diff --git a/contrib/sepgsql/dml.c b/contrib/sepgsql/dml.c index cc934b5..2892346 100644 --- a/contrib/sepgsql/dml.c +++ b/contrib/sepgsql/dml.c @@ -161,12 +161,10 @@ check_relation_privileges(Oid relOid, */ if (sepgsql_getenforce() > 0) { - Oid relnamespace = get_rel_namespace(relOid); - - if (IsSystemNamespace(relnamespace) && - (required & (SEPG_DB_TABLE__UPDATE | + if ((required & (SEPG_DB_TABLE__UPDATE | SEPG_DB_TABLE__INSERT | - SEPG_DB_TABLE__DELETE)) != 0) + SEPG_DB_TABLE__DELETE)) != 0 && + IsCatalogRelationOid(relOid)) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("SELinux: hardwired security policy violation"))); diff --git a/src/backend/catalog/catalog.c b/src/backend/catalog/catalog.c index 6d8c746..b5e554f 100644 --- a/src/backend/catalog/catalog.c +++ b/src/backend/catalog/catalog.c @@ -53,15 +53,18 @@ /* * IsSystemRelation - * True iff the relation is either a system catalog or toast table. - * By a system catalog, we mean one that created in the pg_catalog schema - * during initdb. User-created relations in pg_catalog don't count as - * system catalogs. + * True iff the relation is either a system catalog or a toast table. + * See IsCatalogRelation for the exact definition of a system catalog. * - * NB: TOAST relations are considered system relations by this test - * for compatibility with the old IsSystemRelationName function. - * This is appropriate in many places but not all. Where it's not, - * also check IsToastRelation or use IsCatalogRelation(). + * We treat toast tables of user relations as "system relations" for + * protection purposes, e.g. you can't change their schemas without + * special permissions. Therefore, most uses of this function are + * checking whether allow_system_table_mods restrictions apply. + * For other purposes, consider whether you shouldn't be using + * IsCatalogRelation instead. + * + * This function does not perform any catalog accesses. + * Some callers rely on that! */ bool IsSystemRelation(Relation relation) @@ -78,67 +81,86 @@ IsSystemRelation(Relation relation) bool IsSystemClass(Oid relid, Form_pg_class reltuple) { - return IsToastClass(reltuple) || IsCatalogClass(relid, reltuple); + /* IsCatalogRelationOid is a bit faster, so test that first */ + return (IsCatalogRelationOid(relid) || IsToastClass(reltuple)); } /* * IsCatalogRelation - * True iff the relation is a system catalog, or the toast table for - * a system catalog. By a system catalog, we mean one that created - * in the pg_catalog schema during initdb. As with IsSystemRelation(), - * user-created relations in pg_catalog don't count as system catalogs. + * True iff the relation is a system catalog. + * + * By a system catalog, we mean one that is created during the bootstrap + * phase of initdb. That includes not just the catalogs per se, but + * also their indexes, and TOAST tables and indexes if any. * - * Note that IsSystemRelation() returns true for ALL toast relations, - * but this function returns true only for toast relations of system - * catalogs. + * This function does not perform any catalog accesses. + * Some callers rely on that! */ bool IsCatalogRelation(Relation relation) { - return IsCatalogClass(RelationGetRelid(relation), relation->rd_rel); + return IsCatalogRelationOid(RelationGetRelid(relation)); } /* * IsCatalogClass - * True iff the relation is a system catalog relation. - * - * Check IsCatalogRelation() for details. + * Like the above, but takes a Form_pg_class as argument. + * Used when we do not want to open the relation and have to + * search pg_class directly. */ bool IsCatalogClass(Oid relid, Form_pg_class reltuple) { - Oid relnamespace = reltuple->relnamespace; + return IsCatalogRelationOid(relid); +} +/* + * IsCatalogRelationOid + * True iff the relation identified by this OID is a system catalog. + * + * By a system catalog, we mean one that is created during the bootstrap + * phase of initdb. That includes not just the catalogs per se, but + * also their indexes, and TOAST tables and indexes if any. + * + * This function does not perform any catalog accesses. + * Some callers rely on that! + */ +bool +IsCatalogRelationOid(Oid relid) +{ /* - * Never consider relations outside pg_catalog/pg_toast to be catalog - * relations. - */ - if (!IsSystemNamespace(relnamespace) && !IsToastNamespace(relnamespace)) - return false; - - /* ---- - * Check whether the oid was assigned during initdb, when creating the - * initial template database. Minus the relations in information_schema - * excluded above, these are integral part of the system. - * We could instead check whether the relation is pinned in pg_depend, but - * this is noticeably cheaper and doesn't require catalog access. + * We consider a relation to be a system catalog if it has an OID that was + * manually assigned or assigned by genbki.pl. This includes all the + * defined catalogs, their indexes, and their TOAST tables and indexes. + * + * This rule excludes the relations in information_schema, which are not + * integral to the system and can be treated the same as user relations. + * (Since it's valid to drop and recreate information_schema, any rule + * that did not act this way would be wrong.) * - * This test is safe since even an oid wraparound will preserve this - * property (cf. GetNewObjectId()) and it has the advantage that it works - * correctly even if a user decides to create a relation in the pg_catalog - * namespace. - * ---- + * This test is reliable since an OID wraparound will skip this range of + * OIDs; see GetNewObjectId(). */ - return relid < FirstNormalObjectId; + return (relid < (Oid) FirstBootstrapObjectId); } /* * IsToastRelation * True iff relation is a TOAST support relation (or index). + * + * Does not perform any catalog accesses. */ bool IsToastRelation(Relation relation) { + /* + * What we actually check is whether the relation belongs to a pg_toast + * namespace. This should be equivalent because of restrictions that are + * enforced elsewhere against creating user relations in, or moving + * relations into/out of, a pg_toast namespace. Notice also that this + * will not say "true" for toast tables belonging to other sessions' temp + * tables; we expect that other mechanisms will prevent access to those. + */ return IsToastNamespace(RelationGetNamespace(relation)); } @@ -157,14 +179,16 @@ IsToastClass(Form_pg_class reltuple) } /* - * IsSystemNamespace + * IsCatalogNamespace * True iff namespace is pg_catalog. * + * Does not perform any catalog accesses. + * * NOTE: the reason this isn't a macro is to avoid having to include * catalog/pg_namespace.h in a lot of places. */ bool -IsSystemNamespace(Oid namespaceId) +IsCatalogNamespace(Oid namespaceId) { return namespaceId == PG_CATALOG_NAMESPACE; } @@ -173,9 +197,13 @@ IsSystemNamespace(Oid namespaceId) * IsToastNamespace * True iff namespace is pg_toast or my temporary-toast-table namespace. * + * Does not perform any catalog accesses. + * * Note: this will return false for temporary-toast-table namespaces belonging * to other backends. Those are treated the same as other backends' regular * temp table namespaces, and access is prevented where appropriate. + * If you need to check for those, you may be able to use isAnyTempNamespace, + * but beware that that does involve a catalog access. */ bool IsToastNamespace(Oid namespaceId) diff --git a/src/backend/catalog/heap.c b/src/backend/catalog/heap.c index ee6b72e..6cffe55 100644 --- a/src/backend/catalog/heap.c +++ b/src/backend/catalog/heap.c @@ -324,7 +324,7 @@ heap_create(const char *relname, * user defined relation, not a system one. */ if (!allow_system_table_mods && - ((IsSystemNamespace(relnamespace) && relkind != RELKIND_INDEX) || + ((IsCatalogNamespace(relnamespace) && relkind != RELKIND_INDEX) || IsToastNamespace(relnamespace)) && IsNormalProcessingMode()) ereport(ERROR, diff --git a/src/backend/commands/indexcmds.c b/src/backend/commands/indexcmds.c index 663407c..ccbe08c 100644 --- a/src/backend/commands/indexcmds.c +++ b/src/backend/commands/indexcmds.c @@ -2569,15 +2569,11 @@ ReindexMultipleTables(const char *objectName, ReindexObjectType objectKind, continue; /* - * Skip system tables that index_create() would reject to index - * concurrently. XXX We need the additional check for - * FirstNormalObjectId to skip information_schema tables, because - * IsCatalogClass() here does not cover information_schema, but the - * check in index_create() will error on the TOAST tables of - * information_schema tables. + * Skip system tables, since index_create() would reject indexing them + * concurrently (and it would likely fail if we tried). */ if (concurrent && - (IsCatalogClass(relid, classtuple) || relid < FirstNormalObjectId)) + IsCatalogClass(relid, classtuple)) { if (!concurrent_warning) ereport(WARNING, @@ -2821,7 +2817,7 @@ ReindexRelationConcurrently(Oid relationOid, int options) errmsg("concurrent reindex is not supported for shared relations"))); /* A system catalog cannot be reindexed concurrently */ - if (IsSystemNamespace(get_rel_namespace(heapId))) + if (IsCatalogRelationOid(heapId)) ereport(ERROR, (errcode(ERRCODE_FEATURE_NOT_SUPPORTED), errmsg("concurrent reindex is not supported for catalog relations"))); diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c index 8e4743d..97c58c8 100644 --- a/src/backend/commands/tablecmds.c +++ b/src/backend/commands/tablecmds.c @@ -12453,9 +12453,10 @@ AlterTableMoveAll(AlterTableMoveAllStmt *stmt) * Also, explicitly avoid any shared tables, temp tables, or TOAST * (TOAST will be moved with the main table). */ - if (IsSystemNamespace(relForm->relnamespace) || relForm->relisshared || + if (IsCatalogNamespace(relForm->relnamespace) || + relForm->relisshared || isAnyTempNamespace(relForm->relnamespace) || - relForm->relnamespace == PG_TOAST_NAMESPACE) + IsToastNamespace(relForm->relnamespace)) continue; /* Only move the object type requested */ diff --git a/src/backend/utils/cache/relcache.c b/src/backend/utils/cache/relcache.c index eaf2b18..d0f6f71 100644 --- a/src/backend/utils/cache/relcache.c +++ b/src/backend/utils/cache/relcache.c @@ -3316,8 +3316,8 @@ RelationBuildLocalRelation(const char *relname, else rel->rd_rel->relispopulated = true; - /* system relations and non-table objects don't have one */ - if (!IsSystemNamespace(relnamespace) && + /* set replica identity -- system catalogs and non-tables don't have one */ + if (!IsCatalogNamespace(relnamespace) && (relkind == RELKIND_RELATION || relkind == RELKIND_MATVIEW || relkind == RELKIND_PARTITIONED_TABLE)) diff --git a/src/include/catalog/catalog.h b/src/include/catalog/catalog.h index a58d09d..47c48b8 100644 --- a/src/include/catalog/catalog.h +++ b/src/include/catalog/catalog.h @@ -26,7 +26,9 @@ extern bool IsSystemClass(Oid relid, Form_pg_class reltuple); extern bool IsToastClass(Form_pg_class reltuple); extern bool IsCatalogClass(Oid relid, Form_pg_class reltuple); -extern bool IsSystemNamespace(Oid namespaceId); +extern bool IsCatalogRelationOid(Oid relid); + +extern bool IsCatalogNamespace(Oid namespaceId); extern bool IsToastNamespace(Oid namespaceId); extern bool IsReservedName(const char *name);