From ef253a0c2c07f2252c1027faa90b4c4e2551cdbc Mon Sep 17 00:00:00 2001 From: Virender Singla Date: Sun, 23 Aug 2026 13:48:28 +0000 Subject: [PATCH v2] Allow pg_read_all_stats to read replication origin status Grant the pg_read_all_stats role access to the pg_replication_origin_status view and its backing function pg_show_replication_origin_status(). The regression test verifies that pg_read_all_stats can access both the view and its backing function. --- src/backend/catalog/system_views.sql | 2 ++ src/test/regress/expected/privileges.out | 30 ++++++++++++++++++++++++ src/test/regress/sql/privileges.sql | 5 ++++ 3 files changed, 37 insertions(+) diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql index 8612d99a890..1202921318f 100644 --- a/src/backend/catalog/system_views.sql +++ b/src/backend/catalog/system_views.sql @@ -1531,6 +1531,8 @@ CREATE VIEW pg_replication_origin_status AS FROM pg_show_replication_origin_status(); REVOKE ALL ON pg_replication_origin_status FROM public; +GRANT SELECT ON pg_replication_origin_status TO pg_read_all_stats; +GRANT EXECUTE ON FUNCTION pg_show_replication_origin_status() TO pg_read_all_stats; -- All columns of pg_subscription except subconninfo are publicly readable. REVOKE ALL ON pg_subscription FROM public; diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index ce76a4d2f4d..09fd0f23eb4 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -3528,6 +3528,18 @@ SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations', f (1 row) +SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- no + has_table_privilege +--------------------- + f +(1 row) + +SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- no + has_function_privilege +------------------------ + f +(1 row) + GRANT pg_read_all_stats TO regress_readallstats; SELECT has_table_privilege('regress_readallstats','pg_aios','SELECT'); -- yes has_table_privilege @@ -3559,6 +3571,18 @@ SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations', t (1 row) +SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- yes + has_table_privilege +--------------------- + t +(1 row) + +SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- yes + has_function_privilege +------------------------ + t +(1 row) + -- run query to ensure that functions within views can be executed SET ROLE regress_readallstats; SELECT COUNT(*) >= 0 AS ok FROM pg_aios; @@ -3579,6 +3603,12 @@ SELECT COUNT(*) >= 0 AS ok FROM pg_shmem_allocations; t (1 row) +SELECT COUNT(*) >= 0 AS ok FROM pg_replication_origin_status; + ok +---- + t +(1 row) + RESET ROLE; -- clean up DROP ROLE regress_readallstats; diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql index 9f7767fb2b9..e4ef7138583 100644 --- a/src/test/regress/sql/privileges.sql +++ b/src/test/regress/sql/privileges.sql @@ -2156,6 +2156,8 @@ SELECT has_table_privilege('regress_readallstats','pg_backend_memory_contexts',' SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations','SELECT'); -- no SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations_numa','SELECT'); -- no SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations','SELECT'); -- no +SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- no +SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- no GRANT pg_read_all_stats TO regress_readallstats; @@ -2164,12 +2166,15 @@ SELECT has_table_privilege('regress_readallstats','pg_backend_memory_contexts',' SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations','SELECT'); -- yes SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations_numa','SELECT'); -- yes SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations','SELECT'); -- yes +SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- yes +SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- yes -- run query to ensure that functions within views can be executed SET ROLE regress_readallstats; SELECT COUNT(*) >= 0 AS ok FROM pg_aios; SELECT COUNT(*) >= 0 AS ok FROM pg_backend_memory_contexts; SELECT COUNT(*) >= 0 AS ok FROM pg_shmem_allocations; +SELECT COUNT(*) >= 0 AS ok FROM pg_replication_origin_status; RESET ROLE; -- clean up -- 2.55.0.766.g2966f0265a-goog