Commit ea886339 authored by Tom Lane's avatar Tom Lane

Add is_superuser parameter reporting, soon to be used by psql.

parent 3e0bdfad
<!-- <!--
$Header: /cvsroot/pgsql/doc/src/sgml/libpq.sgml,v 1.126 2003/06/22 00:29:29 tgl Exp $ $Header: /cvsroot/pgsql/doc/src/sgml/libpq.sgml,v 1.127 2003/06/27 19:08:37 tgl Exp $
--> -->
<chapter id="libpq"> <chapter id="libpq">
...@@ -812,7 +812,8 @@ is not known. ...@@ -812,7 +812,8 @@ is not known.
Parameters reported as of the current release include Parameters reported as of the current release include
<literal>server_version</> (cannot change after startup); <literal>server_version</> (cannot change after startup);
<literal>server_encoding</> (also not presently changeable after start); <literal>server_encoding</> (also not presently changeable after start);
<literal>client_encoding</>, and <literal>client_encoding</>,
<literal>is_superuser</>, and
<literal>DateStyle</>. <literal>DateStyle</>.
</para> </para>
......
<!-- $Header: /cvsroot/pgsql/doc/src/sgml/protocol.sgml,v 1.38 2003/05/08 14:35:24 tgl Exp $ --> <!-- $Header: /cvsroot/pgsql/doc/src/sgml/protocol.sgml,v 1.39 2003/06/27 19:08:37 tgl Exp $ -->
<chapter id="protocol"> <chapter id="protocol">
<title>Frontend/Backend Protocol</title> <title>Frontend/Backend Protocol</title>
...@@ -998,7 +998,8 @@ ...@@ -998,7 +998,8 @@
<literal>server_version</> (a pseudo-parameter that cannot change after <literal>server_version</> (a pseudo-parameter that cannot change after
startup); startup);
<literal>server_encoding</> (also not presently changeable after start); <literal>server_encoding</> (also not presently changeable after start);
<literal>client_encoding</>, and <literal>client_encoding</>,
<literal>is_superuser</>, and
<literal>DateStyle</>. <literal>DateStyle</>.
This set might change in the future, or even become configurable. This set might change in the future, or even become configurable.
Accordingly, a frontend should simply ignore ParameterStatus for Accordingly, a frontend should simply ignore ParameterStatus for
......
<!-- <!--
$Header: /cvsroot/pgsql/doc/src/sgml/ref/show.sgml,v 1.27 2003/05/14 03:26:00 tgl Exp $ $Header: /cvsroot/pgsql/doc/src/sgml/ref/show.sgml,v 1.28 2003/06/27 19:08:37 tgl Exp $
PostgreSQL documentation PostgreSQL documentation
--> -->
...@@ -97,6 +97,16 @@ SHOW ALL ...@@ -97,6 +97,16 @@ SHOW ALL
</para> </para>
</listitem> </listitem>
</varlistentry> </varlistentry>
<varlistentry>
<term><literal>IS_SUPERUSER</literal></term>
<listitem>
<para>
True if the current session authorization identifier has
superuser privileges.
</para>
</listitem>
</varlistentry>
</variablelist> </variablelist>
</para> </para>
</listitem> </listitem>
......
...@@ -9,7 +9,7 @@ ...@@ -9,7 +9,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/commands/variable.c,v 1.78 2003/06/06 16:25:35 tgl Exp $ * $Header: /cvsroot/pgsql/src/backend/commands/variable.c,v 1.79 2003/06/27 19:08:37 tgl Exp $
* *
*------------------------------------------------------------------------- *-------------------------------------------------------------------------
*/ */
...@@ -721,25 +721,29 @@ assign_client_encoding(const char *value, bool doit, bool interactive) ...@@ -721,25 +721,29 @@ assign_client_encoding(const char *value, bool doit, bool interactive)
* When resetting session auth after an error, we can't expect to do catalog * When resetting session auth after an error, we can't expect to do catalog
* lookups. Hence, the stored form of the value must provide a numeric userid * lookups. Hence, the stored form of the value must provide a numeric userid
* that can be re-used directly. We store the string in the form of * that can be re-used directly. We store the string in the form of
* NAMEDATALEN 'x's followed by the numeric userid --- this cannot conflict * NAMEDATALEN 'x's, followed by T or F to indicate superuserness, followed
* with any valid user name, because of the NAMEDATALEN limit on names. * by the numeric userid --- this cannot conflict with any valid user name,
* because of the NAMEDATALEN limit on names.
