted=20name=20of=20the=20object.=20=20Must=20be=20quoted=20etc.=20= already.=0A=20=20*=20'subname'=20is=20the=20formatted=20name=20of=20the=20= sub-object,=20if=20any.=20=20Must=20be=20quoted.=0A=20=20*=09=09= (Currently=20we=20assume=20that=20subname=20is=20only=20provided=20for=20= table=20columns.)=0Adiff=20--git=20a/src/bin/pg_dump/pg_dumpall.c=20= b/src/bin/pg_dump/pg_dumpall.c=0Aindex=209c9f7c6d63..f8c5d2efa9=20100644=0A= ---=20a/src/bin/pg_dump/pg_dumpall.c=0A+++=20= b/src/bin/pg_dump/pg_dumpall.c=0A@@=20-36,6=20+36,7=20@@=20static=20void=20= help(void);=0A=20static=20void=20dropRoles(PGconn=20*conn);=0A=20static=20= void=20dumpRoles(PGconn=20*conn);=0A=20static=20void=20= dumpRoleMembership(PGconn=20*conn);=0A+static=20void=20= dumpRoleGUCPrivs(PGconn=20*conn);=0A=20static=20void=20= dropTablespaces(PGconn=20*conn);=0A=20static=20void=20= dumpTablespaces(PGconn=20*conn);=0A=20static=20void=20dropDBs(PGconn=20= *conn);=0A@@=20-585,6=20+586,10=20@@=20main(int=20argc,=20char=20= *argv[])=0A=20=0A=20=09=09=09/*=20Dump=20role=20memberships=20*/=0A=20=09= =09=09dumpRoleMembership(conn);=0A+=0A+=09=09=09/*=20Dump=20role=20guc=20= privileges=20*/=0A+=09=09=09if=20(server_version=20>=3D=20150000)=0A+=09=09= =09=09dumpRoleGUCPrivs(conn);=0A=20=09=09}=0A=20=0A=20=09=09/*=20Dump=20= tablespaces=20*/=0A@@=20-1024,6=20+1029,62=20@@=20dropTablespaces(PGconn=20= *conn)=0A=20=09fprintf(OPF,=20"\n\n");=0A=20}=0A=20=0A+/*=0A+=20*=20Dump=20= role=20configuration=20parameter=20privileges.=20=20This=20code=20is=20= used=20for=2015.0=0A+=20*=20and=20later=20servers.=0A+=20*=0A+=20*=20= Note:=20we=20expect=20dumpRoles=20already=20created=20all=20the=20roles,=20= but=20there=20are=0A+=20*=20no=20per-role=20configuration=20parameter=20= privileges=20yet.=0A+=20*/=0A+static=20void=0A+dumpRoleGUCPrivs(PGconn=20= *conn)=0A+{=0A+=09PGresult=20=20=20*res;=0A+=09int=09=09=09i;=0A+=0A+=09= /*=0A+=09=20*=20Get=20all=20parameters=20which=20have=20non-default=20= acls=20defined.=0A+=09=20*/=0A+=09res=20=3D=20executeQuery(conn,=20= "SELECT=20parameter,=20"=0A+=09=09=09=09=09=20=20=20= "pg_catalog.pg_get_userbyid(10)=20AS=20setowner,=20"=0A+=09=09=09=09=09=20= =20=20"setacl,=20aclparameterdefault(parameter)=20AS=20acldefault=20"=0A= +=09=09=09=09=09=20=20=20"FROM=20pg_catalog.pg_parameter_acl=20"=0A+=09=09= =09=09=09=20=20=20"ORDER=20BY=20oid");=0A+=0A+=09fprintf(OPF,=20"--\n--=20= Role=20privileges=20on=20configuration=20parameters\n--\n\n");=0A+=0A+=09= for=20(i=20=3D=200;=20i=20<=20PQntuples(res);=20i++)=0A+=09{=0A+=09=09= PQExpBuffer=20buf=20=3D=20createPQExpBuffer();=0A+=09=09char=09=20=20=20= *parameter=20=3D=20PQgetvalue(res,=20i,=200);=0A+=09=09char=09=20=20=20= *setowner=20=3D=20PQgetvalue(res,=20i,=201);=0A+=09=09char=09=20=20=20= *setacl=20=3D=20PQgetvalue(res,=20i,=202);=0A+=09=09char=09=20=20=20= *acldefault=20=3D=20PQgetvalue(res,=20i,=203);=0A+=09=09char=09=20=20=20= *fparameter;=0A+=0A+=09=09/*=20needed=20for=20buildACLCommands()=20*/=0A= +=09=09fparameter=20=3D=20pg_strdup(fmtId(parameter));=0A+=0A+=09=09if=20= (!buildACLCommands(fparameter,=20NULL,=20NULL,=20"PARAMETER",=0A+=09=09=09= =09=09=09=09=20=20setacl,=20acldefault,=0A+=09=09=09=09=09=09=09=20=20= setowner,=20"",=20server_version,=20buf))=0A+=09=09{=0A+=09=09=09= pg_log_error("could=20not=20parse=20ACL=20list=20(%s)=20for=20tablespace=20= \"%s\"",=0A+=09=09=09=09=09=09=20setacl,=20parameter);=0A+=09=09=09= PQfinish(conn);=0A+=09=09=09exit_nicely(1);=0A+=09=09}=0A+=0A+=09=09= fprintf(OPF,=20"%s",=20buf->data);=0A+=0A+=09=09free(fparameter);=0A+=09=09= destroyPQExpBuffer(buf);=0A+=09}=0A+=0A+=09PQclear(res);=0A+=09= fprintf(OPF,=20"\n\n");=0A+}=0A+=0A=20/*=0A=20=20*=20Dump=20tablespaces.=0A= =20=20*/=0Adiff=20--git=20a/src/bin/psql/tab-complete.c=20= b/src/bin/psql/tab-complete.c=0Aindex=203f9dfffd57..ae7b35d142=20100644=0A= ---=20a/src/bin/psql/tab-complete.c=0A+++=20= b/src/bin/psql/tab-complete.c=0A@@=20-3736,7=20+3736,11=20@@=20= psql_completion(const=20char=20*text,=20int=20start,=20int=20end)=0A=20=20= *=20ALTER=20DEFAULT=20PRIVILEGES,=20so=20use=20TailMatches=0A=20=20*/=0A=20= =09/*=20Complete=20GRANT/REVOKE=20with=20a=20list=20of=20roles=20and=20= privileges=20*/=0A-=09else=20if=20(TailMatches("GRANT|REVOKE"))=0A+=09= else=20if=20(TailMatches("REVOKE",=20"GRANT"))=0A+=09=09= COMPLETE_WITH("OPTION=20FOR");=0A+=09else=20if=20(TailMatches("REVOKE",=20= "GRANT",=20"OPTION"))=0A+=09=09COMPLETE_WITH("FOR");=0A+=09else=20if=20= (TailMatches("REVOKE"))=0A=20=09{=0A=20=09=09/*=0A=20=09=09=20*=20With=20= ALTER=20DEFAULT=20PRIVILEGES,=20restrict=20completion=20to=20grantable=0A= @@=20-3748,8=20+3752,11=20@@=20psql_completion(const=20char=20*text,=20= int=20start,=20int=20end)=0A=20=09=09=09=09=09=09=20=20"EXECUTE",=20= "USAGE",=20"ALL");=0A=20=09=09else=0A=20=09=09=09= COMPLETE_WITH_QUERY_PLUS(Query_for_list_of_roles,=0A+=09=09=09=09=09=09=09= =09=09=20"ALTER",=0A=20=09=09=09=09=09=09=09=09=09=20"SELECT",=0A+=09=09=09= =09=09=09=09=09=09=20"SET",=0A=20=09=09=09=09=09=09=09=09=09=20"INSERT",=0A= +=09=09=09=09=09=09=09=09=09=20"GRANT",=0A=20=09=09=09=09=09=09=09=09=09=20= "UPDATE",=0A=20=09=09=09=09=09=09=09=09=09=20"DELETE",=0A=20=09=09=09=09=09= =09=09=09=09=20"TRUNCATE",=0A@@=20-3762,12=20+3769,139=20@@=20= psql_completion(const=20char=20*text,=20int=20start,=20int=20end)=0A=20=09= =09=09=09=09=09=09=09=09=20"USAGE",=0A=20=09=09=09=09=09=09=09=09=09=20= "ALL");=0A=20=09}=0A+=09else=20if=20(TailMatches("GRANT")=20||=0A+=09=09=09= =20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR"))=0A+=09{=0A+=09=09= /*=0A+=09=09=20*=20With=20ALTER=20DEFAULT=20PRIVILEGES,=20restrict=20= completion=20to=20grantable=0A+=09=09=20*=20privileges=20(can't=20grant=20= roles)=0A+=09=09=20*/=0A+=09=09if=20(HeadMatches("ALTER",=20"DEFAULT",=20= "PRIVILEGES"))=0A+=09=09=09COMPLETE_WITH("SELECT",=20"INSERT",=20= "UPDATE",=0A+=09=09=09=09=09=09=20=20"DELETE",=20"TRUNCATE",=20= "REFERENCES",=20"TRIGGER",=0A+=09=09=09=09=09=09=20=20"EXECUTE",=20= "USAGE",=20"ALL");=0A+=09=09else=0A+=09=09=09= COMPLETE_WITH_QUERY_PLUS(Query_for_list_of_roles,=0A+=09=09=09=09=09=09=09= =09=09=20"ALTER",=0A+=09=09=09=09=09=09=09=09=09=20"SELECT",=0A+=09=09=09= =09=09=09=09=09=09=20"SET",=0A+=09=09=09=09=09=09=09=09=09=20"INSERT",=0A= +=09=09=09=09=09=09=09=09=09=20"UPDATE",=0A+=09=09=09=09=09=09=09=09=09=20= "DELETE",=0A+=09=09=09=09=09=09=09=09=09=20"TRUNCATE",=0A+=09=09=09=09=09= =09=09=09=09=20"REFERENCES",=0A+=09=09=09=09=09=09=09=09=09=20"TRIGGER",=0A= +=09=09=09=09=09=09=09=09=09=20"CREATE",=0A+=09=09=09=09=09=09=09=09=09=20= "CONNECT",=0A+=09=09=09=09=09=09=09=09=09=20"TEMPORARY",=0A+=09=09=09=09=09= =09=09=09=09=20"EXECUTE",=0A+=09=09=09=09=09=09=09=09=09=20"USAGE",=0A+=09= =09=09=09=09=09=09=09=09=20"ALL");=0A+=09}=0A+=0A+=09else=20if=20= (TailMatches("GRANT|REVOKE",=20"ALTER")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER"))=0A+=09=09= COMPLETE_WITH("SYSTEM");=0A+=0A+=09else=20if=20= (TailMatches("GRANT|REVOKE",=20"SET")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"SET")=20||=0A+=09= =09=09=20TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM")=20||=0A+=09=09= =09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM"))=0A+=09=09COMPLETE_WITH(",",=0A+=09=09=09=09=09=20=20"ON=20= PARAMETER");=0A+=0A+=09else=20if=20(TailMatches("GRANT|REVOKE",=20= "SET,")=20||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20"SET",=20",")=20= ||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20= "SET,")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20= "FOR",=20"SET",=20","))=0A+=09=09COMPLETE_WITH("ALTER=20SYSTEM=20ON=20= PARAMETER");=0A+=09else=20if=20(TailMatches("GRANT|REVOKE",=20"ALTER",=20= "SYSTEM,")=20||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20"ALTER",=20= "SYSTEM",=20",")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20= "OPTION",=20"FOR",=20"ALTER",=20"SYSTEM,")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM",=20","))=0A+=09=09COMPLETE_WITH("SET=20ON=20PARAMETER");=0A+=0A= +=09else=20if=20(TailMatches("GRANT|REVOKE",=20"SET,",=20"ALTER")=20||=0A= +=09=09=09=20TailMatches("GRANT|REVOKE",=20"SET",=20",",=20"ALTER")=20||=0A= +=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20= "SET,",=20"ALTER")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20= "OPTION",=20"FOR",=20"SET",=20",",=20"ALTER"))=0A+=09=09= COMPLETE_WITH("SYSTEM=20ON=20PARAMETER");=0A+=09else=20if=20= (TