mirror of https://github.com/postgres/postgres
have adequate mechanisms for tracking the contents of databases and tablespaces). This solves the longstanding problem that you can drop a user who still owns objects and/or has access permissions. Alvaro Herrera, with some kibitzing from Tom Lane.REL8_1_STABLE
Tom Lane
20 years ago
parent
442b59dd8b
commit
59d1b3d99e
File diff suppressed because it is too large
Load Diff
@ -0,0 +1,91 @@ |
||||
/*-------------------------------------------------------------------------
|
||||
* |
||||
* pg_shdepend.h |
||||
* definition of the system "shared dependency" relation (pg_shdepend) |
||||
* along with the relation's initial contents. |
||||
* |
||||
* |
||||
* Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group |
||||
* Portions Copyright (c) 1994, Regents of the University of California |
||||
* |
||||
* $PostgreSQL: pgsql/src/include/catalog/pg_shdepend.h,v 1.1 2005/07/07 20:39:59 tgl Exp $ |
||||
* |
||||
* NOTES |
||||
* the genbki.sh script reads this file and generates .bki |
||||
* information from the DATA() statements. |
||||
* |
||||
*------------------------------------------------------------------------- |
||||
*/ |
||||
#ifndef PG_SHDEPEND_H |
||||
#define PG_SHDEPEND_H |
||||
|
||||
/* ----------------
|
||||
* postgres.h contains the system type definitions and the |
||||
* CATALOG(), BKI_BOOTSTRAP and DATA() sugar words so this file |
||||
* can be read by both genbki.sh and the C compiler. |
||||
* ---------------- |
||||
*/ |
||||
|
||||
/* ----------------
|
||||
* pg_shdepend definition. cpp turns this into |
||||
* typedef struct FormData_pg_shdepend |
||||
* ---------------- |
||||
*/ |
||||
#define SharedDependRelationId 1214 |
||||
CATALOG(pg_shdepend,1214) BKI_SHARED_RELATION BKI_WITHOUT_OIDS |
||||
{ |
||||
/*
|
||||
* Identification of the dependent (referencing) object. |
||||
* |
||||
* These fields are all zeroes for a DEPENDENCY_PIN entry. Also, |
||||
* dbid can be zero to denote a shared object. |
||||
*/ |
||||
Oid dbid; /* OID of database containing object */ |
||||
Oid classid; /* OID of table containing object */ |
||||
Oid objid; /* OID of object itself */ |
||||
|
||||
/*
|
||||
* Identification of the independent (referenced) object. This is |
||||
* always a shared object, so we need no database ID field. |
||||
*/ |
||||
Oid refclassid; /* OID of table containing object */ |
||||
Oid refobjid; /* OID of object itself */ |
||||
|
||||
/*
|
||||
* Precise semantics of the relationship are specified by the deptype |
||||
* field. See SharedDependencyType in catalog/dependency.h. |
||||
*/ |
||||
char deptype; /* see codes in dependency.h */ |
||||
} FormData_pg_shdepend; |
||||
|
||||
/* ----------------
|
||||
* Form_pg_shdepend corresponds to a pointer to a row with |
||||
* the format of pg_shdepend relation. |
||||
* ---------------- |
||||
*/ |
||||
typedef FormData_pg_shdepend *Form_pg_shdepend; |
||||
|
||||
/* ----------------
|
||||
* compiler constants for pg_shdepend |
||||
* ---------------- |
||||
*/ |
||||
#define Natts_pg_shdepend 6 |
||||
#define Anum_pg_shdepend_dbid 1 |
||||
#define Anum_pg_shdepend_classid 2 |
||||
#define Anum_pg_shdepend_objid 3 |
||||
#define Anum_pg_shdepend_refclassid 4 |
||||
#define Anum_pg_shdepend_refobjid 5 |
||||
#define Anum_pg_shdepend_deptype 6 |
||||
|
||||
|
||||
/*
|
||||
* pg_shdepend has no preloaded contents; system-defined dependencies are |
||||
* loaded into it during a late stage of the initdb process. |
||||
* |
||||
* NOTE: we do not represent all possible dependency pairs in pg_shdepend; |
||||
