From 44c44bea036aee3fb61a05868fa703ec879efbd6 Mon Sep 17 00:00:00 2001 From: shalinilohia50 <46928246+shalinilohia50@users.noreply.github.com> Date: Tue, 21 Nov 2023 16:45:03 +0530 Subject: [PATCH 1/2] Fix bugs for GRANT/REVOKE on SCHEMA (#2031) Bug fixes for GRANT/REVOKE .. ON SCHEMA 1. Server crash when using empty bracketed name. `schema::[]` 2. Server crash when using empty quoted identifier. `schema::""` 3. When granting permission to yourself, we need a different error message. 4. Error message in not-supported multi-keyword permission should (i) be in uppercase (ii) have a space between keywords 5. Not-supported object type in error message should be in uppercase 6. GRANT ON SCHEMA:: TO PUBLIC does not take effect 7. Specified collation for column names using NAME datatype Issues Resolved : BABEL-4344 Signed-off-by: Shalini Lohia --- contrib/babelfishpg_tsql/sql/ownership.sql | 10 +- .../babelfishpg_tsql--3.3.0--3.4.0.sql | 10 +- contrib/babelfishpg_tsql/src/catalog.c | 193 +++++++++----- contrib/babelfishpg_tsql/src/catalog.h | 2 + contrib/babelfishpg_tsql/src/pl_exec-2.c | 48 ++-- contrib/babelfishpg_tsql/src/pl_handler.c | 82 +++--- contrib/babelfishpg_tsql/src/pltsql_utils.c | 5 +- contrib/babelfishpg_tsql/src/tsqlIface.cpp | 20 ++ .../src/tsqlUnsupportedFeatureHandler.cpp | 8 +- test/JDBC/expected/BABEL-GRANT.out | 34 ++- test/JDBC/expected/GRANT_SCHEMA.out | 236 +++++++++++++++++- test/JDBC/input/BABEL-GRANT.sql | 18 +- test/JDBC/input/GRANT_SCHEMA.mix | 157 +++++++++++- .../expected_create.out | 1 - 14 files changed, 681 insertions(+), 143 deletions(-) diff --git a/contrib/babelfishpg_tsql/sql/ownership.sql b/contrib/babelfishpg_tsql/sql/ownership.sql index ee3a5446a43..a632a918157 100644 --- a/contrib/babelfishpg_tsql/sql/ownership.sql +++ b/contrib/babelfishpg_tsql/sql/ownership.sql @@ -17,11 +17,11 @@ GRANT SELECT on sys.babelfish_sysdatabases TO PUBLIC; -- BABELFISH_SCHEMA_PERMISSIONS CREATE TABLE sys.babelfish_schema_permissions ( dbid smallint NOT NULL, - schema_name NAME NOT NULL, - object_name NAME NOT NULL, - permission NAME NOT NULL, - grantee NAME NOT NULL, - object_type NAME, + schema_name NAME NOT NULL COLLATE sys.database_default, + object_name NAME NOT NULL COLLATE sys.database_default, + permission NAME NOT NULL COLLATE sys.database_default, + grantee NAME NOT NULL COLLATE sys.database_default, + object_type NAME COLLATE sys.database_default, PRIMARY KEY(dbid, schema_name, object_name, permission, grantee) ); diff --git a/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql b/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql index fe141534577..88085d95304 100644 --- a/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql +++ b/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql @@ -892,11 +892,11 @@ LANGUAGE plpgsql STABLE; -- BABELFISH_SCHEMA_PERMISSIONS CREATE TABLE IF NOT EXISTS sys.babelfish_schema_permissions ( dbid smallint NOT NULL, - schema_name NAME NOT NULL, - object_name NAME NOT NULL, - permission NAME NOT NULL, - grantee NAME NOT NULL, - object_type NAME, + schema_name NAME NOT NULL COLLATE sys.database_default, + object_name NAME NOT NULL COLLATE sys.database_default, + permission NAME NOT NULL COLLATE sys.database_default, + grantee NAME NOT NULL COLLATE sys.database_default, + object_type NAME COLLATE sys.database_default, PRIMARY KEY(dbid, schema_name, object_name, permission, grantee) ); diff --git a/contrib/babelfishpg_tsql/src/catalog.c b/contrib/babelfishpg_tsql/src/catalog.c index 8f1f9bdc2a2..2d832e6a6e6 100644 --- a/contrib/babelfishpg_tsql/src/catalog.c +++ b/contrib/babelfishpg_tsql/src/catalog.c @@ -2843,6 +2843,10 @@ add_entry_to_bbf_schema(const char *schema_name, bool new_record_nulls_bbf_schema[BBF_SCHEMA_PERMS_NUM_OF_COLS]; int16 dbid = get_cur_db_id(); + /* Immediately return, if grantee is NULL or PUBLIC. */ + if ((grantee == NULL) || (strcmp(grantee, "public") == 0)) + return; + /* Fetch the relation */ bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), RowExclusiveLock); @@ -2885,45 +2889,65 @@ check_bbf_schema_for_entry(const char *schema_name, { Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; - ScanKeyData key[5]; - TableScanDesc scan; + ScanKeyData