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM,",=20"SET")=20||=0A+=09= =09=09=20TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM",=20",",=20= "SET")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20= "FOR",=20"ALTER",=20"SYSTEM,",=20"SET")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM",=20",",=20"SET")=20||=0A+=09=09=09=20= TailMatches("GRANT|REVOKE",=20"SET,",=20"ALTER",=20"SYSTEM")=20||=0A+=09=09= =09=20TailMatches("GRANT|REVOKE",=20"SET",=20",",=20"ALTER",=20"SYSTEM")=20= ||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM,",=20= "SET")=20||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20"ALTER",=20= "SYSTEM",=20",",=20"SET"))=0A+=09=09COMPLETE_WITH("ON=20PARAMETER");=0A+=0A= +=09else=20if=20(TailMatches("GRANT|REVOKE",=20"SET",=20"ON")=20||=0A+=09= =09=09=20TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM",=20"ON")=20||=0A= +=09=09=09=20TailMatches("GRANT|REVOKE",=20"SET,",=20"ALTER",=20= "SYSTEM",=20"ON")=20||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20= "SET",=20",",=20"ALTER",=20"SYSTEM",=20"ON")=20||=0A+=09=09=09=20= TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM,",=20"SET",=20"ON")=20= ||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM",=20= ",",=20"SET",=20"ON")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20= "GRANT",=20"OPTION",=20"FOR",=20"SET",=20"ON")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM",=20"ON")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20= "OPTION",=20"FOR",=20"SET,",=20"ALTER",=20"SYSTEM",=20"ON")=20||=0A+=09=09= =09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"SET",=20= ",",=20"ALTER",=20"SYSTEM",=20"ON")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM,",=20"SET",=20"ON")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20= "GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20"SYSTEM",=20",",=20"SET",=20= "ON"))=0A+=09=09COMPLETE_WITH("PARAMETER");=0A+=0A+=09else=20if=20= (TailMatches("GRANT|REVOKE",=20"SET",=20"ON",=20"PARAMETER")=20||=0A+=09=09= =09=20TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM",=20"ON",=20= "PARAMETER")=20||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20"SET,",=20= "ALTER",=20"SYSTEM",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("GRANT|REVOKE",=20"SET",=20",",=20"ALTER",=20"SYSTEM",=20= "ON",=20"PARAMETER")=20||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20= "ALTER",=20"SYSTEM,",=20"SET",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("GRANT|REVOKE",=20"ALTER",=20"SYSTEM",=20",",=20"SET",=20= "ON",=20"PARAMETER")=20||=0A+=09=09=09=20TailMatches("GRANT|REVOKE",=20= "ALL",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("GRANT|REVOKE",=20"ALL",=20"PRIVILEGES",=20"ON",=20= "PARAMETER")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20= "OPTION",=20"FOR",=20"SET",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"SET,",=20= "ALTER",=20"SYSTEM",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"SET",=20",",=20= "ALTER",=20"SYSTEM",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM,",=20"SET",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM",=20",",=20"SET",=20"ON",=20"PARAMETER")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALL",=20"ON",=20= "PARAMETER")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20= "OPTION",=20"FOR",=20"ALL",=20"PRIVILEGES",=20"ON",=20"PARAMETER"))=0A+=09= =09COMPLETE_WITH_QUERY(Query_for_list_of_set_vars);=0A+=0A+=09else=20if=20= (TailMatches("GRANT",=20"SET",=20"ON",=20"PARAMETER",=20MatchAny)=20||=0A= +=09=09=09=20TailMatches("GRANT",=20"ALTER",=20"SYSTEM",=20"ON",=20= "PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20TailMatches("GRANT",=20= "SET,",=20"ALTER",=20"SYSTEM",=20"ON",=20"PARAMETER",=20MatchAny)=20||=0A= +=09=09=09=20TailMatches("GRANT",=20"SET",=20",",=20"ALTER",=20"SYSTEM",=20= "ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("GRANT",=20"ALTER",=20"SYSTEM,",=20"SET",=20"ON",=20= "PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20TailMatches("GRANT",=20= "ALTER",=20"SYSTEM",=20",",=20"SET",=20"ON",=20"PARAMETER",=20MatchAny)=20= ||=0A+=09=09=09=20TailMatches("GRANT",=20"ALL",=20"ON",=20"PARAMETER",=20= MatchAny)=20||=0A+=09=09=09=20TailMatches("GRANT",=20"ALL",=20= "PRIVILEGES",=20"ON",=20"PARAMETER",=20MatchAny))=0A+=09=09= COMPLETE_WITH("TO");=0A+=0A+=09else=20if=20(TailMatches("REVOKE",=20= "SET",=20"ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"ALTER",=20"SYSTEM",=20"ON",=20"PARAMETER",=20= MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"SET,",=20"ALTER",=20= "SYSTEM",=20"ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"SET",=20",",=20"ALTER",=20"SYSTEM",=20"ON",=20= "PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20= "ALL",=20"ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"ALL",=20"PRIVILEGES",=20"ON",=20"PARAMETER",=20= MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"ALTER",=20= "SYSTEM,",=20"SET",=20"ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"ALTER",=20"SYSTEM",=20",",=20"SET",=20"ON",=20= "PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20= "GRANT",=20"OPTION",=20"FOR",=20"SET",=20"ON",=20"PARAMETER",=20= MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20= "OPTION",=20"FOR",=20"ALTER",=20"SYSTEM",=20"ON",=20"PARAMETER",=20= MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20= "OPTION",=20"FOR",=20"SET,",=20"ALTER",=20"SYSTEM",=20"ON",=20= "PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20= "GRANT",=20"OPTION",=20"FOR",=20"SET",=20",",=20"ALTER",=20"SYSTEM",=20= "ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM,",=20"SET",=20"ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALTER",=20= "SYSTEM",=20",",=20"SET",=20"ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09= =09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALL",=20= "ON",=20"PARAMETER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20"ALL",=20= "PRIVILEGES",=20"ON",=20"PARAMETER",=20MatchAny))=0A+=09=09= COMPLETE_WITH("FROM");=0A=20=0A=20=09/*=0A=20=09=20*=20Complete=20= GRANT/REVOKE=20=20with=20"ON",=20GRANT/REVOKE=20=20with=0A= =20=09=20*=20TO/FROM=0A=20=09=20*/=0A-=09else=20if=20= (TailMatches("GRANT|REVOKE",=20MatchAny))=0A+=09else=20if=20= (TailMatches("GRANT|REVOKE",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20MatchAny))=0A=20=09= {=0A=20=09=09if=20= (TailMatches("SELECT|INSERT|UPDATE|DELETE|TRUNCATE|REFERENCES|TRIGGER|CREA= TE|CONNECT|TEMPORARY|TEMP|EXECUTE|USAGE|ALL"))=0A=20=09=09=09= COMPLETE_WITH("ON");=0A@@=20-3784,7=20+3918,8=20@@=20= psql_completion(const=20char=20*text,=20int=20start,=20int=20end)=0A=20=09= =20*=20here=20will=20only=20work=20if=20the=20privilege=20list=20= contains=20exactly=20one=0A=20=09=20*=20privilege.=0A=20=09=20*/=0A-=09= else=20if=20(TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON"))=0A+=09else=20= if=20(TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON")=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20MatchAny,=20= "ON"))=0A=20=09{=0A=20=09=09/*=0A=20=09=09=20*=20With=20ALTER=20DEFAULT=20= PRIVILEGES,=20restrict=20completion=20to=20the=20kinds=20of=0A@@=20= -3814,13=20+3949,15=20@@=20psql_completion(const=20char=20*text,=20int=20= start,=20int=20end)=0A=20=09=09=09=09=09=09=09=09=09=09=09"TABLESPACE",=0A= =20=09=09=09=09=09=09=09=09=09=09=09"TYPE");=0A=20=09}=0A-=09else=20if=20= (TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20"ALL"))=0A+=09else=20= if=20(TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20"ALL")=20||=0A+=09= =09=09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20= MatchAny,=20"ON",=20"ALL"))=0A=20=09=09COMPLETE_WITH("FUNCTIONS=20IN=20= SCHEMA",=0A=20=09=09=09=09=09=20=20"PROCEDURES=20IN=20SCHEMA",=0A=20=09=09= =09=09=09=20=20"ROUTINES=20IN=20SCHEMA",=0A=20=09=09=09=09=09=20=20= "SEQUENCES=20IN=20SCHEMA",=0A=20=09=09=09=09=09=20=20"TABLES=20IN=20= SCHEMA");=0A-=09else=20if=20(TailMatches("GRANT|REVOKE",=20MatchAny,=20= "ON",=20"FOREIGN"))=0A+=09else=20if=20(TailMatches("GRANT|REVOKE",=20= MatchAny,=20"ON",=20"FOREIGN")=20||=0A+=09=09=09=20TailMatches("REVOKE",=20= "GRANT",=20"OPTION",=20"FOR",=20MatchAny,=20"ON",=20"FOREIGN"))=0A=20=09=09= COMPLETE_WITH("DATA=20WRAPPER",=20"SERVER");=0A=20=0A=20=09/*=0A@@=20= -3829,7=20+3966,8=20@@=20psql_completion(const=20char=20*text,=20int=20= start,=20int=20end)=0A=20=09=20*=0A=20=09=20*=20Complete=20"GRANT/REVOKE=20= *=20ON=20*"=20with=20"TO/FROM".