From f1325ce213ae1843d2ee636ff6780c3f8ac9ada6 Mon Sep 17 00:00:00 2001 From: Itagaki Takahiro Date: Fri, 11 Dec 2009 03:34:57 +0000 Subject: Add large object access control. A new system catalog pg_largeobject_metadata manages ownership and access privileges of large objects. KaiGai Kohei, reviewed by Jaime Casanova. --- doc/src/sgml/catalogs.sgml | 76 +++++++++++++++++++++++++++++--- doc/src/sgml/config.sgml | 31 ++++++++++++- doc/src/sgml/lobj.sgml | 53 +++++++++++++++++++++- doc/src/sgml/ref/allfiles.sgml | 3 +- doc/src/sgml/ref/alter_large_object.sgml | 75 +++++++++++++++++++++++++++++++ doc/src/sgml/ref/grant.sgml | 10 ++++- doc/src/sgml/ref/revoke.sgml | 8 +++- doc/src/sgml/reference.sgml | 3 +- 8 files changed, 248 insertions(+), 11 deletions(-) create mode 100755 doc/src/sgml/ref/alter_large_object.sgml (limited to 'doc/src') diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml index be5b037aa0b..9d7f7346d95 100644 --- a/doc/src/sgml/catalogs.sgml +++ b/doc/src/sgml/catalogs.sgml @@ -1,4 +1,4 @@ - + @@ -160,7 +160,12 @@ pg_largeobject - large objects + data pages for large objects + + + + pg_largeobject_metadata + metadata for large objects @@ -3120,22 +3125,31 @@ The catalog pg_largeobject holds the data making up - large objects. A large object is identified by an - OID assigned when it is created. Each large object is broken into + large objects. A large object is identified by an OID of + pg_largeobject_metadata + catalog, assigned when it is created. Each large object is broken into segments or pages small enough to be conveniently stored as rows in pg_largeobject. The amount of data per page is defined to be LOBLKSIZE (which is currently BLCKSZ/4, or typically 2 kB). + + pg_largeobject should not be readable by the + public, since the catalog contains data in large objects of all users. + pg_largeobject_metadata is a publicly readable catalog + that only contains identifiers of large objects. + + <structname>pg_largeobject</> Columns - + Name Type + References Description @@ -3144,12 +3158,14 @@ loid oid + pg_largeobject_metadata.oid Identifier of the large object that includes this page pageno int4 + Page number of this page within its large object (counting from zero) @@ -3157,6 +3173,7 @@ data bytea + Actual data stored in the large object. This will never be more than LOBLKSIZE bytes and might be less @@ -3177,6 +3194,55 @@ + + <structname>pg_largeobject_metadata</structname> + + + pg_largeobject_metadata + + + + The purpose of pg_largeobject_metadata is to + hold metadata of large objects, such as OID of its owner, + access permissions and OID of the large object itself. + + +
+ <structname>pg_largeobject_metadata</> Columns + + + + + Name + Type + References + Description + + + + + + lomowner + oid + pg_authid.oid + Owner of the largeobejct + + + + lomacl + aclitem[] + + Access privileges; see + and + + for details + + + + + +
+ <structname>pg_listener</structname> diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 1fb32c8de39..8045f5c95be 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1,4 +1,4 @@ - + Server Configuration @@ -4816,6 +4816,35 @@ dynamic_library_path = 'C:\tools\postgresql;H:\my_project\lib;$libdir' + + lo_compat_privileges (boolean) + + + lo_compat_privileges configuration parameter + + + + + This allows us to tuen on/off database privilege checks on large + objects. In the 8.4.x series and earlier release do not have + privilege checks on large object in most cases. + + So, turning the lo_compat_privileges off means + the large object feature performs in compatible mode. + + + Please note that it is not equivalent to disable all the security + checks corresponding to large objects. + For example, the lo_import() and + lo_export() need superuser privileges independent + from this setting as prior versions were doing. + + + It is off by default. + + + + sql_inheritance (boolean) diff --git a/doc/src/sgml/lobj.sgml b/doc/src/sgml/lobj.sgml index 750b9c5c4ee..1cec73e4c02 100644 --- a/doc/src/sgml/lobj.sgml +++ b/doc/src/sgml/lobj.sgml @@ -1,4 +1,4 @@ - + Large Objects @@ -441,6 +441,57 @@ SELECT lo_export(image.raster, '/tmp/motd') FROM image The client-side functions can be used by any PostgreSQL user. + + + Large object and privileges + + Note that access control feature was not supported in the 8.4.x series + and earlier release. + Also see the compatibility + option. + + + Now it supports access controls on large objects, and allows the owner + of large objects to set up access rights using + and + statement. + + + Two permissions are defined on the large object class. + These are checked only when + option is disabled. + + + The first is SELECT. + It is required on loread() function. + Note that when we open large object with read-only mode, we can see + a static image even if other concurrent transaction modified the + same large object. + This principle is also applied on the access rights of large objects. + Even if a transaction modified access rights and commit it, it is + not invisible from other transaction which already opened the large + object. + + + The second is UPDATE. + It is required on lowrite() function and + lo_truncate() function. + + + In addition, lo_unlink() function, + COMMENT ON and ALTER LARGE OBJECT + statements needs ownership of the large object to be accessed. + + + You may wonder why SELECT is not checked on the + lo_export() function or UPDATE + is not checked on the lo_import function. + + These functions originally require database superuser privilege, + and it allows to bypass the default database privilege checks, + so we don't need to check an obvious test twice. + + diff --git a/doc/src/sgml/ref/allfiles.sgml b/doc/src/sgml/ref/allfiles.sgml index c15579c5164..1754aae58b8 100644 --- a/doc/src/sgml/ref/allfiles.sgml +++ b/doc/src/sgml/ref/allfiles.sgml @@ -1,5 +1,5 @@ @@ -16,6 +16,7 @@ Complete list of usable sgml source files in this directory. + diff --git a/doc/src/sgml/ref/alter_large_object.sgml b/doc/src/sgml/ref/alter_large_object.sgml new file mode 100755 index 00000000000..3436ae8b88a --- /dev/null +++ b/doc/src/sgml/ref/alter_large_object.sgml @@ -0,0 +1,75 @@ + + + ALTER LARGE OBJECT + 7 + SQL - Language Statements + + + + ALTER LARGE OBJECT + change the definition of a large object + + + + ALTER LARGE OBJECT + + + + +ALTER LARGE OBJECT large_object_oid OWNER TO new_owner + + + + + Description + + + ALTER LARGE OBJECT changes the definition of a + large object. The only functionality is to assign a new owner. + You must be superuser or owner of the large object to use + ALTER LARGE OBJECT. + + + + + Parameters + + + + large_object_oid + + + OID of the large object to be altered + + + + + + new_owner + + + The new owner of the large object + + + + + + + + Compatibility + + + There is no ALTER LARGE OBJECT statement in the SQL + standard. + + + + + See Also + + + + + + + diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml index 2e8f2050f11..86879acedbc 100644 --- a/doc/src/sgml/ref/grant.sgml +++ b/doc/src/sgml/ref/grant.sgml @@ -1,5 +1,5 @@ @@ -59,6 +59,10 @@ GRANT { USAGE | ALL [ PRIVILEGES ] } ON LANGUAGE lang_name [, ...] TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ] +GRANT { { SELECT | UPDATE } [,...] | ALL [ PRIVILEGES ] } + ON LARGE OBJECT loid [, ...] + TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ] + GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] } ON SCHEMA schema_name [, ...] TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ] @@ -170,6 +174,8 @@ GRANT role_name [, ...] TO . For sequences, this privilege also allows the use of the currval function. + For large objects, this privilege also allows to read from + the target large object. @@ -203,6 +209,8 @@ GRANT role_name [, ...] TO SELECT privilege. For sequences, this privilege allows the use of the nextval and setval functions. + For large objects, this privilege also allows to write or truncate + on the target large object. diff --git a/doc/src/sgml/ref/revoke.sgml b/doc/src/sgml/ref/revoke.sgml index 0b8aea534c4..e31549fa3c3 100644 --- a/doc/src/sgml/ref/revoke.sgml +++ b/doc/src/sgml/ref/revoke.sgml @@ -1,5 +1,5 @@ @@ -75,6 +75,12 @@ REVOKE [ GRANT OPTION FOR ] FROM { [ GROUP ] role_name | PUBLIC } [, ...] [ CASCADE | RESTRICT ] +REVOKE [ GRANT OPTION FOR ] + { { SELECT | UPDATE } [,...] | ALL [ PRIVILEGES ] } + ON LARGE OBJECT loid [, ...] + FROM { [ GROUP ] rolename | PUBLIC } [, ...] + [ CASCADE | RESTRICT ] + REVOKE [ GRANT OPTION FOR ] { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] } ON SCHEMA schema_name [, ...] diff --git a/doc/src/sgml/reference.sgml b/doc/src/sgml/reference.sgml index 0e72fc5475b..f97bf651ce5 100644 --- a/doc/src/sgml/reference.sgml +++ b/doc/src/sgml/reference.sgml @@ -1,4 +1,4 @@ - + Reference @@ -44,6 +44,7 @@ &alterGroup; &alterIndex; &alterLanguage; + &alterLargeObject; &alterOperator; &alterOperatorClass; &alterOperatorFamily; -- cgit v1.2.3