scanKey[5]; + SysScanDesc scan; bool catalog_entry_exists = false; int16 dbid = get_cur_db_id(); + /* Immediately return false, if grantee is NULL or PUBLIC. */ + if ((grantee == NULL) || (strcmp(grantee, "public") == 0)) + return false; + bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), AccessShareLock); - ScanKeyInit(&key[0], + ScanKeyInit(&scanKey[0], Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&key[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&key[2], + ScanKeyEntryInitialize(&scanKey[2], 0, Anum_bbf_schema_perms_object_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(object_name)); - ScanKeyInit(&key[3], + ScanKeyEntryInitialize(&scanKey[3], 0, Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(permission)); - ScanKeyInit(&key[4], + ScanKeyEntryInitialize(&scanKey[4], 0, Anum_bbf_schema_perms_grantee, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(grantee)); + scan = systable_beginscan(bbf_schema_rel, + get_bbf_schema_perms_idx_oid(), + true, NULL, 5, scanKey); - scan = table_beginscan_catalog(bbf_schema_rel, 5, key); - - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + tuple_bbf_schema = systable_getnext(scan); if (HeapTupleIsValid(tuple_bbf_schema)) catalog_entry_exists = true; - table_endscan(scan); + systable_endscan(scan); table_close(bbf_schema_rel, AccessShareLock); return catalog_entry_exists; } +/* + * Checks if a particular schema has any SCHEMA level permission granted to any user. + */ bool check_bbf_schema_for_schema(const char *schema_name, const char *object_name, @@ -2932,7 +2956,7 @@ check_bbf_schema_for_schema(const char *schema_name, Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; ScanKeyData key[4]; - TableScanDesc scan; + SysScanDesc scan; bool catalog_entry_exists = false; int16 dbid = get_cur_db_id(); @@ -2942,26 +2966,37 @@ check_bbf_schema_for_schema(const char *schema_name, Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&key[1], + ScanKeyEntryInitialize(&key[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&key[2], + ScanKeyEntryInitialize(&key[2], 0, Anum_bbf_schema_perms_object_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(object_name)); - ScanKeyInit(&key[3], + ScanKeyEntryInitialize(&key[3], 0, Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(permission)); - scan = table_beginscan_catalog(bbf_schema_rel, 4, key); + scan = systable_beginscan(bbf_schema_rel, + get_bbf_schema_perms_idx_oid(), + true, NULL, 4, key); - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + tuple_bbf_schema = systable_getnext(scan); if (HeapTupleIsValid(tuple_bbf_schema)) catalog_entry_exists = true; - table_endscan(scan); + systable_endscan(scan); table_close(bbf_schema_rel, AccessShareLock); return catalog_entry_exists; } @@ -2974,44 +3009,59 @@ del_from_bbf_schema(const char *schema_name, { Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; - ScanKeyData key[5]; - TableScanDesc scan; + ScanKeyData scanKey[5]; + SysScanDesc scan; int16 dbid = get_cur_db_id(); + /* Immediately return, if grantee is NULL or PUBLIC. */ + if ((grantee == NULL) || (strcmp(grantee, "public") == 0)) + return; + bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), RowExclusiveLock); - ScanKeyInit(&key[0], + ScanKeyInit(&scanKey[0], Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&key[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&key[2], + ScanKeyEntryInitialize(&scanKey[2], 0, Anum_bbf_schema_perms_object_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(object_name)); - ScanKeyInit(&key[3], + ScanKeyEntryInitialize(&scanKey[3], 0, Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(permission)); - ScanKeyInit(&key[4], + ScanKeyEntryInitialize(&scanKey[4], 0, Anum_bbf_schema_perms_grantee, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(grantee)); + scan = systable_beginscan(bbf_schema_rel, + get_bbf_schema_perms_idx_oid(), + true, NULL, 5, scanKey); - scan = table_beginscan_catalog(bbf_schema_rel, 5, key); - - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + tuple_bbf_schema = systable_getnext(scan); if (HeapTupleIsValid(tuple_bbf_schema)) CatalogTupleDelete(bbf_schema_rel, &tuple_bbf_schema->t_self); - table_endscan(scan); + systable_endscan(scan); table_close(bbf_schema_rel, RowExclusiveLock); - - CommandCounterIncrement(); } void @@ -3035,9 +3085,12 @@ clean_up_bbf_schema(const char *schema_name, Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&scanKey[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), @@ -3050,13 +3103,19 @@ clean_up_bbf_schema(const char *schema_name, Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&scanKey[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&scanKey[2], + ScanKeyEntryInitialize(&scanKey[2], 0, Anum_bbf_schema_perms_object_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(object_name)); scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), @@ -3074,12 +3133,18 @@ clean_up_bbf_schema(const char *schema_name, table_close(bbf_schema_rel, RowExclusiveLock); } +/* + * For all objects belonging to a schema which has OBJECT level permission, + * It grants the permission explicitly when REVOKE has been executed on that + * specific schema. + */ + void grant_perms_to_objects_in_schema(const char *schema_name, const char *permission, const char *grantee) { - TableScanDesc scan; + SysScanDesc scan; Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; const char *object_name; @@ -3095,21 +3160,31 @@ grant_perms_to_objects_in_schema(const char *schema_name, Anum_bbf_schema_perms_dbid, BTEqualStrategyNumber, F_INT2EQ, Int16GetDatum(dbid)); - ScanKeyInit(&scanKey[1], + ScanKeyEntryInitialize(&scanKey[1], 0, Anum_bbf_schema_perms_schema_name, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(schema_name)); - ScanKeyInit(&scanKey[2], + ScanKeyEntryInitialize(&scanKey[2], 0, Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(permission)); - ScanKeyInit(&scanKey[3], + ScanKeyEntryInitialize(&scanKey[3], 0, Anum_bbf_schema_perms_grantee, - BTEqualStrategyNumber, F_NAMEEQ, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, CStringGetDatum(grantee)); - scan = table_beginscan_catalog(bbf_schema_rel, 4, scanKey); - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), + true, NULL, 4, scanKey); + tuple_bbf_schema = systable_getnext(scan); while (HeapTupleIsValid(tuple_bbf_schema)) { @@ -3162,9 +3237,9 @@ grant_perms_to_objects_in_schema(const char *schema_name, /* make sure later steps can see the object created here */ CommandCounterIncrement(); } - tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + tuple_bbf_schema = systable_getnext(scan); } - table_endscan(scan); + systable_endscan(scan); table_close(bbf_schema_rel, AccessShareLock); } diff --git a/contrib/babelfishpg_tsql/src/catalog.h b/contrib/babelfishpg_tsql/src/catalog.h index 7b8ad195c27..c3a7de00859 100644 --- a/contrib/babelfishpg_tsql/src/catalog.h +++ b/contrib/babelfishpg_tsql/src/catalog.h @@ -299,6 +299,8 @@ typedef FormData_bbf_function_ext *Form_bbf_function_ext; #define Anum_bbf_schema_perms_grantee 5 #define Anum_bbf_schema_perms_object_type 6 +#define PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA "ALL" + extern Oid bbf_schema_perms_oid; extern Oid bbf_schema_perms_idx_oid; diff --git a/contrib/babelfishpg_tsql/src/pl_exec-2.c b/contrib/babelfishpg_tsql/src/pl_exec-2.c index 4e948a0be0f..3e98b678e85 100644 --- a/contrib/babelfishpg_tsql/src/pl_exec-2.c +++ b/contrib/babelfishpg_tsql/src/pl_exec-2.c @@ -3683,32 +3683,36 @@ exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) char *dbname = get_cur_db_name(); char *login = GetUserNameFromId(GetSessionUserId(), false); bool login_is_db_owner; - Oid datdba; char *rolname; char *schema_name; ListCell *lc; ListCell *lc1; Oid schemaOid; + char *user = GetUserNameFromId(GetUserId(), false); /* * If the login is not the db owner or the login is not the member of * sysadmin or login is not the schema owner, then it doesn't have the permission to GRANT/REVOKE. */ login_is_db_owner = 0 == strncmp(login, get_owner_of_db(dbname), NAMEDATALEN); - datdba = get_role_oid("sysadmin", false); schema_name = get_physical_schema_name(dbname, stmt->schema_name); - schemaOid = LookupExplicitNamespace(schema_name, true); + + if(schema_name) + { + schemaOid = LookupExplicitNamespace(schema_name, true); + } + else + { + ereport(ERROR, + (errcode(ERRCODE_UNDEFINED_SCHEMA), + errmsg("An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as \"\" or [] are not