=0A=20=09=20*/=0A-=09else=20if=20= (TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20MatchAny))=0A+=09else=20= if=20(TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20MatchAny)=20||=0A= +=09=09=09=20TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20= MatchAny,=20"ON",=20MatchAny))=0A=20=09{=0A=20=09=09if=20= (TailMatches("DATABASE"))=0A=20=09=09=09= COMPLETE_WITH_QUERY(Query_for_list_of_databases);=0A@@=20-3867,6=20= +4005,25=20@@=20psql_completion(const=20char=20*text,=20int=20start,=20= int=20end)=0A=20=09=09=09=20(HeadMatches("REVOKE")=20&&=20= TailMatches("FROM")))=0A=20=09=09= COMPLETE_WITH_QUERY_PLUS(Query_for_list_of_roles,=0A=20=09=09=09=09=09=09= =09=09=20Keywords_for_list_of_grant_roles);=0A+=09else=20if=20= (HeadMatches("GRANT")=20&&=20TailMatches("TO",=20MatchAny))=0A+=09=09= COMPLETE_WITH("WITH=20ADMIN=20OPTION",=0A+=09=09=09=09=09=20=20"WITH=20= GRANT=20OPTION",=0A+=09=09=09=09=09=20=20"GRANTED=20BY");=0A+=09else=20= if=20(HeadMatches("GRANT")=20&&=20TailMatches("TO",=20MatchAny,=20= "WITH"))=0A+=09=09COMPLETE_WITH("ADMIN=20OPTION",=0A+=09=09=09=09=09=20=20= "GRANT=20OPTION");=0A+=09else=20if=20(HeadMatches("GRANT")=20&&=20= TailMatches("TO",=20MatchAny,=20"WITH",=20"ADMIN"))=0A+=09=09= COMPLETE_WITH("OPTION");=0A+=09else=20if=20((HeadMatches("GRANT")=20&&=20= TailMatches("TO",=20MatchAny,=20"WITH",=20"ADMIN",=20"OPTION"))=20||=0A+=09= =09=09=20(HeadMatches("GRANT")=20&&=20TailMatches("TO",=20MatchAny,=20= "WITH",=20"GRANT",=20"OPTION")))=0A+=09=09COMPLETE_WITH("GRANTED=20BY");=0A= +=09else=20if=20((HeadMatches("GRANT")=20&&=20TailMatches("TO",=20= MatchAny,=20"WITH",=20"ADMIN",=20"OPTION",=20"GRANTED"))=20||=0A+=09=09=09= =20(HeadMatches("GRANT")=20&&=20TailMatches("TO",=20MatchAny,=20"WITH",=20= "GRANT",=20"OPTION",=20"GRANTED")))=0A+=09=09COMPLETE_WITH("BY");=0A+=09= else=20if=20((HeadMatches("GRANT")=20&&=20TailMatches("TO",=20MatchAny,=20= "WITH",=20"ADMIN",=20"OPTION",=20"GRANTED",=20"BY"))=20||=0A+=09=09=09=20= (HeadMatches("GRANT")=20&&=20TailMatches("TO",=20MatchAny,=20"WITH",=20= "GRANT",=20"OPTION",=20"GRANTED",=20"BY")))=0A+=09=09= COMPLETE_WITH_QUERY_PLUS(Query_for_list_of_roles,=0A+=09=09=09=09=09=09=09= =09=20Keywords_for_list_of_grant_roles);=0A=20=09/*=20Complete=20"ALTER=20= DEFAULT=20PRIVILEGES=20...=20GRANT/REVOKE=20...=20TO/FROM=20*/=0A=20=09= else=20if=20(HeadMatches("ALTER",=20"DEFAULT",=20"PRIVILEGES")=20&&=20= TailMatches("TO|FROM"))=0A=20=09=09= COMPLETE_WITH_QUERY_PLUS(Query_for_list_of_roles,=0A@@=20-3878,7=20= +4035,8=20@@=20psql_completion(const=20char=20*text,=20int=20start,=20= int=20end)=0A=20=09=09COMPLETE_WITH("FROM");=0A=20=0A=20=09/*=20Complete=20= "GRANT/REVOKE=20*=20ON=20ALL=20*=20IN=20SCHEMA=20*"=20with=20TO/FROM=20= */=0A-=09else=20if=20(TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20= "ALL",=20MatchAny,=20"IN",=20"SCHEMA",=20MatchAny))=0A+=09else=20if=20= (TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20"ALL",=20MatchAny,=20= "IN",=20"SCHEMA",=20MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20= "GRANT",=20"OPTION",=20"FOR",=20MatchAny,=20"ON",=20"ALL",=20MatchAny,=20= "IN",=20"SCHEMA",=20MatchAny))=0A=20=09{=0A=20=09=09if=20= (TailMatches("GRANT",=20MatchAny,=20MatchAny,=20MatchAny,=20MatchAny,=20= MatchAny,=20MatchAny,=20MatchAny))=0A=20=09=09=09COMPLETE_WITH("TO");=0A= @@=20-3887,7=20+4045,8=20@@=20psql_completion(const=20char=20*text,=20= int=20start,=20int=20end)=0A=20=09}=0A=20=0A=20=09/*=20Complete=20= "GRANT/REVOKE=20*=20ON=20FOREIGN=20DATA=20WRAPPER=20*"=20with=20TO/FROM=20= */=0A-=09else=20if=20(TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20= "FOREIGN",=20"DATA",=20"WRAPPER",=20MatchAny))=0A+=09else=20if=20= (TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20"FOREIGN",=20"DATA",=20= "WRAPPER",=20MatchAny)=20||=0A+=09=09=09=20TailMatches("REVOKE",=20= "GRANT",=20"OPTION",=20"FOR",=20MatchAny,=20"ON",=20"FOREIGN",=20"DATA",=20= "WRAPPER",=20MatchAny))=0A=20=09{=0A=20=09=09if=20(TailMatches("GRANT",=20= MatchAny,=20MatchAny,=20MatchAny,=20MatchAny,=20MatchAny,=20MatchAny))=0A= =20=09=09=09COMPLETE_WITH("TO");=0A@@=20-3896,7=20+4055,8=20@@=20= psql_completion(const=20char=20*text,=20int=20start,=20int=20end)=0A=20=09= }=0A=20=0A=20=09/*=20Complete=20"GRANT/REVOKE=20*=20ON=20FOREIGN=20= SERVER=20*"=20with=20TO/FROM=20*/=0A-=09else=20if=20= (TailMatches("GRANT|REVOKE",=20MatchAny,=20"ON",=20"FOREIGN",=20= "SERVER",=20MatchAny))=0A+=09else=20if=20(TailMatches("GRANT|REVOKE",=20= MatchAny,=20"ON",=20"FOREIGN",=20"SERVER",=20MatchAny)=20||=0A+=09=09=09=20= TailMatches("REVOKE",=20"GRANT",=20"OPTION",=20"FOR",=20MatchAny,=20= "ON",=20"FOREIGN",=20"SERVER",=20MatchAny))=0A=20=09{=0A=20=09=09if=20= (TailMatches("GRANT",=20MatchAny,=20MatchAny,=20MatchAny,=20MatchAny,=20= MatchAny))=0A=20=09=09=09COMPLETE_WITH("TO");=0Adiff=20--git=20= a/src/include/catalog/dependency.h=20b/src/include/catalog/dependency.h=0A= index=20344482ec87..15185b3738=20100644=0A---=20= a/src/include/catalog/dependency.h=0A+++=20= b/src/include/catalog/dependency.h=0A@@=20-120,6=20+120,7=20@@=20typedef=20= enum=20ObjectClass=0A=20=09OCLASS_DEFACL,=09=09=09=09/*=20pg_default_acl=20= */=0A=20=09OCLASS_EXTENSION,=09=09=09/*=20pg_extension=20*/=0A=20=09= OCLASS_EVENT_TRIGGER,=09=09/*=20pg_event_trigger=20*/=0A+=09= OCLASS_PARAMETER,=09=09=09/*=20pg_parameter_acl=20*/=0A=20=09= OCLASS_POLICY,=09=09=09=09/*=20pg_policy=20*/=0A=20=09= OCLASS_PUBLICATION,=09=09=09/*=20pg_publication=20*/=0A=20=09= OCLASS_PUBLICATION_NAMESPACE,=09/*=20pg_publication_namespace=20*/=0A= diff=20--git=20a/src/include/catalog/objectaccess.h=20= b/src/include/catalog/objectaccess.h=0Aindex=204d54ae2a7d..ac6adcb730=20= 100644=0A---=20a/src/include/catalog/objectaccess.h=0A+++=20= b/src/include/catalog/objectaccess.h=0A@@=20-239,7=20+239,7=20@@=20= extern=20void=20RunFunctionExecuteHookStr(const=20char=20*objectStr);=0A=20= =09=09=09RunObjectTruncateHookStr(objectName);=09=09=09=09=09=09\=0A=20=09= }=20while(0)=0A=20=0A-#define=20= InvokeObjectPostAlterHookStr(className,objectName,subId)=09=09=09\=0A= +#define=20InvokeObjectPostAlterHookStr(classId,objectName,subId)=09=09=09= \=0A=20=09= InvokeObjectPostAlterHookArgStr((classId),(objectName),(subId),=09=09\=0A= =20=09=09=09=09=09=09=09=09=20InvalidOid,false)=0A=20#define=20= InvokeObjectPostAlterHookArgStr(classId,objectName,subId,=09=09\=0Adiff=20= --git=20a/src/include/catalog/pg_default_acl.h=20= b/src/include/catalog/pg_default_acl.h=0Aindex=202a79155636..757fc4963b=20= 100644=0A---=20a/src/include/catalog/pg_default_acl.h=0A+++=20= b/src/include/catalog/pg_default_acl.h=0A@@=20-66,6=20+66,7=20@@=20= DECLARE_UNIQUE_INDEX_PKEY(pg_default_acl_oid_index,=20828,=20= DefaultAclOidIndexId,=20o=0A=20#define=20DEFACLOBJ_FUNCTION=09=09'f'=20= /*=20function=20*/=0A=20#define=20DEFACLOBJ_TYPE=09=09=09'T'=20/*=20type=20= */=0A=20#define=20DEFACLOBJ_NAMESPACE=09=09'n'=20/*=20namespace=20*/=0A= +#define=20DEFACLOBJ_PARAMETER=09=09'p'=20/*=20configuration=20parameter=20= */=0A=20=0A=20#endif=09=09=09=09=09=09=09/*=20EXPOSE_TO_CLIENT_CODE=20*/=0A= =20=0Adiff=20--git=20a/src/include/catalog/pg_parameter_acl.h=20= b/src/include/catalog/pg_parameter_acl.h=0Anew=20file=20mode=20100644=0A= index=200000000000..20f15063ca=0A---=20/dev/null=0A+++=20= b/src/include/catalog/pg_parameter_acl.h=0A@@=20-0,0=20+1,63=20@@=0A= +/*-----------------------------------------------------------------------= --=0A+=20*=0A+=20*=20pg_parameter_acl.h=0A+=20*=09=20=20definition=20of=20= the=20"configuration=20parameter"=20system=20catalog=0A+=20*=09=20=20= (pg_parameter_acl).=0A+=20*=0A+=20*=0A+=20*=20Portions=20Copyright=20(c)=20= 1996-2021,=20PostgreSQL=20Global=20Development=20Group=0A+=20*=20= Portions=20Copyright=20(c)=201994,=20Regents=20of=20the=20University=20= of=20California=0A+=20*=0A+=20*=20src/include/catalog/pg_parameter_acl.h=0A= +=20*=0A+=20*=20NOTES=0A+=20*=09=20=20The=20Catalog.pm=20module=20reads=20= this=20file=20and=20derives=20schema=0A+=20*=09=20=20information.=0A+=20= *=0A+=20= *-------------------------------------------------------------------------= =0A+=20*/=0A+#ifndef=20PG_PARAMETER_ACL_H=0A+#define=20= PG_PARAMETER_ACL_H=0A+=0A+#include=20"catalog/genbki.h"=0A+#include=20= "catalog/pg_parameter_acl_d.h"=0A+=0A+/*=20----------------=0A+=20*=09=09= pg_parameter_acl=20definition.=20=20cpp=20turns=20this=20into=0A+=20*=09=09= typedef=20struct=20FormData_pg_parameter_acl=0A+=20*=20----------------=0A= +=20*/=0A+CATALOG(pg_parameter_acl,8924,ParameterAclRelationId)=20= BKI_SHARED_RELATION=0A+{=0A+=09Oid=09=09=09oid;=09=09=09/*=20oid=20*/=0A= +=0A+=09/*=0A+=09=20*=20Variable-length=20fields=20start=20here,=20but=20= we=20allow=20direct=20access=20to=0A+=09=20*=20parameter.=0A+=09=20*/=0A= +=09text=09=09parameter=20BKI_FORCE_NOT_NULL;=0A+=0A+#ifdef=20= CATALOG_VARLEN=0A+=09/*=20Access=20privileges=20*/=0A+=09aclitem=09=09= setacl[1]=20BKI_DEFAULT(_null_);=0A+#endif=0A+}=20= FormData_pg_parameter_acl;=0A+=0A+=0A+/*=20----------------=0A+=20*=09=09= Form_pg_parameter_acl=20corresponds=20to=20a=20pointer=20to=20a=20tuple=20= with=0A+=20*=09=09the=20format=20of=20pg_parameter_acl=20relation.=0A+=20= *=20----------------=0A+=20*/=0A+typedef=20FormData_pg_parameter_acl=20= *Form_pg_parameter_acl;=0A+=0A+DECLARE_TOAST(pg_parameter_acl,=208925,=20= 8926);=0A+#define=20PgParameterAclToastTable=208925=0A+#define=20= PgParameterAclToastIndex=208926=0A+=0A= +DECLARE_UNIQUE_INDEX(pg_parameter_acl_parameter_index,=208927,=20= ParameterAclParameterIndexId,=20on=20pg_parameter_acl=20using=20= btree(parameter=20text_ops));=0A= +DECLARE_UNIQUE_INDEX_PKEY(pg_parameter_acl_oid_index,=208928,=20= ParameterAclOidIndexId,=20on=20pg_parameter_acl=20using=20btree(oid=20= oid_ops));=0A+=0A+extern=20Oid=09ParameterAclCreate(const=20char=20= *parameter,=20bool=20if_not_exists);=0A+=0A+#endif=09=09=09=09=09=09=09= /*=20PG_PARAMETER_ACL_H=20*/=0Adiff=20--git=20= a/src/include/catalog/pg_proc.dat=20b/src/include/catalog/pg_proc.dat=0A= index=2001e1dd4d6d..f106ff4bae=20100644=0A---=20= a/src/include/catalog/pg_proc.dat=0A+++=20= b/src/include/catalog/pg_proc.dat=0A@@=20-2085,6=20+2085,10=20@@=0A=20=20= =20descr=20=3D>=20'show=20hardwired=20default=20privileges,=20primarily=20= for=20use=20by=20the=20information=20schema',=0A=20=20=20proname=20=3D>=20= 'acldefault',=20prorettype=20=3D>=20'_aclitem',=20proargtypes=20=3D>=20= 'char=20oid',=0A=20=20=20prosrc=20=3D>=20'acldefault_sql'=20},=0A+{=20= oid=20=3D>=20'9806',=0A+=20=20descr=20=3D>=20'show=20hardwired=20default=20= privileges=20on=20parameters',=0A+=20=20proname=20=3D>=20= 'aclparameterdefault',=20prorettype=20=3D>=20'_aclitem',=20proargtypes=20= =3D>=20'text',=0A+=20=20prosrc=20=3D>=20'aclparameterdefault_sql'=20},=0A= =20{=20oid=20=3D>=20'1689',=0A=20=20=20descr=20=3D>=20'convert=20ACL=20= item=20array=20to=20table,=20primarily=20for=20use=20by=20information=20= schema',=0A=20=20=20proname=20=3D>=20'aclexplode',=20prorows=20=3D>=20= '10',=20proretset=20=3D>=20't',=0A@@=20-7213,6=20+7217,25=20@@=0A=20=20=20= proname=20=3D>=20'has_type_privilege',=20provolatile=20=3D>=20's',=20= prorettype=20=3D>=20'bool',=0A=20=20=20proargtypes=20=3D>=20'oid=20= text',=20prosrc=20=3D>=20'has_type_privilege_id'=20},=0A=20=0A+{=20oid=20= =3D>=20'8050',=20descr=20=3D>=20'user=20privilege=20on=20parameter=20by=20= username,=20parameter=20name',=0A+=20=20proname=20=3D>=20= 'has_parameter_privilege',=20provolatile=20=3D>=20's',=20prorettype=20=3D>= =20'bool',=0A+=20=20proargtypes=20=3D>=20'name=20text=20text',=20prosrc=20= =3D>=20'has_parameter_privilege_name_name'=20},=0A+{=20oid=20=3D>=20= '8051',=20descr=20=3D>=20'user=20privilege=20on=20parameter=20by=20= username,=20parameter=20oid',=0A+=20=20proname=20=3D>=20= 'has_parameter_privilege',=20provolatile=20=3D>=20's',=20prorettype=20=3D>= =20'bool',=0A+=20=20proargtypes=20=3D>=20'name=20oid=20text',=20prosrc=20= =3D>=20'has_parameter_privilege_name_id'=20},=0A+{=20oid=20=3D>=20= '8052',=20descr=20=3D>=20'user=20privilege=20on=20parameter=20by=20user=20= oid,=20parameter=20name',=0A+=20=20proname=20=3D>=20= 'has_parameter_privilege',=20provolatile=20=3D>=20's',=20prorettype=20=3D>= =20'bool',=0A+=20=20proargtypes=20=3D>=20'oid=20text=20text',=20prosrc=20= =3D>=20'has_parameter_privilege_id_name'=20},=0A+{=20oid=20=3D>=20= '8053',=20descr=20=3D>=20'user=20privilege=20on=20parameter=20by=20user=20= oid,=20parameter=20oid',=0A+=20=20proname=20=3D>=20= 'has_parameter_privilege',=20provolatile=20=3D>=20's',=20prorettype=20=3D>= =20'bool',=0A+=20=20proargtypes=20=3D>=20'oid=20oid=20text',=20prosrc=20= =3D>=20'has_parameter_privilege_id_id'=20},=0A+{=20oid=20=3D>=20'8054',=20= descr=20=3D>=20'current=20user=20privilege=20on=20parameter=20by=20= parameter=20name',=0A+=20=20proname=20=3D>=20'has_parameter_privilege',=20= provolatile=20=3D>=20's',=20prorettype=20=3D>=20'bool',=0A+=20=20= proargtypes=20=3D>=20'text=20text',=20prosrc=20=3D>=20= 'has_parameter_privilege_name'=20},=0A+{=20oid=20=3D>=20'8055',=20descr=20= =3D>=20'current=20user=20privilege=20on=20parameter=20by=20parameter=20= oid',=0A+=20=20proname=20=3D>=20'has_parameter_privilege',=20provolatile=20= =3D>=20's',=20prorettype=20=3D>=20'bool',=0A+=20=20proargtypes=20=3D>=20= 'oid=20text',=20prosrc=20=3D>=20'has_parameter_privilege_id'=20},=0A+=0A=20= {=20oid=20=3D>=20'2705',=20descr=20=3D>=20'user=20privilege=20on=20role=20= by=20username,=20role=20name',=0A=20=20=20proname=20=3D>=20= 'pg_has_role',=20provolatile=20=3D>=20's',=20prorettype=20=3D>=20'bool',=0A= =20=20=20proargtypes=20=3D>=20'name=20name=20text',=20prosrc=20=3D>=20= 'pg_has_role_name_name'=20},=0Adiff=20--git=20= a/src/include/nodes/parsenodes.h=20b/src/include/nodes/parsenodes.h=0A= index=200ff4ba0884..bb7874da3a=20100644=0A---=20= a/src/include/nodes/parsenodes.h=0A+++=20= b/src/include/nodes/parsenodes.h=0A@@=20-92,7=20+92,7=20@@=20typedef=20= uint32=20AclMode;=09=09=09/*=20a=20bitmask=20of=20privilege=20bits=20*/=0A= =20#define=20ACL_CREATE=09=09(1<<9)=09/*=20for=20namespaces=20and=20= databases=20*/=0A=20#define=20ACL_CREATE_TEMP=20(1<<10)=20/*=20for=20= databases=20*/=0A=20#define=20ACL_CONNECT=09=09(1<<11)=20/*=20for=20= databases=20*/=0A-#define=20ACL_SET_VALUE=09(1<<12)=20/*=20for=20= configuration=20parameters=20*/=0A+#define=20ACL_SET=09(1<<12)=20/*=20= for=20configuration=20parameters=20*/=0A=20#define=20ACL_ALTER_SYSTEM=20= (1<<13)=20/*=20for=20configuration=20parameters=20*/=0A=20#define=20= N_ACL_RIGHTS=0914=09=09/*=201=20plus=20the=20last=201<=20= {=20pg_dumpall_globals=20=3D>=201,=20},=0A=20=09},=0A=20=0A+=09'GRANT=20= ALTER=20SYSTEM=20ON=20PARAMETER=20full_page_writes=20TO=20= regress_dump_test_role'=20=3D>=20{=0A+=09=09create_order=20=3D>=202,=0A+=09= =09create_sql=20=20=20=3D>=0A+=09=09=09'GRANT=20ALTER=20SYSTEM=20ON=20= PARAMETER=20full_page_writes=20TO=20regress_dump_test_role;',=0A+=09=09= regexp=20=20=20=20=20=20=20=3D>=0A+=0A+=09=09=09qr/^GRANT=20ALTER=20= SYSTEM=20ON=20PARAMETER=20full_page_writes=20TO=20= regress_dump_test_role;/m,=0A+=09=09like=20=20=20=20=20=20=20=20=20=3D>=20= {=20pg_dumpall_globals=20=3D>=201,=20},=0A+=09},=0A+=0A+=09'GRANT=20ALL=20= ON=20PARAMETER=20fsync=20TO=20regress_dump_test_role=20WITH=20GRANT=20= OPTION'=20=3D>=20{=0A+=09=09create_order=20=3D>=202,=0A+=09=09create_sql=20= =3D>=0A+=09=09=09'GRANT=20SET,=20ALTER=20SYSTEM=20ON=20PARAMETER=20fsync=20= TO=20regress_dump_test_role=20WITH=20GRANT=20OPTION;',=0A+=09=09regexp=20= =3D>=0A+=09=09=09#=20"set"=20plus=20"alter=20system"=20is=20"all"=20= privileges=20on=20parameters=0A+=09=09=09qr/^GRANT=20ALL=20ON=20= PARAMETER=20fsync=20TO=20regress_dump_test_role=20WITH=20GRANT=20= OPTION;/m,=0A+=09=09like=20=3D>=20{=20pg_dumpall_globals=20=3D>=201,=20= },=0A+=09},=0A+=0A+=09'GRANT=20ALTER=20SYSTEM=20ON=20PARAMETER=20= zero_damaged_pages"=20TO=20regress_dump_test_role'=20=3D>=20{=0A+=09=09= create_order=20=3D>=202,=0A+=09=09create_sql=20=3D>=0A+=09=09=09#=20= configuration=20parameters=20get=20cased=20folded=0A+=09=09=09'GRANT=20= ALTER=20SYSTEM=20ON=20PARAMETER=20ZERO_DAMAGED_PAGES=20TO=20= regress_dump_test_role;',=0A+=09=09regexp=20=3D>=0A+=09=09=09qr/^GRANT=20= ALTER=20SYSTEM=20ON=20PARAMETER=20zero_damaged_pages=20TO=20= regress_dump_test_role;/m,=0A+=09=09like=20=3D>=20{=20pg_dumpall_globals=20= =3D>=201,=20},=0A+=09},=0A+=0A+=09'GRANT=20ALL=20ON=20PARAMETER=20= ignore_checksum_failure=20TO=20regress_dump_test_role'=20=3D>=20{=0A+=09=09= create_order=20=3D>=202,=0A+=09=09create_sql=20=3D>=0A+=09=09=09#=20= GRANTED=20BY=20CURRENT_ROLE=20is=20allowed=20for=20SQL=20compatibility,=20= but=20is=20ignored=0A+=09=09=09'GRANT=20ALTER=20SYSTEM,=20SET=20ON=20= PARAMETER=20ignore_checksum_failure=20TO=20regress_dump_test_role=20= GRANTED=20BY=20CURRENT_ROLE;',=0A+=09=09regexp=20=3D>=0A+=09=09=09= qr/^GRANT=20ALL=20ON=20PARAMETER=20ignore_checksum_failure=20TO=20= regress_dump_test_role/m,=0A+=09=09like=20=3D>=20{=20pg_dumpall_globals=20= =3D>=201,=20},=0A+=09},=0A+=0A+=09'REVOKE=20SET=20ON=20PARAMETER=20= work_mem=20FROM=20PUBLIC'=20=3D>=20{=0A+=09=09create_order=20=3D>=202,=0A= +=09=09create_sql=20=3D>=0A+=09=09=09'REVOKE=20ALL=20PRIVILEGES=20ON=20= PARAMETER=20work_mem=20FROM=20PUBLIC;',=0A+=09=09regexp=20=3D>=0A+=09=09=09= #=20Pubilc=20only=20has=20"set"=20by=20default,=20so=20revoking=20"all=20= privileges"=20is=20simplified=20to=20revoking=20"set"=0A+=09=09=09= qr/^REVOKE=20SET=20ON=20PARAMETER=20work_mem=20FROM=20PUBLIC;/m,=0A+=09=09= like=20=3D>=20{=20pg_dumpall_globals=20=3D>=201,=20},=0A+=09},=0A+=0A+=09= 'GRANT=20ALL=20ON=20PARAMETER=20"DateStyle"=20TO=20= regress_dump_test_role'=20=3D>=20{=0A+=09=09create_order=20=3D>=202,=0A+=09= =09create_sql=20=3D>=0A+=09=09=09'GRANT=20ALL=20ON=20PARAMETER=20= DateStyle=20TO=20regress_dump_test_role=20WITH=20GRANT=20OPTION;=20= REVOKE=20GRANT=20OPTION=20FOR=20ALL=20ON=20PARAMETER=20DateStyle=20FROM=20= regress_dump_test_role;',=0A+=09=09regexp=20=3D>=0A+=09=09=09#=20The=20= revoke=20simplifies=20the=20ultimate=20grant=20so=20as=20to=20not=20= include=20"with=20grant=20option"=0A+=09=09=09qr/^GRANT=20ALL=20ON=20= PARAMETER=20"DateStyle"=20TO=20regress_dump_test_role;/m,=0A+=09=09like=20= =3D>=20{=20pg_dumpall_globals=20=3D>=201,=20},=0A+=09},=0A+=0A=20=09= 'CREATE=20SCHEMA=20public'=20=3D>=20{=0A=20=09=09regexp=20=3D>=20= qr/^CREATE=20SCHEMA=20public;/m,=0A=20=09=09like=20=20=20=3D>=20{=0Adiff=20= --git=20a/src/test/modules/unsafe_tests/Makefile=20= b/src/test/modules/unsafe_tests/Makefile=0Aindex=20= 3ecf5fcfc5..df58273688=20100644=0A---=20= a/src/test/modules/unsafe_tests/Makefile=0A+++=20= b/src/test/modules/unsafe_tests/Makefile=0A@@=20-1,6=20+1,6=20@@=0A=20#=20= src/test/modules/unsafe_tests/Makefile=0A=20=0A-REGRESS=20=3D=20= rolenames=20alter_system_table=0A+REGRESS=20=3D=20rolenames=20= alter_system_table=20guc_privs=0A=20=0A=20ifdef=20USE_PGXS=0A=20= PG_CONFIG=20=3D=20pg_config=0Adiff=20--git=20= a/src/test/modules/unsafe_tests/expected/guc_privs.out=20= b/src/test/modules/unsafe_tests/expected/guc_privs.out=0Anew=20file=20= mode=20100644=0Aindex=200000000000..c43c19d5e5=0A---=20/dev/null=0A+++=20= b/src/test/modules/unsafe_tests/expected/guc_privs.out=0A@@=20-0,0=20= +1,375=20@@=0A+--=20Test=20superuser=0A+--=20Superuser=20DBA=0A+CREATE=20= ROLE=20regress_admin=20SUPERUSER;=0A+--=20Perform=20operations=20as=20= user=20'regress_admin'=20--=0A+SET=20SESSION=20AUTHORIZATION=20= regress_admin;=0A+--=20PGC_BACKEND=0A+SET=20ignore_system_indexes=20=3D=20= OFF;=20=20--=20fail,=20cannot=20be=20set=20after=20connection=20start=0A= +ERROR:=20=20parameter=20"ignore_system_indexes"=20cannot=20be=20set=20= after=20connection=20start=0A+RESET=20ignore_system_indexes;=20=20--=20= fail,=20cannot=20be=20set=20after=20connection=20start=0A+ERROR:=20=20= parameter=20"ignore_system_indexes"=20cannot=20be=20set=20after=20= connection=20start=0A+ALTER=20SYSTEM=20SET=20ignore_system_indexes=20=3D=20= OFF;=20=20--=20ok=0A+ALTER=20SYSTEM=20RESET=20ignore_system_indexes;=20=20= --=20ok=0A+--=20PGC_INTERNAL=0A+SET=20block_size=20=3D=2050;=20=20--=20= fail,=20cannot=20be=20changed=0A+ERROR:=20=20parameter=20"block_size"=20= cannot=20be=20changed=0A+RESET=20block_size;=20=20--=20fail,=20cannot=20= be=20changed=0A+ERROR:=20=20parameter=20"block_size"=20cannot=20be=20= changed=0A+ALTER=20SYSTEM=20SET=20block_size=20=3D=2050;=20=20--=20fail,=20= cannot=20be=20changed=0A+ERROR:=20=20parameter=20"block_size"=20cannot=20= be=20changed=0A+ALTER=20SYSTEM=20RESET=20block_size;=20=20--=20fail,=20= cannot=20be=20changed=0A+ERROR:=20=20parameter=20"block_size"=20cannot=20= be=20changed=0A+--=20PGC_POSTMASTER=0A+SET=20autovacuum_freeze_max_age=20= =3D=201000050000;=20=20--=20fail,=20requires=20restart=0A+ERROR:=20=20= parameter=20"autovacuum_freeze_max_age"=20cannot=20be=20changed=20= without=20restarting=20the=20server=0A+RESET=20= autovacuum_freeze_max_age;=20=20--=20fail,=20requires=20restart=0A= +ERROR:=20=20parameter=20"autovacuum_freeze_max_age"=20cannot=20be=20= changed=20without=20restarting=20the=20server=0A+ALTER=20SYSTEM=20SET=20= autovacuum_freeze_max_age=20=3D=201000050000;=20=20--=20ok=0A+ALTER=20= SYSTEM=20RESET=20autovacuum_freeze_max_age;=20=20--=20ok=0A+ALTER=20= SYSTEM=20SET=20config_file=20=3D=20'/usr/local/data/postgresql.conf';=20=20= --=20fail,=20cannot=20be=20changed=0A+ERROR:=20=20parameter=20= "config_file"=20cannot=20be=20changed=0A+ALTER=20SYSTEM=20RESET=20= config_file;=20=20--=20fail,=20cannot=20be=20changed=0A+ERROR:=20=20= parameter=20"config_file"=20cannot=20be=20changed=0A+--=20PGC_SIGHUP=0A= +SET=20autovacuum=20=3D=20OFF;=20=20--=20fail,=20requires=20reload=0A= +ERROR:=20=20parameter=20"autovacuum"=20cannot=20be=20changed=20now=0A= +RESET=20autovacuum;=20=20--=20fail,=20requires=20reload=0A+ERROR:=20=20= parameter=20"autovacuum"=20cannot=20be=20changed=20now=0A+ALTER=20SYSTEM=20= SET=20autovacuum=20=3D=20OFF;=20=20--=20ok=0A+ALTER=20SYSTEM=20RESET=20= autovacuum;=20=20--=20ok=0A+--=20PGC_SUSET=0A+SET=20lc_messages=20=3D=20= 'C';=20=20--=20ok=0A+RESET=20lc_messages;=20=20--=20ok=0A+ALTER=20SYSTEM=20= SET=20lc_messages=20=3D=20'C';=20=20--=20ok=0A+ALTER=20SYSTEM=20RESET=20= lc_messages;=20=20--=20ok=0A+--=20PGC_SU_BACKEND=0A+SET=20= jit_debugging_support=20=3D=20OFF;=20=20--=20fail,=20cannot=20be=20set=20= after=20connection=20start=0A+ERROR:=20=20parameter=20= "jit_debugging_support"=20cannot=20be=20set=20after=20connection=20start=0A= +RESET=20jit_debugging_support;=20=20--=20fail,=20cannot=20be=20set=20= after=20connection=20start=0A+ERROR:=20=20parameter=20= "jit_debugging_support"=20cannot=20be=20set=20after=20connection=20start=0A= +ALTER=20SYSTEM=20SET=20jit_debugging_support=20=3D=20OFF;=20=20--=20ok=0A= +ALTER=20SYSTEM=20RESET=20jit_debugging_support;=20=20--=20ok=0A+--=20= PGC_USERSET=0A+SET=20DateStyle=20=3D=20'ISO,=20MDY';=20=20--=20ok=0A= +RESET=20DateStyle;=20=20--=20ok=0A+ALTER=20SYSTEM=20SET=20DateStyle=20=3D= =20'ISO,=20MDY';=20=20--=20ok=0A+ALTER=20SYSTEM=20RESET=20DateStyle;=20=20= --=20ok=0A+ALTER=20SYSTEM=20SET=20ssl_renegotiation_limit=20=3D=200;=20=20= --=20fail,=20cannot=20be=20changed=0A+ERROR:=20=20parameter=20= "ssl_renegotiation_limit"=20cannot=20be=20changed=0A+ALTER=20SYSTEM=20= RESET=20ssl_renegotiation_limit;=20=20--=20fail,=20cannot=20be=20changed=0A= +ERROR:=20=20parameter=20"ssl_renegotiation_limit"=20cannot=20be=20= changed=0A+--=20Finished=20testing=20superuser=0A+RESET=20= statement_timeout;=0A+--=20Create=20non-superuser=20with=20privileges=20= to=20configure=20host=20resource=20usage=0A+CREATE=20ROLE=20= regress_host_resource_admin=20NOSUPERUSER;=0A+--=20Revoke=20privileges=20= not=20yet=20granted=0A+REVOKE=20SET,=20ALTER=20SYSTEM=20ON=20PARAMETER=20= work_mem=20FROM=20regress_host_resource_admin;=0A+REVOKE=20SET,=20ALTER=20= SYSTEM=20ON=20PARAMETER=20zero_damaged_pages=20FROM=20= regress_host_resource_admin;=0A+--=20Check=20the=20new=20role=20does=20= not=20yet=20have=20privileges=20on=20parameters=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET,=20ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+--=20Check=20= inappropriate=20and=20nonsense=20privilege=20types=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SELECT,=20UPDATE,=20CREATE');=0A+ERROR:=20=20unrecognized=20privilege=20= type:=20"SELECT"=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'USAGE');=0A+ERROR:=20=20unrecognized=20privilege=20type:=20"USAGE"=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'work_mem',=20'WHATEVER');=0A+ERROR:=20=20unrecognized=20privilege=20= type:=20"WHATEVER"=0A+--=20Revoke,=20grant,=20and=20revoke=20again=20a=20= SUSET=20parameter=20not=20yet=20granted=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'SET');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20= =0A+-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+REVOKE=20SET=20= ON=20PARAMETER=20zero_damaged_pages=20FROM=20= regress_host_resource_admin;=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'SET');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20= =0A+-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+GRANT=20SET=20= ON=20PARAMETER=20zero_damaged_pages=20TO=20regress_host_resource_admin;=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'SET');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20= =0A+-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+REVOKE=