*/ */
const char * const char *
assign_session_authorization(const char *value, bool doit, bool interactive) assign_session_authorization(const char *value, bool doit, bool interactive)
{ {
AclId usesysid = 0; AclId usesysid = 0;
bool is_superuser = false;
char *result; char *result;
if (strspn(value, "x") == NAMEDATALEN) if (strspn(value, "x") == NAMEDATALEN &&
(value[NAMEDATALEN] == 'T' || value[NAMEDATALEN] == 'F'))
{ {
/* might be a saved numeric userid */ /* might be a saved numeric userid */
char *endptr; char *endptr;
usesysid = (AclId) strtoul(value + NAMEDATALEN, &endptr, 10); usesysid = (AclId) strtoul(value + NAMEDATALEN + 1, &endptr, 10);
if (endptr != value + NAMEDATALEN && *endptr == '\0') if (endptr != value + NAMEDATALEN + 1 && *endptr == '\0')
{ {
/* syntactically valid, so use the numeric user ID */ /* syntactically valid, so use the numeric user ID and flag */
is_superuser = (value[NAMEDATALEN] == 'T');
} }
else else
usesysid = 0; usesysid = 0;
...@@ -771,12 +775,13 @@ assign_session_authorization(const char *value, bool doit, bool interactive) ...@@ -771,12 +775,13 @@ assign_session_authorization(const char *value, bool doit, bool interactive)
} }
usesysid = ((Form_pg_shadow) GETSTRUCT(userTup))->usesysid; usesysid = ((Form_pg_shadow) GETSTRUCT(userTup))->usesysid;
is_superuser = ((Form_pg_shadow) GETSTRUCT(userTup))->usesuper;
ReleaseSysCache(userTup); ReleaseSysCache(userTup);
} }
if (doit) if (doit)
SetSessionAuthorization(usesysid); SetSessionAuthorization(usesysid, is_superuser);
result = (char *) malloc(NAMEDATALEN + 32); result = (char *) malloc(NAMEDATALEN + 32);
if (!result) if (!result)
...@@ -784,7 +789,9 @@ assign_session_authorization(const char *value, bool doit, bool interactive) ...@@ -784,7 +789,9 @@ assign_session_authorization(const char *value, bool doit, bool interactive)
memset(result, 'x', NAMEDATALEN); memset(result, 'x', NAMEDATALEN);
snprintf(result + NAMEDATALEN, 32, "%lu", (unsigned long) usesysid); snprintf(result + NAMEDATALEN, 32, "%c%lu",
is_superuser ? 'T' : 'F',
(unsigned long) usesysid);
return result; return result;
} }
......
...@@ -8,7 +8,7 @@ ...@@ -8,7 +8,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/utils/init/miscinit.c,v 1.103 2003/06/27 14:45:30 petere Exp $ * $Header: /cvsroot/pgsql/src/backend/utils/init/miscinit.c,v 1.104 2003/06/27 19:08:37 tgl Exp $
* *
*------------------------------------------------------------------------- *-------------------------------------------------------------------------
*/ */
...@@ -553,9 +553,12 @@ InitializeSessionUserId(const char *username) ...@@ -553,9 +553,12 @@ InitializeSessionUserId(const char *username)
SetSessionUserId(usesysid); /* sets CurrentUserId too */ SetSessionUserId(usesysid); /* sets CurrentUserId too */
/* Record username as a config option too */ /* Record username and superuser status as GUC settings too */
SetConfigOption("session_authorization", username, SetConfigOption("session_authorization", username,
PGC_BACKEND, PGC_S_OVERRIDE); PGC_BACKEND, PGC_S_OVERRIDE);
SetConfigOption("is_superuser",
AuthenticatedUserIsSuperuser ? "on" : "off",
PGC_INTERNAL, PGC_S_OVERRIDE);
/* /*
* Set up user-specific configuration variables. This is a good place * Set up user-specific configuration variables. This is a good place
...@@ -594,10 +597,13 @@ InitializeSessionUserIdStandalone(void) ...@@ -594,10 +597,13 @@ InitializeSessionUserIdStandalone(void)
/* /*
* Change session auth ID while running * Change session auth ID while running
* *
* Only a superuser may set auth ID to something other than himself. * Only a superuser may set auth ID to something other than himself. Note
* that in case of multiple SETs in a single session, the original userid's
* superuserness is what matters. But we set the GUC variable is_superuser
* to indicate whether the *current* session userid is a superuser.
*/ */
void void
SetSessionAuthorization(AclId userid) SetSessionAuthorization(AclId userid, bool is_superuser)
{ {
/* Must have authenticated already, else can't make permission check */ /* Must have authenticated already, else can't make permission check */
AssertState(AclIdIsValid(AuthenticatedUserId)); AssertState(AclIdIsValid(AuthenticatedUserId));
...@@ -608,6 +614,10 @@ SetSessionAuthorization(AclId userid) ...@@ -608,6 +614,10 @@ SetSessionAuthorization(AclId userid)
SetSessionUserId(userid); SetSessionUserId(userid);
SetUserId(userid); SetUserId(userid);
SetConfigOption("is_superuser",
is_superuser ? "on" : "off",
PGC_INTERNAL, PGC_S_OVERRIDE);
} }
......
