24 Commits (b83e8a2ca2eb381ea0a48e5b2d4e4cdb74febc45)

Author	SHA1	Message	Date
Tom Lane	cf590c568d	Update contrib/sepgsql regression tests for commit 89e51abcb. ... Oversight revealed by buildfarm.	1 year ago
Alvaro Herrera	6f8bb7c1e9	Revert structural changes to not-null constraints ... There are some problems with the new way to handle these constraints that were detected at the last minute, and require fixes that appear too invasive to be doing this late in the cycle. Revert this (again) for now, we'll try again with these problems fixed. The following commits are reverted: b0e96f3119 Catalog not-null constraints 9b581c5341 Disallow changing NO INHERIT status of a not-null constraint d0ec2ddbe0 Fix not-null constraint test ac22a9545c Move privilege check to the right place b0f7dd915b Check stack depth in new recursive functions 3af7217942 Update information_schema definition for not-null constraints c3709100be Fix propagating attnotnull in multiple inheritance d9f686a72e Fix restore of not-null constraints with inheritance d72d32f52d Don't try to assign smart names to constraints 0cd711271d Better handle indirect constraint drops 13daa33fa5 Disallow NO INHERIT not-null constraints on partitioned tables d45597f72f Disallow direct change of NO INHERIT of not-null constraints 21ac38f498 Fix inconsistencies in error messages Discussion: https://postgr.es/m/202405110940.joxlqcx4dogd@alvherre.pgsql	2 years ago
Jeff Davis	c7ea3f4229	Update sepgsql expected output. ... Fix for buildfarm member rhinoceros after commit 2af07e2f74.	2 years ago
Alvaro Herrera	b0e96f3119	Catalog not-null constraints ... We now create contype='n' pg_constraint rows for not-null constraints. We propagate these constraints to other tables during operations such as adding inheritance relationships, creating and attaching partitions and creating tables LIKE other tables. We also spawn not-null constraints for inheritance child tables when their parents have primary keys. These related constraints mostly follow the well-known rules of conislocal and coninhcount that we have for CHECK constraints, with some adaptations: for example, as opposed to CHECK constraints, we don't match not-null ones by name when descending a hierarchy to alter it, instead matching by column name that they apply to. This means we don't require the constraint names to be identical across a hierarchy. For now, we omit them for system catalogs. Maybe this is worth reconsidering. We don't support NOT VALID nor DEFERRABLE clauses either; these can be added as separate features later (this patch is already large and complicated enough.) psql shows these constraints in \d+. pg_dump requires some ad-hoc hacks, particularly when dumping a primary key. We now create one "throwaway" not-null constraint for each column in the PK together with the CREATE TABLE command, and once the PK is created, all those throwaway constraints are removed. This avoids having to check each tuple for nullness when the dump restores the primary key creation. pg_upgrading from an older release requires a somewhat brittle procedure to create a constraint state that matches what would be created if the database were being created fresh in Postgres 17. I have tested all the scenarios I could think of, and it works correctly as far as I can tell, but I could have neglected weird cases. This patch has been very long in the making. The first patch was written by Bernd Helmle in 2010 to add a new pg_constraint.contype value ('n'), which I (Álvaro) then hijacked in 2011 and 2012, until that one was killed by the realization that we ought to use contype='c' instead: manufactured CHECK constraints. However, later SQL standard development, as well as nonobvious emergent properties of that design (mostly, failure to distinguish them from "normal" CHECK constraints as well as the performance implication of having to test the CHECK expression) led us to reconsider this choice, so now the current implementation uses contype='n' again. During Postgres 16 this had already been introduced by commit e056c557ae, but there were some problems mainly with the pg_upgrade procedure that couldn't be fixed in reasonable time, so it was reverted. In 2016 Vitaly Burovoy also worked on this feature[1] but found no consensus for his proposed approach, which was claimed to be closer to the letter of the standard, requiring an additional pg_attribute column to track the OID of the not-null constraint for that column. [1] https://postgr.es/m/CAKOSWNkN6HSyatuys8xZxzRCR-KL1OkHS5-b9qd9bf1Rad3PLA@mail.gmail.com Author: Álvaro Herrera <alvherre@alvh.no-ip.org> Author: Bernd Helmle <mailings@oopsware.de> Reviewed-by: Justin Pryzby <pryzby@telsasoft.com> Reviewed-by: Peter Eisentraut <peter.eisentraut@enterprisedb.com> Reviewed-by: Dean Rasheed <dean.a.rasheed@gmail.com>	2 years ago
Tom Lane	8d525d7b95	Adjust sepgsql expected output for 681d9e462 et al. ... Security: CVE-2023-2454	3 years ago
Alvaro Herrera	21e6bf4ddd	Revert "Adjust contrib/sepgsql regression test expected outputs." ... This reverts commit 76c111a7f166; should have been included in 9ce04b50e1. Noted by Joe Conway	3 years ago
Tom Lane	76c111a7f1	Adjust contrib/sepgsql regression test expected outputs. ... Per buildfarm, the log output has changed as a consequence of commit e056c557a changing the catalog accesses performed in some commands. Discussion: https://postgr.es/m/20230407211950.aojbdirwdrxjeyzb@awork3.anarazel.de	3 years ago
Tom Lane	134d974636	Include permissive/enforcing state in sepgsql log messages. ... SELinux itself does this (at least in modern releases), and it seems like a good idea to reduce confusion. Dave Page Discussion: https://postgr.es/m/CA+OCxowsQoLEYc=jN7OtNvOdX0Jg5L7nMYt++=k0X78HGq-sXg@mail.gmail.com	4 years ago
Michael Paquier	1e3445237b	Fix regression test output of sepgsql ... The difference is caused by 7b56584, for the tests involving a table rewrite. Per buildfarm member rhinoceros. Discussion: https://postgr.es/m/YRHxXcyFjPuPTZui@paquier.xyz	4 years ago
Michael Paquier	14ac4237cb	Update test output of sepgsql for ALTER TABLE COLUMN DROP ... 1df5875 has changed the way dependencies are dropped for this command with inheritance trees, which impacts sepgsql. This just updates the regression test output to take care of the failures and adapt to the new code. Reported by buildfarm member rhinoceros. Author: Michael Paquier Reviewed-by: Tom Lane Discussion: https://postgr.es/m/20191013101331.GC1434@paquier.xyz Backpatch-through: 12	6 years ago
Tom Lane	071e11898d	Fix sepgsql regression test. ... Message order in the expected output changes due to commit f1ad067fc. Per buildfarm. Discussion: https://postgr.es/m/20190121201134.dyx6anto6akflh5d@alap3.anarazel.de	7 years ago
Andres Freund	7306d5e920	Blind attempt at fixing sepgsql output for 578b22.	7 years ago
Andres Freund	578b229718	Remove WITH OIDS support, change oid catalog column visibility. ... Previously tables declared WITH OIDS, including a significant fraction of the catalog tables, stored the oid column not as a normal column, but as part of the tuple header. This special column was not shown by default, which was somewhat odd, as it's often (consider e.g. pg_class.oid) one of the more important parts of a row. Neither pg_dump nor COPY included the contents of the oid column by default. The fact that the oid column was not an ordinary column necessitated a significant amount of special case code to support oid columns. That already was painful for the existing, but upcoming work aiming to make table storage pluggable, would have required expanding and duplicating that "specialness" significantly. WITH OIDS has been deprecated since 2005 (commit ff02d0a05280e0). Remove it. Removing includes: - CREATE TABLE and ALTER TABLE syntax for declaring the table to be WITH OIDS has been removed (WITH (oids[ = true]) will error out) - pg_dump does not support dumping tables declared WITH OIDS and will issue a warning when dumping one (and ignore the oid column). - restoring an pg_dump archive with pg_restore will warn when restoring a table with oid contents (and ignore the oid column) - COPY will refuse to load binary dump that includes oids. - pg_upgrade will error out when encountering tables declared WITH OIDS, they have to be altered to remove the oid column first. - Functionality to access the oid of the last inserted row (like plpgsql's RESULT_OID, spi's SPI_lastoid, ...) has been removed. The syntax for declaring a table WITHOUT OIDS (or WITH (oids = false) for CREATE TABLE) is still supported. While that requires a bit of support code, it seems unnecessary to break applications / dumps that do not use oids, and are explicit about not using them. The biggest user of WITH OID columns was postgres' catalog. This commit changes all 'magic' oid columns to be columns that are normally declared and stored. To reduce unnecessary query breakage all the newly added columns are still named 'oid', even if a table's column naming scheme would indicate 'reloid' or such. This obviously requires adapting a lot code, mostly replacing oid access via HeapTupleGetOid() with access to the underlying Form_pg_*->oid column. The bootstrap process now assigns oids for all oid columns in genbki.pl that do not have an explicit value (starting at the largest oid previously used), only oids assigned later by oids will be above FirstBootstrapObjectId. As the oid column now is a normal column the special bootstrap syntax for oids has been removed. Oids are not automatically assigned during insertion anymore, all backend code explicitly assigns oids with GetNewOidWithIndex(). For the rare case that insertions into the catalog via SQL are called for the new pg_nextoid() function can be used (which only works on catalog tables). The fact that oid columns on system tables are now normal columns means that they will be included in the set of columns expanded by * (i.e. SELECT * FROM pg_class will now include the table's oid, previously it did not). It'd not technically be hard to hide oid column by default, but that'd mean confusing behavior would either have to be carried forward forever, or it'd cause breakage down the line. While it's not unlikely that further adjustments are needed, the scope/invasiveness of the patch makes it worthwhile to get merge this now. It's painful to maintain externally, too complicated to commit after the code code freeze, and a dependency of a number of other patches. Catversion bump, for obvious reasons. Author: Andres Freund, with contributions by John Naylor Discussion: https://postgr.es/m/20180930034810.ywp2c7awz7opzcfr@alap3.anarazel.de	7 years ago
Tom Lane	2dd510e630	Fix contrib/sepgsql regression tests for partition NOT NULL change. ... Commit 3ec76ff1f changed the partitioning logic to not install a forced NOT NULL constraint on range partitioning columns. This affects the expected output for contrib/sepgsql, because there's no longer LOG entries reporting allowance of such a constraint. Per buildfarm.	9 years ago