* for example, there's not much value in creating an explicit dependency |
||||
* from a relation to its database. Currently, only dependencies on roles |
||||
* are explicitly stored in pg_shdepend. |
||||
*/ |
||||
|
||||
#endif /* PG_SHDEPEND_H */ |
||||
@ -0,0 +1,39 @@ |
||||
-- |
||||
-- DEPENDENCIES |
||||
-- |
||||
CREATE USER regression_user; |
||||
CREATE USER regression_user2; |
||||
CREATE USER regression_user3; |
||||
CREATE GROUP regression_group; |
||||
CREATE TABLE deptest (); |
||||
GRANT SELECT ON TABLE deptest TO GROUP regression_group; |
||||
GRANT ALL ON TABLE deptest TO regression_user, regression_user2; |
||||
-- can't drop neither because they have privileges somewhere |
||||
DROP USER regression_user; |
||||
ERROR: role "regression_user" cannot be dropped because some objects depend on it |
||||
DETAIL: access to table deptest |
||||
DROP GROUP regression_group; |
||||
ERROR: role "regression_group" cannot be dropped because some objects depend on it |
||||
DETAIL: access to table deptest |
||||
-- if we revoke the privileges we can drop the group |
||||
REVOKE SELECT ON deptest FROM GROUP regression_group; |
||||
DROP GROUP regression_group; |
||||
-- can't drop the user if we revoke the privileges partially |
||||
REVOKE SELECT, INSERT, UPDATE, DELETE, RULE, REFERENCES ON deptest FROM regression_user; |
||||
DROP USER regression_user; |
||||
ERROR: role "regression_user" cannot be dropped because some objects depend on it |
||||
DETAIL: access to table deptest |
||||
-- now we are OK to drop him |
||||
REVOKE TRIGGER ON deptest FROM regression_user; |
||||
DROP USER regression_user; |
||||
-- we are OK too if we drop the privileges all at once |
||||
REVOKE ALL ON deptest FROM regression_user2; |
||||
DROP USER regression_user2; |
||||
-- can't drop the owner of an object |
||||
ALTER TABLE deptest OWNER TO regression_user3; |
||||
DROP USER regression_user3; |
||||
ERROR: role "regression_user3" cannot be dropped because some objects depend on it |
||||
DETAIL: owner of table deptest |
||||
-- if we drop the object, we can drop the user too |
||||
DROP TABLE deptest; |
||||
DROP USER regression_user3; |
||||
@ -0,0 +1,41 @@ |
||||
-- |
||||
-- DEPENDENCIES |
||||
-- |
||||
|
||||
CREATE USER regression_user; |
||||
CREATE USER regression_user2; |
||||
CREATE USER regression_user3; |
||||
CREATE GROUP regression_group; |
||||
|
||||
CREATE TABLE deptest (); |
||||
|
||||
GRANT SELECT ON TABLE deptest TO GROUP regression_group; |
||||
GRANT ALL ON TABLE deptest TO regression_user, regression_user2; |
||||
|
||||
-- can't drop neither because they have privileges somewhere |
||||
DROP USER regression_user; |
||||
DROP GROUP regression_group; |
||||
|
||||
-- if we revoke the privileges we can drop the group |
||||
REVOKE SELECT ON deptest FROM GROUP regression_group; |
||||
DROP GROUP regression_group; |
||||
|
||||
-- can't drop the user if we revoke the privileges partially |
||||
REVOKE SELECT, INSERT, UPDATE, DELETE, RULE, REFERENCES ON deptest FROM regression_user; |
||||
DROP USER regression_user; |
||||
|
||||
-- now we are OK to drop him |
||||
REVOKE TRIGGER ON deptest FROM regression_user; |
||||
DROP USER regression_user; |
||||
|
||||
-- we are OK too if we drop the privileges all at once |
||||
REVOKE ALL ON deptest FROM regression_user2; |
||||
DROP USER regression_user2; |
||||
|
||||
-- can't drop the owner of an object |
||||
ALTER TABLE deptest OWNER TO regression_user3; |
||||
DROP USER regression_user3; |
||||
|
||||
-- if we drop the object, we can drop the user too |
||||
DROP TABLE deptest; |
||||
DROP USER regression_user3; |
||||
Loading…
Reference in new issue