20SET=20= ON=20PARAMETER=20zero_damaged_pages=20FROM=20= regress_host_resource_admin;=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'SET');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20= =0A+-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+--=20Revoke,=20= grant,=20and=20revoke=20again=20a=20USERSET=20parameter=20not=20yet=20= granted=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+REVOKE=20SET=20ON=20= PARAMETER=20work_mem=20FROM=20regress_host_resource_admin;=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+GRANT=20SET=20ON=20= PARAMETER=20work_mem=20TO=20regress_host_resource_admin;=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+REVOKE=20SET=20ON=20= PARAMETER=20work_mem=20FROM=20regress_host_resource_admin;=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20f=0A+(1=20row)=0A+=0A+--=20Grant=20= privileges=20on=20parameters=20to=20the=20new=20non-superuser=20role=0A= +GRANT=20SET,=20ALTER=20SYSTEM=20ON=20PARAMETER=0A+=09= autovacuum_work_mem,=20hash_mem_multiplier,=20logical_decoding_work_mem,=0A= +=09maintenance_work_mem,=20max_stack_depth,=20= min_dynamic_shared_memory,=0A+=09shared_buffers,=20temp_file_limit,=20= work_mem=0A+TO=20regress_host_resource_admin;=0A+REVOKE=20ALL=20ON=20= PARAMETER=20temp_buffers=20FROM=20PUBLIC;=0A+--=20Check=20the=20new=20= role=20now=20has=20privilges=20on=20parameters=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET,=20ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+=20has_parameter_privilege=20=0A= +-------------------------=0A+=20t=0A+(1=20row)=0A+=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET=20WITH=20GRANT=20OPTION,=20ALTER=20SYSTEM=20WITH=20GRANT=20= OPTION');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20f=0A+(1=20row)=0A+=0A+--=20Check=20again=20the=20inappropriate=20and=20= nonsense=20privilege=20types.=20=20The=20prior=20similar=20check=0A+--=20= was=20performed=20before=20any=20entry=20for=20work_mem=20existed.=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'work_mem',=20'SELECT,=20UPDATE,=20CREATE');=0A+ERROR:=20=20unrecognized=20= privilege=20type:=20"SELECT"=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'USAGE');=0A+ERROR:=20=20unrecognized=20privilege=20type:=20"USAGE"=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'work_mem',=20'WHATEVER');=0A+ERROR:=20=20unrecognized=20privilege=20= type:=20"WHATEVER"=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'WHATEVER=20WITH=20GRANT=20OPTION');=0A+ERROR:=20=20unrecognized=20= privilege=20type:=20"WHATEVER=20WITH=20GRANT=20OPTION"=0A+--=20Check=20= other=20function=20signatures=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=0A+=09=09=09=09=09= =09=09=20(SELECT=20oid=20FROM=20pg_catalog.pg_parameter_acl=20WHERE=20= parameter=20=3D=20'max_stack_depth'),=0A+=09=09=09=09=09=09=09=20'SET');=0A= +=20has_parameter_privilege=20=0A+-------------------------=0A+=20t=0A= +(1=20row)=0A+=0A+SELECT=20has_parameter_privilege((SELECT=20oid=20FROM=20= pg_catalog.pg_authid=20WHERE=20rolname=20=3D=20= 'regress_host_resource_admin'),=0A+=09=09=09=09=09=09=09=20= 'max_stack_depth',=0A+=09=09=09=09=09=09=09=20'SET');=0A+=20= has_parameter_privilege=20=0A+-------------------------=0A+=20t=0A+(1=20= row)=0A+=0A+SELECT=20has_parameter_privilege((SELECT=20oid=20FROM=20= pg_catalog.pg_authid=20WHERE=20rolname=20=3D=20= 'regress_host_resource_admin'),=0A+=09=09=09=09=09=09=09=20(SELECT=20oid=20= FROM=20pg_catalog.pg_parameter_acl=20WHERE=20parameter=20=3D=20= 'max_stack_depth'),=0A+=09=09=09=09=09=09=09=20'SET');=0A+=20= has_parameter_privilege=20=0A+-------------------------=0A+=20t=0A+(1=20= row)=0A+=0A+SELECT=20has_parameter_privilege('hash_mem_multiplier',=20= 'set');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20t=0A+(1=20row)=0A+=0A+SELECT=20has_parameter_privilege((SELECT=20oid=20= FROM=20pg_catalog.pg_parameter_acl=20WHERE=20parameter=20=3D=20= 'work_mem'),=0A+=09=09=09=09=09=09=09=20'alter=20system=20with=20grant=20= option');=0A+=20has_parameter_privilege=20=0A+-------------------------=0A= +=20t=0A+(1=20row)=0A+=0A+--=20Perform=20all=20operations=20as=20user=20= 'regress_host_resource_admin'=20--=0A+SET=20SESSION=20AUTHORIZATION=20= regress_host_resource_admin;=0A+ALTER=20SYSTEM=20SET=20= autovacuum_work_mem=20=3D=2032;=20=20--=20ok,=20privileges=20have=20been=20= granted=0A+ALTER=20SYSTEM=20SET=20ignore_system_indexes=20=3D=20OFF;=20=20= --=20fail,=20insufficient=20privileges=0A+ERROR:=20=20permission=20= denied=20to=20set=20parameter=20"ignore_system_indexes"=0A+ALTER=20= SYSTEM=20RESET=20autovacuum_multixact_freeze_max_age;=20=20--=20fail,=20= insufficient=20privileges=0A+ERROR:=20=20permission=20denied=20to=20set=20= parameter=20"autovacuum_multixact_freeze_max_age"=0A+SET=20jit_provider=20= =3D=20'llvmjit';=20=20--=20fail,=20insufficient=20privileges=0A+ERROR:=20= =20parameter=20"jit_provider"=20cannot=20be=20changed=20without=20= restarting=20the=20server=0A+SELECT=20set_config=20('jit_provider',=20= 'llvmjit',=20true);=20--=20fail,=20insufficient=20privileges=0A+ERROR:=20= =20parameter=20"jit_provider"=20cannot=20be=20changed=20without=20= restarting=20the=20server=0A+ALTER=20SYSTEM=20SET=20shared_buffers=20=3D=20= 50;=20=20--=20ok=0A+ALTER=20SYSTEM=20RESET=20shared_buffers;=20=20--=20= ok=0A+SET=20autovacuum_work_mem=20=3D=2050;=20=20--=20cannot=20be=20= changed=20now=0A+ERROR:=20=20parameter=20"autovacuum_work_mem"=20cannot=20= be=20changed=20now=0A+ALTER=20SYSTEM=20RESET=20temp_file_limit;=20=20--=20= ok=0A+SET=20TimeZone=20=3D=20'Europe/Helsinki';=20=20--=20ok=0A+SELECT=20= set_config=20('temp_buffers',=20'8192',=20false);=20--=20fail,=20= privileges=20have=20been=20revoked=0A+ERROR:=20=20permission=20denied=20= to=20set=20parameter=20"temp_buffers"=0A+ALTER=20SYSTEM=20RESET=20= autovacuum_work_mem;=20=20--=20ok,=20privileges=20have=20been=20granted=0A= +RESET=20TimeZone;=20=20--=20ok=0A+SET=20SESSION=20AUTHORIZATION=20= regress_admin;=0A+DROP=20ROLE=20regress_host_resource_admin;=20=20--=20= fail,=20privileges=20remain=0A+ERROR:=20=20role=20= "regress_host_resource_admin"=20cannot=20be=20dropped=20because=20some=20= objects=20depend=20on=20it=0A+DETAIL:=20=20privileges=20for=20parameter=20= work_mem=0A+privileges=20for=20parameter=20autovacuum_work_mem=0A= +privileges=20for=20parameter=20hash_mem_multiplier=0A+privileges=20for=20= parameter=20logical_decoding_work_mem=0A+privileges=20for=20parameter=20= maintenance_work_mem=0A+privileges=20for=20parameter=20max_stack_depth=0A= +privileges=20for=20parameter=20min_dynamic_shared_memory=0A+privileges=20= for=20parameter=20shared_buffers=0A+privileges=20for=20parameter=20= temp_file_limit=0A+--=20Use=20"revoke"=20to=20remove=20the=20privileges=20= and=20allow=20the=20role=20to=20be=20dropped=0A+REVOKE=20SET,=20ALTER=20= SYSTEM=20ON=20PARAMETER=0A+=09autovacuum_work_mem,=20= hash_mem_multiplier,=20logical_decoding_work_mem,=0A+=09= maintenance_work_mem,=20max_stack_depth,=20min_dynamic_shared_memory,=0A= +=09shared_buffers,=20temp_file_limit,=20work_mem=0A+FROM=20= regress_host_resource_admin;=0A+DROP=20ROLE=20= regress_host_resource_admin;=20=20--=20ok=0A+--=20Try=20that=20again,=20= but=20use=20"drop=20owned=20by"=20instead=20of=20"revoke"=0A+CREATE=20= ROLE=20regress_host_resource_admin=20NOSUPERUSER;=0A+SET=20SESSION=20= AUTHORIZATION=20regress_host_resource_admin;=0A+ALTER=20SYSTEM=20SET=20= autovacuum_work_mem=20=3D=2032;=20=20--=20fail,=20privileges=20not=20yet=20= granted=0A+ERROR:=20=20permission=20denied=20to=20set=20parameter=20= "autovacuum_work_mem"=0A+SET=20SESSION=20AUTHORIZATION=20regress_admin;=0A= +GRANT=20SET,=20ALTER=20SYSTEM=20ON=20PARAMETER=0A+=09= autovacuum_work_mem,=20hash_mem_multiplier,=20logical_decoding_work_mem,=0A= +=09maintenance_work_mem,=20max_stack_depth,=20= min_dynamic_shared_memory,=0A+=09shared_buffers,=20temp_file_limit,=20= work_mem=0A+TO=20regress_host_resource_admin;=0A+DROP=20ROLE=20= regress_host_resource_admin;=20=20--=20fail,=20privileges=20remain=0A= +ERROR:=20=20role=20"regress_host_resource_admin"=20cannot=20be=20= dropped=20because=20some=20objects=20depend=20on=20it=0A+DETAIL:=20=20= privileges=20for=20parameter=20work_mem=0A+privileges=20for=20parameter=20= autovacuum_work_mem=0A+privileges=20for=20parameter=20= hash_mem_multiplier=0A+privileges=20for=20parameter=20= logical_decoding_work_mem=0A+privileges=20for=20parameter=20= maintenance_work_mem=0A+privileges=20for=20parameter=20max_stack_depth=0A= +privileges=20for=20parameter=20min_dynamic_shared_memory=0A+privileges=20= for=20parameter=20shared_buffers=0A+privileges=20for=20parameter=20= temp_file_limit=0A+DROP=20OWNED=20BY=20regress_host_resource_admin=20= RESTRICT;=20--=20cascade=20should=20not=20be=20needed=0A+SET=20SESSION=20= AUTHORIZATION=20regress_host_resource_admin;=0A+ALTER=20SYSTEM=20SET=20= autovacuum_work_mem=20=3D=2032;=20=20--=20fail,=20"drop=20owned"=20has=20= dropped=20privileges=0A+ERROR:=20=20permission=20denied=20to=20set=20= parameter=20"autovacuum_work_mem"=0A+SET=20SESSION=20AUTHORIZATION=20= regress_admin;=0A+DROP=20ROLE=20regress_host_resource_admin;=20=20--=20= ok=0A+--=20Try=20that=20again,=20but=20use=20"reassign=20owned=20by"=20= this=20time=0A+CREATE=20ROLE=20regress_host_resource_admin=20= NOSUPERUSER;=0A+CREATE=20ROLE=20regress_host_resource_newadmin=20= NOSUPERUSER;=0A+GRANT=20SET,=20ALTER=20SYSTEM=20ON=20PARAMETER=0A+=09= autovacuum_work_mem,=20hash_mem_multiplier,=20logical_decoding_work_mem,=0A= +=09maintenance_work_mem,=20max_stack_depth,=20= min_dynamic_shared_memory,=0A+=09shared_buffers,=20temp_file_limit,=20= work_mem=0A+TO=20regress_host_resource_admin;=0A+REASSIGN=20OWNED=20BY=20= regress_host_resource_admin=20TO=20regress_host_resource_newadmin;=0A= +SET=20SESSION=20AUTHORIZATION=20regress_host_resource_admin;=0A+ALTER=20= SYSTEM=20SET=20autovacuum_work_mem=20=3D=2032;=20=20--=20ok,=20"reassign=20= owned"=20did=20not=20change=20privileges=0A+SET=20SESSION=20= AUTHORIZATION=20regress_admin;=0A+DROP=20ROLE=20= regress_host_resource_admin;=20=20--=20fail,=20privileges=20remain=0A= +ERROR:=20=20role=20"regress_host_resource_admin"=20cannot=20be=20= dropped=20because=20some=20objects=20depend=20on=20it=0A+DETAIL:=20=20= privileges=20for=20parameter=20work_mem=0A+privileges=20for=20parameter=20= autovacuum_work_mem=0A+privileges=20for=20parameter=20= hash_mem_multiplier=0A+privileges=20for=20parameter=20= logical_decoding_work_mem=0A+privileges=20for=20parameter=20= maintenance_work_mem=0A+privileges=20for=20parameter=20max_stack_depth=0A= +privileges=20for=20parameter=20min_dynamic_shared_memory=0A+privileges=20= for=20parameter=20shared_buffers=0A+privileges=20for=20parameter=20= temp_file_limit=0A+DROP=20ROLE=20regress_host_resource_newadmin;=20=20--=20= ok,=20nothing=20was=20transferred=0A+--=20Use=20"drop=20owned=20by"=20so=20= we=20can=20drop=20the=20role=0A+DROP=20OWNED=20BY=20= regress_host_resource_admin;=20=20--=20ok=0A+DROP=20ROLE=20= regress_host_resource_admin;=20=20--=20ok=0A+--=20Drop=20the=20test=20= superuser=0A+RESET=20SESSION=20AUTHORIZATION;=0A+DROP=20ROLE=20= regress_admin;=20--=20ok=0Adiff=20--git=20= a/src/test/modules/unsafe_tests/sql/guc_privs.sql=20= b/src/test/modules/unsafe_tests/sql/guc_privs.sql=0Anew=20file=20mode=20= 100644=0Aindex=200000000000..feae920379=0A---=20/dev/null=0A+++=20= b/src/test/modules/unsafe_tests/sql/guc_privs.sql=0A@@=20-0,0=20+1,174=20= @@=0A+--=20Test=20superuser=0A+--=20Superuser=20DBA=0A+CREATE=20ROLE=20= regress_admin=20SUPERUSER;=0A+--=20Perform=20operations=20as=20user=20= 'regress_admin'=20--=0A+SET=20SESSION=20AUTHORIZATION=20regress_admin;=0A= +--=20PGC_BACKEND=0A+SET=20ignore_system_indexes=20=3D=20OFF;=20=20--=20= fail,=20cannot=20be=20set=20after=20connection=20start=0A+RESET=20= ignore_system_indexes;=20=20--=20fail,=20cannot=20be=20set=20after=20= connection=20start=0A+ALTER=20SYSTEM=20SET=20ignore_system_indexes=20=3D=20= OFF;=20=20--=20ok=0A+ALTER=20SYSTEM=20RESET=20ignore_system_indexes;=20=20= --=20ok=0A+--=20PGC_INTERNAL=0A+SET=20block_size=20=3D=2050;=20=20--=20= fail,=20cannot=20be=20changed=0A+RESET=20block_size;=20=20--=20fail,=20= cannot=20be=20changed=0A+ALTER=20SYSTEM=20SET=20block_size=20=3D=2050;=20= =20--=20fail,=20cannot=20be=20changed=0A+ALTER=20SYSTEM=20RESET=20= block_size;=20=20--=20fail,=20cannot=20be=20changed=0A+--=20= PGC_POSTMASTER=0A+SET=20autovacuum_freeze_max_age=20=3D=201000050000;=20=20= --=20fail,=20requires=20restart=0A+RESET=20autovacuum_freeze_max_age;=20=20= --=20fail,=20requires=20restart=0A+ALTER=20SYSTEM=20SET=20= autovacuum_freeze_max_age=20=3D=201000050000;=20=20--=20ok=0A+ALTER=20= SYSTEM=20RESET=20autovacuum_freeze_max_age;=20=20--=20ok=0A+ALTER=20= SYSTEM=20SET=20config_file=20=3D=20'/usr/local/data/postgresql.conf';=20=20= --=20fail,=20cannot=20be=20changed=0A+ALTER=20SYSTEM=20RESET=20= config_file;=20=20--=20fail,=20cannot=20be=20changed=0A+--=20PGC_SIGHUP=0A= +SET=20autovacuum=20=3D=20OFF;=20=20--=20fail,=20requires=20reload=0A= +RESET=20autovacuum;=20=20--=20fail,=20requires=20reload=0A+ALTER=20= SYSTEM=20SET=20autovacuum=20=3D=20OFF;=20=20--=20ok=0A+ALTER=20SYSTEM=20= RESET=20autovacuum;=20=20--=20ok=0A+--=20PGC_SUSET=0A+SET=20lc_messages=20= =3D=20'C';=20=20--=20ok=0A+RESET=20lc_messages;=20=20--=20ok=0A+ALTER=20= SYSTEM=20SET=20lc_messages=20=3D=20'C';=20=20--=20ok=0A+ALTER=20SYSTEM=20= RESET=20lc_messages;=20=20--=20ok=0A+--=20PGC_SU_BACKEND=0A+SET=20= jit_debugging_support=20=3D=20OFF;=20=20--=20fail,=20cannot=20be=20set=20= after=20connection=20start=0A+RESET=20jit_debugging_support;=20=20--=20= fail,=20cannot=20be=20set=20after=20connection=20start=0A+ALTER=20SYSTEM=20= SET=20jit_debugging_support=20=3D=20OFF;=20=20--=20ok=0A+ALTER=20SYSTEM=20= RESET=20jit_debugging_support;=20=20--=20ok=0A+--=20PGC_USERSET=0A+SET=20= DateStyle=20=3D=20'ISO,=20MDY';=20=20--=20ok=0A+RESET=20DateStyle;=20=20= --=20ok=0A+ALTER=20SYSTEM=20SET=20DateStyle=20=3D=20'ISO,=20MDY';=20=20= --=20ok=0A+ALTER=20SYSTEM=20RESET=20DateStyle;=20=20--=20ok=0A+ALTER=20= SYSTEM=20SET=20ssl_renegotiation_limit=20=3D=200;=20=20--=20fail,=20= cannot=20be=20changed=0A+ALTER=20SYSTEM=20RESET=20= ssl_renegotiation_limit;=20=20--=20fail,=20cannot=20be=20changed=0A+--=20= Finished=20testing=20superuser=0A+RESET=20statement_timeout;=0A+--=20= Create=20non-superuser=20with=20privileges=20to=20configure=20host=20= resource=20usage=0A+CREATE=20ROLE=20regress_host_resource_admin=20= NOSUPERUSER;=0A+--=20Revoke=20privileges=20not=20yet=20granted=0A+REVOKE=20= SET,=20ALTER=20SYSTEM=20ON=20PARAMETER=20work_mem=20FROM=20= regress_host_resource_admin;=0A+REVOKE=20SET,=20ALTER=20SYSTEM=20ON=20= PARAMETER=20zero_damaged_pages=20FROM=20regress_host_resource_admin;=0A= +--=20Check=20the=20new=20role=20does=20not=20yet=20have=20privileges=20= on=20parameters=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET,=20ALTER=20SYSTEM');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+--=20Check=20inappropriate=20and=20nonsense=20= privilege=20types=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SELECT,=20UPDATE,=20CREATE');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'USAGE');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'WHATEVER');=0A+--=20Revoke,=20grant,=20and=20revoke=20again=20a=20SUSET=20= parameter=20not=20yet=20granted=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'ALTER=20SYSTEM');=0A+REVOKE=20SET=20ON=20= PARAMETER=20zero_damaged_pages=20FROM=20regress_host_resource_admin;=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'ALTER=20SYSTEM');=0A+GRANT=20SET=20ON=20= PARAMETER=20zero_damaged_pages=20TO=20regress_host_resource_admin;=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'ALTER=20SYSTEM');=0A+REVOKE=20SET=20ON=20= PARAMETER=20zero_damaged_pages=20FROM=20regress_host_resource_admin;=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20= 'zero_damaged_pages',=20'ALTER=20SYSTEM');=0A+--=20Revoke,=20grant,=20= and=20revoke=20again=20a=20USERSET=20parameter=20not=20yet=20granted=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'work_mem',=20'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+REVOKE=20SET=20ON=20PARAMETER=20work_mem=20FROM=20= regress_host_resource_admin;=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+GRANT=20SET=20ON=20PARAMETER=20work_mem=20TO=20= regress_host_resource_admin;=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+REVOKE=20SET=20ON=20PARAMETER=20work_mem=20FROM=20= regress_host_resource_admin;=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+--=20Grant=20privileges=20on=20parameters=20to=20= the=20new=20non-superuser=20role=0A+GRANT=20SET,=20ALTER=20SYSTEM=20ON=20= PARAMETER=0A+=09autovacuum_work_mem,=20hash_mem_multiplier,=20= logical_decoding_work_mem,=0A+=09maintenance_work_mem,=20= max_stack_depth,=20min_dynamic_shared_memory,=0A+=09shared_buffers,=20= temp_file_limit,=20work_mem=0A+TO=20regress_host_resource_admin;=0A= +REVOKE=20ALL=20ON=20PARAMETER=20temp_buffers=20FROM=20PUBLIC;=0A+--=20= Check=20the=20new=20role=20now=20has=20privilges=20on=20parameters=0A= +SELECT=20has_parameter_privilege('regress_host_resource_admin',=20= 'work_mem',=20'SET,=20ALTER=20SYSTEM');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'ALTER=20SYSTEM');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SET=20WITH=20GRANT=20OPTION,=20ALTER=20SYSTEM=20WITH=20GRANT=20= OPTION');=0A+--=20Check=20again=20the=20inappropriate=20and=20nonsense=20= privilege=20types.=20=20The=20prior=20similar=20check=0A+--=20was=20= performed=20before=20any=20entry=20for=20work_mem=20existed.=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'SELECT,=20UPDATE,=20CREATE');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'USAGE');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'WHATEVER');=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=20'work_mem',=20= 'WHATEVER=20WITH=20GRANT=20OPTION');=0A+--=20Check=20other=20function=20= signatures=0A+SELECT=20= has_parameter_privilege('regress_host_resource_admin',=0A+=09=09=09=09=09= =09=09=20(SELECT=20oid=20FROM=20pg_catalog.pg_parameter_acl=20WHERE=20= parameter=20=3D=20'max_stack_depth'),=0A+=09=09=09=09=09=09=09=20'SET');=0A= +SELECT=20has_parameter_privilege((SELECT=20oid=20FROM=20= pg_catalog.pg_authid=20WHERE=20rolname=20=3D=20= 'regress_host_resource_admin'),=0A+=09=09=09=09=09=09=09=20= 'max_stack_depth',=0A+=09=09=09=09=09=09=09=20'SET');=0A+SELECT=20= has_parameter_privilege((SELECT=20oid=20FROM=20pg_catalog.pg_authid=20= WHERE=20rolname=20=3D=20'regress_host_resource_admin'),=0A+=09=09=09=09=09= =09=09=20(SELECT=20oid=20FROM=20pg_catalog.pg_parameter_acl=20WHERE=20= parameter=20=3D=20'max_stack_depth'),=0A+=09=09=09=09=09=09=09=20'SET');=0A= +SELECT=20has_parameter_privilege('hash_mem_multiplier',=20'set');=0A= +SELECT=20has_parameter_privilege((SELECT=20oid=20FROM=20= pg_catalog.pg_parameter_acl=20WHERE=20parameter=20=3D=20'work_mem'),=0A+=09= =09=09=09=09=09=09=20'alter=20system=20with=20grant=20option');=0A+--=20= Perform=20all=20operations=20as=20user=20'regress_host_resource_admin'=20= --=0A+SET=20SESSION=20AUTHORIZATION=20regress_host_resource_admin;=0A= +ALTER=20SYSTEM=20SET=20autovacuum_work_mem=20=3D=2032;=20=20--=20ok,=20= privileges=20have=20been=20granted=0A+ALTER=20SYSTEM=20SET=20= ignore_system_indexes=20=3D=20OFF;=20=20--=20fail,=20insufficient=20= privileges=0A+ALTER=20SYSTEM=20RESET=20= autovacuum_multixact_freeze_max_age;=20=20--=20fail,=20insufficient=20= privileges=0A+SET=20jit_provider=20=3D=20'llvmjit';=20=20--=20fail,=20= insufficient=20privileges=0A+SELECT=20set_config=20('jit_provider',=20= 'llvmjit',=20true);=20--=20fail,=20insufficient=20privileges=0A+ALTER=20= SYSTEM=20SET=20shared_buffers=20=3D=2050;=20=20--=20ok=0A+ALTER=20SYSTEM=20= RESET=20shared_buffers;=20=20--=20ok=0A+SET=20autovacuum_work_mem=20=3D=20= 50;=20=20--=20cannot=20be=20changed=20now=0A+ALTER=20SYSTEM=20RESET=20= temp_file_limit;=20=20--=20ok=0A+SET=20TimeZone=20=3D=20= 'Europe/Helsinki';=20=20--=20ok=0A+SELECT=20set_config=20= ('temp_buffers',=20'8192',=20false);=20--=20fail,=20privileges=20have=20= been=20revoked=0A+ALTER=20SYSTEM=20RESET=20autovacuum_work_mem;=20=20--=20= ok,=20privileges=20have=20been=20granted=0A+RESET=20TimeZone;=20=20--=20= ok=0A+SET=20SESSION=20AUTHORIZATION=20regress_admin;=0A+DROP=20ROLE=20= regress_host_resource_admin;=20=20--=20fail,=20privileges=20remain=0A+--=20= Use=20"revoke"=20to=20remove=20the=20privileges=20and=20allow=20the=20= role=20to=20be=20dropped=0A+REVOKE=20SET,=20ALTER=20SYSTEM=20ON=20= PARAMETER=0A+=09autovacuum_work_mem,=20hash_mem_multiplier,=20= logical_decoding_work_mem,=0A+=09maintenance_work_mem,=20= max_stack_depth,=20min_dynamic_shared_memory,=0A+=09shared_buffers,=20= temp_file_limit,=20work_mem=0A+FROM=20regress_host_resource_admin;=0A= +DROP=20ROLE=20regress_host_resource_admin;=20=20--=20ok=0A+--=20Try=20= that=20again,=20but=20use=20"drop=20owned=20by"=20instead=20of=20= "revoke"=0A+CREATE=20ROLE=20regress_host_resource_admin=20NOSUPERUSER;=0A= +SET=20SESSION=20AUTHORIZATION=20regress_host_resource_admin;=0A+ALTER=20= SYSTEM=20SET=20autovacuum_work_mem=20=3D=2032;=20=20--=20fail,=20= privileges=20not=20yet=20granted=0A+SET=20SESSION=20AUTHORIZATION=20= regress_admin;=0A+GRANT=20SET,=20ALTER=20SYSTEM=20ON=20PARAMETER=0A+=09= autovacuum_work_mem,=20hash_mem_multiplier,=20logical_decoding_work_mem,=0A= +=09maintenance_work_mem,=20max_stack_depth,=20= min_dynamic_shared_memory,=0A+=09shared_buffers,=20temp_file_limit,=20= work_mem=0A+TO=20regress_host_resource_admin;=0A+DROP=20ROLE=20= regress_host_resource_admin;=20=20--=20fail,=20privileges=20remain=0A= +DROP=20OWNED=20BY=20regress_host_resource_admin=20RESTRICT;=20--=20= cascade=20should=20not=20be=20needed=0A+SET=20SESSION=20AUTHORIZATION=20= regress_host_resource_admin;=0A+ALTER=20SYSTEM=20SET=20= autovacuum_work_mem=20=3D=2032;=20=20--=20fail,=20"drop=20owned"=20has=20= dropped=20privileges=0A+SET=20SESSION=20AUTHORIZATION=20regress_admin;=0A= +DROP=20ROLE=20regress_host_resource_admin;=20=20--=20ok=0A+--=20Try=20= that=20again,=20but=20use=20"reassign=20owned=20by"=20this=20time=0A= +CREATE=20ROLE=20regress_host_resource_admin=20NOSUPERUSER;=0A+CREATE=20= ROLE=20regress_host_resource_newadmin=20NOSUPERUSER;=0A+GRANT=20SET,=20= ALTER=20SYSTEM=20ON=20PARAMETER=0A+=09autovacuum_work_mem,=20= hash_mem_multiplier,=20logical_decoding_work_mem,=0A+=09= maintenance_work_mem,=20max_stack_depth,=20min_dynamic_shared_memory,=0A= +=09shared_buffers,=20temp_file_limit,=20work_mem=0A+TO=20= regress_host_resource_admin;=0A+REASSIGN=20OWNED=20BY=20= regress_host_resource_admin=20TO=20regress_host_resource_newadmin;=0A= +SET=20SESSION=20AUTHORIZATION=20regress_host_resource_admin;=0A+ALTER=20= SYSTEM=20SET=20autovacuum_work_mem=20=3D=2032;=20=20--=20ok,=20"reassign=20= owned"=20did=20not=20change=20privileges=0A+SET=20SESSION=20= AUTHORIZATION=20regress_admin;=0A+DROP=20ROLE=20= regress_host_resource_admin;=20=20--=20fail,=20privileges=20remain=0A= +DROP=20ROLE=20regress_host_resource_newadmin;=20=20--=20ok,=20nothing=20= was=20transferred=0A+--=20Use=20"drop=20owned=20by"=20so=20we=20can=20= drop=20the=20role=0A+DROP=20OWNED=20BY=20regress_host_resource_admin;=20=20= --=20ok=0A+DROP=20ROLE=20regress_host_resource_admin;=20=20--=20ok=0A+--=20= Drop=20the=20test=20superuser=0A+RESET=20SESSION=20AUTHORIZATION;=0A= +DROP=20ROLE=20regress_admin;=20--=20ok=0Adiff=20--git=20= a/src/test/regress/expected/rules.out=20= b/src/test/regress/expected/rules.out=0Aindex=20423b9b99fb..5322039237=20= 100644=0A---=20a/src/test/regress/expected/rules.out=0A+++=20= b/src/test/regress/expected/rules.out=0A@@=20-1392,6=20+1392,19=20@@=20= pg_matviews|=20SELECT=20n.nspname=20AS=20schemaname,=0A=20=20=20=20=20=20= LEFT=20JOIN=20pg_namespace=20n=20ON=20((n.oid=20=3D=20c.relnamespace)))=0A= =20=20=20=20=20=20LEFT=20JOIN=20pg_tablespace=20t=20ON=20((t.oid=20=3D=20= c.reltablespace)))=0A=20=20=20WHERE=20(c.relkind=20=3D=20'm'::"char");=0A= +pg_parameter_privileges|=20SELECT=20grantor.rolname=20AS=20grantor,=0A+=20= =20=20=20grantee.rolname=20AS=20grantee,=0A+=20=20=20=20= set_acl.parameter,=0A+=20=20=20=20acl.privilege_type,=0A+=20=20=20=20= acl.is_grantable=0A+=20=20=20FROM=20pg_parameter_acl=20set_acl,=0A+=20=20= =20=20((LATERAL=20(=20SELECT=20aclexplode.grantor,=0A+=20=20=20=20=20=20=20= =20=20=20=20=20aclexplode.grantee,=0A+=20=20=20=20=20=20=20=20=20=20=20=20= aclexplode.privilege_type,=0A+=20=20=20=20=20=20=20=20=20=20=20=20= aclexplode.is_grantable=0A+=20=20=20=20=20=20=20=20=20=20=20FROM=20= aclexplode(set_acl.setacl)=20aclexplode(grantor,=20grantee,=20= privilege_type,=20is_grantable))=20acl=0A+=20=20=20=20=20LEFT=20JOIN=20= pg_authid=20grantee=20ON=20((acl.grantee=20=3D=20grantee.oid)))=0A+=20=20= =20=20=20LEFT=20JOIN=20pg_authid=20grantor=20ON=20((acl.grantor=20=3D=20= grantor.oid)));=0A=20pg_policies|=20SELECT=20n.nspname=20AS=20= schemaname,=0A=20=20=20=20=20c.relname=20AS=20tablename,=0A=20=20=20=20=20= pol.polname=20AS=20policyname,=0A--=20=0A2.35.1=0A=0A= --Apple-Mail=_1F5504FD-28BA-45DF-9BE4-262FCF180738 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 =E2=80=94 Mark Dilger EnterpriseDB: http://www.enterprisedb.com The Enterprise PostgreSQL Company --Apple-Mail=_1F5504FD-28BA-45DF-9BE4-262FCF180738--