Joe Conway	25542d77dd	Add partitioned table support to sepgsql ... The new partitioned table capability added a new relkind, namely RELKIND_PARTITIONED_TABLE. Update sepgsql to treat this new relkind exactly the same way it does RELKIND_RELATION. In addition, add regression test coverage for partitioned tables. Issue raised by Stephen Frost and initial patch by Mike Palmiotto. Review by Tom Lane and Robert Haas, and editorializing by me. Discussion: https://postgr.es/m/flat/623bcaae-112e-ced0-8c22-a84f75ae0c53%40joeconway.com	9 years ago
Andres Freund	83bbcb04ab	Blindly attempt to fix sepgsql tests. ... Due to b8d7f053c5 some permission checks are now happening even on empty tables, and some of the checks move around. Discussion: https://postgr.es/m/95bdb608-093c-160f-c6be-983a36ccd7f9@joeconway.com	9 years ago
Tom Lane	18555b1323	Establish conventions about global object names used in regression tests. ... To ensure that "make installcheck" can be used safely against an existing installation, we need to be careful about what global object names (database, role, and tablespace names) we use; otherwise we might accidentally clobber important objects. There's been a weak consensus that test databases should have names including "regression", and that test role names should start with "regress_", but we didn't have any particular rule about tablespace names; and neither of the other rules was followed with any consistency either. This commit moves us a long way towards having a hard-and-fast rule that regression test databases must have names including "regression", and that test role and tablespace names must start with "regress_". It's not completely there because I did not touch some test cases in rolenames.sql that test creation of special role names like "session_user". That will require some rethinking of exactly what we want to test, whereas the intent of this patch is just to hit all the cases in which the needed renamings are cosmetic. There is no enforcement mechanism in this patch either, but if we don't add one we can expect that the tests will soon be violating the convention again. Again, that's not such a cosmetic change and it will require discussion. (But I did use a quick-hack enforcement patch to find these cases.) Discussion: <16638.1468620817@sss.pgh.pa.us>	10 years ago
Joe Conway	794e2558be	Fix sepgsql regression tests. ... The regression tests for sepgsql were broken by changes in the base distro as-shipped policies. Specifically, definition of unconfined_t in the system default policy was changed to bypass multi-category rules, which the regression test depended on. Fix that by defining a custom privileged domain (sepgsql_regtest_superuser_t) and using it instead of system's unconfined_t domain. The new sepgsql_regtest_superuser_t domain performs almost like the current unconfined_t, but restricted by multi-category policy as the traditional unconfined_t was. The custom policy module is a self defined domain, and so should not be affected by related future system policy changes. However, it still uses the unconfined_u:unconfined_r pair for selinux-user and role. Those definitions have not been changed for several years and seem less risky to rely on than the unconfined_t domain. Additionally, if we define custom user/role, they would need to be manually defined at the operating system level, adding more complexity to an already non-standard and complex regression test. Back-patch to 9.3. The regression tests will need more work before working correctly on 9.2. Starting with 9.2, sepgsql has had dependencies on libselinux versions that are only available on newer distros with the changed set of policies (e.g. RHEL 7.x). On 9.1 sepgsql works fine with the older distros with original policy set (e.g. RHEL 6.x), and on which the existing regression tests work fine. We might want eventually change 9.1 sepgsql regression tests to be more independent from the underlying OS policies, however more work will be needed to make that happen and it is not clear that it is worth the effort. Kohei KaiGai with review by Adam Brightwell and me, commentary by Stephen, Alvaro, Tom, Robert, and others.	11 years ago
Robert Haas	b620fdabba	sepgql: Use getObjectIdentity rather than getObjectDescription. ... KaiGai Kohei, based on a suggestion from Álvaro Herrera	13 years ago
Robert Haas	e965e6344c	sepgsql: Enforce db_schema:search permission. ... KaiGai Kohei, with comment and doc wordsmithing by me	13 years ago
Robert Haas	1cea9bbb21	sepgsql: Support for new post-ALTER access hook. ... KaiGai Kohei	13 years ago
Alvaro Herrera	f4c4335a4a	Add context info to OAT_POST_CREATE security hook ... ... and have sepgsql use it to determine whether to check permissions during certain operations. Indexes that are being created as a result of REINDEX, for instance, do not need to have their permissions checked; they were already checked when the index was created. Author: KaiGai Kohei, slightly revised by me	13 years ago
Robert Haas	d7c734841b	Reduce messages about implicit indexes and sequences to DEBUG1. ... Per recent discussion on pgsql-hackers, these messages are too chatty for most users.	14 years ago
Robert Haas	e914a144d3	sepgsql DROP support. ... KaiGai Kohei	14 years ago