...@@ -16,9 +16,12 @@ ...@@ -16,9 +16,12 @@
## if an option is valid but shows up in only one file (guc.c but not ## if an option is valid but shows up in only one file (guc.c but not
## postgresql.conf.sample), it should be listed here so that it ## postgresql.conf.sample), it should be listed here so that it
## can be ignored ## can be ignored
INTENTIONALLY_NOT_INCLUDED="pre_auth_delay lc_messages lc_monetary \ INTENTIONALLY_NOT_INCLUDED="autocommit debug_deadlocks exit_on_error \
lc_numeric lc_time seed server_encoding session_authorization \ is_superuser lc_collate lc_ctype lc_messages lc_monetary lc_numeric lc_time \
transaction_isolation transaction_read_only zero_damaged_pages" pre_auth_delay seed server_encoding server_version session_authorization \
trace_lock_oidmin trace_lock_table trace_locks trace_lwlocks trace_notify \
trace_userlocks transaction_isolation transaction_read_only \
zero_damaged_pages"
### What options are listed in postgresql.conf.sample, but don't appear ### What options are listed in postgresql.conf.sample, but don't appear
### in guc.c? ### in guc.c?
......
...@@ -10,7 +10,7 @@ ...@@ -10,7 +10,7 @@
* Written by Peter Eisentraut <peter_e@gmx.net>. * Written by Peter Eisentraut <peter_e@gmx.net>.
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/utils/misc/guc.c,v 1.131 2003/06/11 22:13:22 momjian Exp $ * $Header: /cvsroot/pgsql/src/backend/utils/misc/guc.c,v 1.132 2003/06/27 19:08:38 tgl Exp $
* *
*-------------------------------------------------------------------- *--------------------------------------------------------------------
*/ */
...@@ -138,6 +138,7 @@ static char *log_min_error_statement_str; ...@@ -138,6 +138,7 @@ static char *log_min_error_statement_str;
static char *log_min_messages_str; static char *log_min_messages_str;
static char *client_min_messages_str; static char *client_min_messages_str;
static bool phony_autocommit; static bool phony_autocommit;
static bool session_auth_is_superuser;
static double phony_random_seed; static double phony_random_seed;
static char *client_encoding_string; static char *client_encoding_string;
static char *datestyle_string; static char *datestyle_string;
...@@ -361,6 +362,13 @@ static struct config_bool ...@@ -361,6 +362,13 @@ static struct config_bool
true, NULL, NULL true, NULL, NULL
}, },
/* Not for general use --- used by SET SESSION AUTHORIZATION */
{
{"is_superuser", PGC_INTERNAL, GUC_REPORT | GUC_NO_SHOW_ALL | GUC_NO_RESET_ALL},
&session_auth_is_superuser,
false, NULL, NULL
},
{ {
{"tcpip_socket", PGC_POSTMASTER}, &NetServer, {"tcpip_socket", PGC_POSTMASTER}, &NetServer,
false, NULL, NULL false, NULL, NULL
...@@ -894,6 +902,7 @@ static struct config_string ...@@ -894,6 +902,7 @@ static struct config_string
"SQL_ASCII", NULL, NULL "SQL_ASCII", NULL, NULL
}, },
/* Can't be set in postgresql.conf */
{ {
{"server_version", PGC_INTERNAL, GUC_REPORT}, {"server_version", PGC_INTERNAL, GUC_REPORT},
&server_version_string, &server_version_string,
......
...@@ -12,7 +12,7 @@ ...@@ -12,7 +12,7 @@
* Portions Copyright (c) 1996-2002, PostgreSQL Global Development Group * Portions Copyright (c) 1996-2002, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California * Portions Copyright (c) 1994, Regents of the University of California
* *
* $Id: miscadmin.h,v 1.124 2003/06/27 14:45:31 petere Exp $ * $Id: miscadmin.h,v 1.125 2003/06/27 19:08:38 tgl Exp $
* *
* NOTES * NOTES
* some of the information in this file should be moved to * some of the information in this file should be moved to
...@@ -208,7 +208,7 @@ extern AclId GetSessionUserId(void); ...@@ -208,7 +208,7 @@ extern AclId GetSessionUserId(void);
extern void SetSessionUserId(AclId userid); extern void SetSessionUserId(AclId userid);
extern void InitializeSessionUserId(const char *username); extern void InitializeSessionUserId(const char *username);
extern void InitializeSessionUserIdStandalone(void); extern void InitializeSessionUserIdStandalone(void);
extern void SetSessionAuthorization(AclId userid); extern void SetSessionAuthorization(AclId userid, bool is_superuser);
extern void SetDataDir(const char *dir); extern void SetDataDir(const char *dir);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment