From a9993f9a4ff90264aa10cb747d83ca58a4538fed Mon Sep 17 00:00:00 2001 From: Paul Kim Date: Mon, 28 Sep 2026 10:17:34 +0900 Subject: [PATCH v2 2/2] Test grant option chains through a grantor that became superuser The previous commit tests inherited ownership and grant options. Add coverage for an intermediate grantor that becomes a superuser after issuing a grant. Without the fix, revoking that role's grant option succeeds and leaves its dependent grant in the ACL. After the role loses SUPERUSER, dump/restore loses the dependent grant with a warning. Check that RESTRICT (the default) rejects the revocation and CASCADE removes the dependent grant. Discussion: https://postgr.es/m/CAOYmi%2B%3DKTLd%2BXsEP%3DTDiZ48iVf-CEc7JrZd5uhWPYWKEfOgyyQ%40mail.gmail.com --- src/test/regress/expected/privileges.out | 31 ++++++++++++++++++++++++ src/test/regress/sql/privileges.sql | 29 ++++++++++++++++++++++ 2 files changed, 60 insertions(+) diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index 4de9d749574..b6276b30d15 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -2006,6 +2006,37 @@ SELECT has_table_privilege('regress_priv_user1', 'atest4_groupowned', 'UPDATE'); f (1 row) +-- Same, but the intermediate grantor has become a superuser since issuing its +-- grant (regress_priv_user1 -> regress_priv_su -> regress_priv_user2). +RESET SESSION AUTHORIZATION; +CREATE ROLE regress_priv_su; +SET SESSION AUTHORIZATION regress_priv_user1; +CREATE TABLE atest4_su (a int); +GRANT SELECT ON atest4_su TO regress_priv_su WITH GRANT OPTION; +SET SESSION AUTHORIZATION regress_priv_su; +GRANT SELECT ON atest4_su TO regress_priv_user2; +RESET SESSION AUTHORIZATION; +ALTER ROLE regress_priv_su SUPERUSER; +SET SESSION AUTHORIZATION regress_priv_user1; +REVOKE GRANT OPTION FOR SELECT ON atest4_su FROM regress_priv_su; -- fail +ERROR: dependent privileges exist +HINT: Use CASCADE to revoke them too. +SELECT has_table_privilege('regress_priv_user2', 'atest4_su', 'SELECT'); -- true + has_table_privilege +--------------------- + t +(1 row) + +REVOKE GRANT OPTION FOR SELECT ON atest4_su FROM regress_priv_su CASCADE; -- ok +SELECT has_table_privilege('regress_priv_user2', 'atest4_su', 'SELECT'); -- false + has_table_privilege +--------------------- + f +(1 row) + +RESET SESSION AUTHORIZATION; +DROP TABLE atest4_su; +DROP ROLE regress_priv_su; -- security-restricted operations \c - CREATE ROLE regress_sro_user; diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql index c34f5196fe5..a05aae34b6b 100644 --- a/src/test/regress/sql/privileges.sql +++ b/src/test/regress/sql/privileges.sql @@ -1287,6 +1287,35 @@ SELECT has_table_privilege('regress_priv_user1', 'atest4_groupowned', 'UPDATE'); REVOKE UPDATE ON atest4_groupowned FROM regress_priv_group2 RESTRICT; -- ok SELECT has_table_privilege('regress_priv_user1', 'atest4_groupowned', 'UPDATE'); -- false +-- Same, but the intermediate grantor has become a superuser since issuing its +-- grant (regress_priv_user1 -> regress_priv_su -> regress_priv_user2). +RESET SESSION AUTHORIZATION; +CREATE ROLE regress_priv_su; + +SET SESSION AUTHORIZATION regress_priv_user1; + +CREATE TABLE atest4_su (a int); + +GRANT SELECT ON atest4_su TO regress_priv_su WITH GRANT OPTION; + +SET SESSION AUTHORIZATION regress_priv_su; + +GRANT SELECT ON atest4_su TO regress_priv_user2; + +RESET SESSION AUTHORIZATION; +ALTER ROLE regress_priv_su SUPERUSER; + +SET SESSION AUTHORIZATION regress_priv_user1; + +REVOKE GRANT OPTION FOR SELECT ON atest4_su FROM regress_priv_su; -- fail +SELECT has_table_privilege('regress_priv_user2', 'atest4_su', 'SELECT'); -- true +REVOKE GRANT OPTION FOR SELECT ON atest4_su FROM regress_priv_su CASCADE; -- ok +SELECT has_table_privilege('regress_priv_user2', 'atest4_su', 'SELECT'); -- false + +RESET SESSION AUTHORIZATION; +DROP TABLE atest4_su; +DROP ROLE regress_priv_su; + -- security-restricted operations \c - CREATE ROLE regress_sro_user; -- 2.50.1 (Apple Git-155)