BUG #5458: Permission check is skipped by inheritance

From: "Takahiro Itagaki" <itagaki(dot)takahiro(at)oss(dot)ntt(dot)co(dot)jp>
To: pgsql-bugs(at)postgresql(dot)org
Subject: BUG #5458: Permission check is skipped by inheritance
Date: 2010-05-11 09:21:12
Message-ID: 201005110921.o4B9LCol056191@wwwmaster.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs


The following bug has been logged online:

Bug reference: 5458
Logged by: Takahiro Itagaki
Email address: itagaki(dot)takahiro(at)oss(dot)ntt(dot)co(dot)jp
PostgreSQL version: 9.0beta1
Operating system: Linux (maybe ALL)
Description: Permission check is skipped by inheritance
Details:

Even if a non-superuser who has no permissions on
a parent and a child tables, he can retrieve data
from the parent when the two tables have inheritance
relationship.

The behavior seems to be changed in 9.0.
8.4 returns "permission denied" errors expectedly.

=== test case ===
- 'postgres' is a superuser.
- 'normal' is a non-superuser.

(9.0beta1)
=# CREATE TABLE parent (i integer);
=# CREATE TABLE child (i integer);
=# REVOKE ALL ON parent, child FROM public;
=# SET ROLE normal;
=> SELECT * FROM parent;
ERROR: permission denied for relation parent
=> SELECT * FROM child;
ERROR: permission denied for relation child
=> SET ROLE postgres;
=# ALTER TABLE child INHERIT parent;
=# SET ROLE normal;
=> SELECT * FROM parent; -- ???
i
---
(0 rows)

postgres=> SELECT * FROM child;
ERROR: permission denied for relation child

(8.4.3)
...
=# ALTER TABLE child INHERIT parent;
=# SET ROLE normal;
=> SELECT * FROM parent;
ERROR: permission denied for relation parent
=> SELECT * FROM child;
ERROR: permission denied for relation child

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Jasen Betts 2010-05-11 09:24:55 Re: BUG #5457: dblink_connect now restricts non-superusers to password
Previous Message Chana Slutzkin 2010-05-11 07:21:07 BUG #5457: dblink_connect now restricts non-superusers to password