allowed. Change the alias to a valid name."))); + } if (!OidIsValid(schemaOid)) ereport(ERROR, (errcode(ERRCODE_UNDEFINED_SCHEMA), errmsg("schema \"%s\" does not exist", schema_name))); - - if (!is_member_of_role(GetSessionUserId(), datdba) && !login_is_db_owner && !pg_namespace_ownercheck(schemaOid, GetUserId())) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("Cannot find the schema \"%s\", because it does not exist or you do not have permission.", stmt->schema_name))); foreach(lc1, stmt->privileges) { @@ -3718,20 +3722,27 @@ exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) char *grantee_name = (char *) lfirst(lc); Oid role_oid; bool grantee_is_db_owner; - rolname = get_physical_user_name(dbname, grantee_name); + if (strcmp(grantee_name, "public") != 0) + rolname = get_physical_user_name(dbname, grantee_name); + else + rolname = pstrdup("public"); role_oid = get_role_oid(rolname, true); grantee_is_db_owner = 0 == strncmp(grantee_name, get_owner_of_db(dbname), NAMEDATALEN); - - if (role_oid == InvalidOid) + if (strcmp(grantee_name, "public") != 0 && role_oid == InvalidOid) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("Cannot find the principal '%s', because it does not exist or you do not have permission.", grantee_name))); - if (pg_namespace_ownercheck(schemaOid, role_oid) || is_member_of_role(role_oid, datdba) || grantee_is_db_owner) + if ((strcmp(rolname, user) == 0) || pg_namespace_ownercheck(schemaOid, role_oid) || is_member_of_role(role_oid, get_sysadmin_oid()) || grantee_is_db_owner) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself."))); + if (!is_member_of_role(GetSessionUserId(), get_sysadmin_oid()) && !login_is_db_owner && !pg_namespace_ownercheck(schemaOid, GetUserId())) + ereport(ERROR, + (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("Cannot find the schema \"%s\", because it does not exist or you do not have permission.", stmt->schema_name))); + parsetree_list = gen_grantschema_subcmds(schema_name, rolname, stmt->is_grant, stmt->with_grant_option, priv_name); /* Run all subcommands */ foreach(parsetree_item, parsetree_list) @@ -3761,17 +3772,22 @@ exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) CommandCounterIncrement(); } /* Add entry for each grant statement. */ - if (stmt->is_grant && !check_bbf_schema_for_entry(stmt->schema_name, "ALL", priv_name, rolname)) - add_entry_to_bbf_schema(stmt->schema_name, "ALL", priv_name, rolname, NULL); + if (stmt->is_grant && !check_bbf_schema_for_entry(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname)) + add_entry_to_bbf_schema(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname, NULL); /* Remove entry for each revoke statement. */ - if (!stmt->is_grant && check_bbf_schema_for_entry(stmt->schema_name, "ALL", priv_name, rolname)) + if (!stmt->is_grant && check_bbf_schema_for_entry(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname)) { /* If any object in the schema has the OBJECT level permission. Then, internally grant that permission back. */ grant_perms_to_objects_in_schema(stmt->schema_name, priv_name, rolname); - del_from_bbf_schema(stmt->schema_name, "ALL", priv_name, rolname); + del_from_bbf_schema(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname); } + pfree(rolname); } } + pfree(user); + pfree(schema_name); + pfree(dbname); + pfree(login); return PLTSQL_RC_OK; } diff --git a/contrib/babelfishpg_tsql/src/pl_handler.c b/contrib/babelfishpg_tsql/src/pl_handler.c index 10297b0c90e..ab83ccdf4af 100644 --- a/contrib/babelfishpg_tsql/src/pl_handler.c +++ b/contrib/babelfishpg_tsql/src/pl_handler.c @@ -3641,7 +3641,10 @@ bbf_ProcessUtility(PlannedStmt *pstmt, char *permissions[] = {"select", "insert", "update", "references", "delete"}; for(i = 0; i < 5; i++) { - if ((rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logical_schema, obj, permissions[i], rol_spec->rolename)) + /* + * If object permission doesn't exist already, add an entry to the catalog. + */ + if (!check_bbf_schema_for_entry(logical_schema, obj, permissions[i], rol_spec->rolename)) add_entry_to_bbf_schema(logical_schema, obj, permissions[i], rol_spec->rolename, obj_type); } } @@ -3657,10 +3660,15 @@ bbf_ProcessUtility(PlannedStmt *pstmt, char *permissions[] = {"select", "insert", "update", "references", "delete"}; for(i = 0; i < 5; i++) { - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logical_schema, "ALL", permissions[i], rol_spec->rolename) && !has_schema_perms) + /* + * 1. If only schema permission exists, don't revoke any permission. + * 2. If only object permission exists, delete entry from the catalog and revoke permission. + * 3. If both schema and object permission exist, don't revoke any permission but delete object + * entry from the catalog. + */ + if (check_bbf_schema_for_entry(logical_schema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, permissions[i], rol_spec->rolename) && !has_schema_perms) has_schema_perms = true; - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logical_schema, obj, permissions[i], rol_spec->rolename)) - del_from_bbf_schema(logical_schema, obj, permissions[i], rol_spec->rolename); + del_from_bbf_schema(logical_schema, obj, permissions[i], rol_spec->rolename); } if (has_schema_perms) return; @@ -3687,7 +3695,12 @@ bbf_ProcessUtility(PlannedStmt *pstmt, foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - if ((ap->cols == NULL) && (rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logical_schema, obj, ap->priv_name, rol_spec->rolename)) + /* + * Don't add an entry, if the permission is granted on column list. + */ + if (ap->cols != NULL) + break; + if (!check_bbf_schema_for_entry(logical_schema, obj, ap->priv_name, rol_spec->rolename)) add_entry_to_bbf_schema(logical_schema, obj, ap->priv_name, rol_spec->rolename, obj_type); } } @@ -3700,7 +3713,7 @@ bbf_ProcessUtility(PlannedStmt *pstmt, * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. */ - if ((logical_schema != NULL) && (rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logical_schema, "ALL", ap->priv_name, rol_spec->rolename)) + if ((logical_schema != NULL) && !check_bbf_schema_for_entry(logical_schema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, ap->priv_name, rol_spec->rolename)) { if (prev_ProcessUtility) prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, @@ -3709,8 +3722,12 @@ bbf_ProcessUtility(PlannedStmt *pstmt, standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, queryEnv, dest, qc); } - if ((ap->cols == NULL) && (rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logical_schema, obj, ap->priv_name, rol_spec->rolename)) - del_from_bbf_schema(logical_schema, obj, ap->priv_name, rol_spec->rolename); + /* + * Don't remove an entry, if the permission is revoked on column list. + */ + if (ap->cols != NULL) + break; + del_from_bbf_schema(logical_schema, obj, ap->priv_name, rol_spec->rolename); } } } @@ -3743,28 +3760,28 @@ bbf_ProcessUtility(PlannedStmt *pstmt, logicalschema = get_logical_schema_name(schemaname, true); funcname = strVal(func); } - /* - * Case: When ALL PRIVILEGES is revoked internally during create function. - * Check if schema entry exists in the catalog, do not revoke any permission if exists. - */ - if (pstmt->stmt_len == 0 && list_length(grant->privileges) == 0) - { - if(check_bbf_schema_for_schema(logicalschema, "ALL", "execute")) - return; - break; - } + /* If ALL PRIVILEGES is granted/revoked. */ if (list_length(grant->privileges) == 0) { + /* + * Case: When ALL PRIVILEGES is revoked internally during create function. + * Check if schema entry exists in the catalog, do not revoke any permission if exists. + */ + if (pstmt->stmt_len == 0) + { + if(check_bbf_schema_for_schema(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, "execute")) + return; + } + if (grant->is_grant) { foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - if ((rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logicalschema, funcname, "execute", rol_spec->rolename)) + if (!check_bbf_schema_for_entry(logicalschema, funcname, "execute", rol_spec->rolename)) add_entry_to_bbf_schema(logicalschema, funcname, "execute", rol_spec->rolename, obj_type); } - break; } else { @@ -3772,15 +3789,14 @@ bbf_ProcessUtility(PlannedStmt *pstmt, { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); bool has_schema_perms = false; - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logicalschema, "ALL", "execute", rol_spec->rolename) && !has_schema_perms) + if (check_bbf_schema_for_entry(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, "execute", rol_spec->rolename) && !has_schema_perms) has_schema_perms = true; - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logicalschema, funcname, "execute", rol_spec->rolename)) - del_from_bbf_schema(logicalschema, funcname, "execute", rol_spec->rolename); + del_from_bbf_schema(logicalschema, funcname, "execute", rol_spec->rolename); if (has_schema_perms) return; } - break; } + break; } foreach(lc1, grant->privileges) { @@ -3798,9 +3814,11 @@ bbf_ProcessUtility(PlannedStmt *pstmt, foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - /* Don't store a row in catalog, if permission is granted for column */ - if ((rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logicalschema, funcname, ap->priv_name, rol_spec->rolename)) + /* Add an entry to the catalog, if an entry doesn't exist already. */ + if (!check_bbf_schema_for_entry(logicalschema, funcname, ap->priv_name, rol_spec->rolename)) + { add_entry_to_bbf_schema(logicalschema, funcname, ap->priv_name, rol_spec->rolename, obj_type); + } } } else @@ -3809,10 +3827,10 @@ bbf_ProcessUtility(PlannedStmt *pstmt, { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); /* - * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. - * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. - */ - if ((rol_spec->rolename != NULL) && !check_bbf_schema_for_entry(logicalschema, "ALL", ap->priv_name, rol_spec->rolename)) + * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. + * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. + */ + if (!check_bbf_schema_for_entry(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, ap->priv_name, rol_spec->rolename)) { /* Execute REVOKE statement. */ if (prev_ProcessUtility) @@ -3822,8 +3840,8 @@ bbf_ProcessUtility(PlannedStmt *pstmt, standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, queryEnv, dest, qc); } - if ((rol_spec->rolename != NULL) && check_bbf_schema_for_entry(logicalschema, funcname, ap->priv_name, rol_spec->rolename)) - del_from_bbf_schema(logicalschema, funcname, ap->priv_name, rol_spec->rolename); + /* Remove an entry from the catalog, if it exists. */ + del_from_bbf_schema(logicalschema, funcname, ap->priv_name, rol_spec->rolename); } } } diff --git a/contrib/babelfishpg_tsql/src/pltsql_utils.c b/contrib/babelfishpg_tsql/src/pltsql_utils.c index df3c57df719..d635d81ab7a 100644 --- a/contrib/babelfishpg_tsql/src/pltsql_utils.c +++ b/contrib/babelfishpg_tsql/src/pltsql_utils.c @@ -1036,7 +1036,10 @@ update_GrantStmt(Node *n, const char *object, const char *obj_schema, const char if (grantee && stmt->grantees) { RoleSpec *tmp = (RoleSpec *) llast(stmt->grantees); - + if (strcmp(grantee, "public") == 0) + { + tmp->roletype = ROLESPEC_PUBLIC; + } tmp->rolename = pstrdup(grantee); } diff --git a/contrib/babelfishpg_tsql/src/tsqlIface.cpp b/contrib/babelfishpg_tsql/src/tsqlIface.cpp index 695b28dc468..be3ceece6cb 100644 --- a/contrib/babelfishpg_tsql/src/tsqlIface.cpp +++ b/contrib/babelfishpg_tsql/src/tsqlIface.cpp @@ -5527,6 +5527,11 @@ makeGrantdbStatement(TSqlParser::Security_statementContext *ctx) char *grantee_name = pstrdup(downcase_truncate_identifier(id_str.c_str(), id_str.length(), true)); grantee_list = lappend(grantee_list, grantee_name); } + if (prin->PUBLIC()) + { + char *grantee_name = pstrdup("public"); + grantee_list = lappend(grantee_list, grantee_name); + } } result->grantees = grantee_list; return (PLtsql_stmt *) result; @@ -5555,6 +5560,11 @@ makeGrantdbStatement(TSqlParser::Security_statementContext *ctx) char *grantee_name = pstrdup(downcase_truncate_identifier(id_str.c_str(), id_str.length(), true)); grantee_list = lappend(grantee_list, grantee_name); } + if (prin->PUBLIC()) + { + char *grantee_name = pstrdup("public"); + grantee_list = lappend(grantee_list, grantee_name); + } } result->grantees = grantee_list; return (PLtsql_stmt *) result; @@ -5585,6 +5595,11 @@ makeGrantdbStatement(TSqlParser::Security_statementContext *ctx) char *grantee_name = pstrdup(downcase_truncate_identifier(id_str.c_str(), id_str.length(), true)); grantee_list = lappend(grantee_list, grantee_name); } + if (prin->PUBLIC()) + { + char *grantee_name = pstrdup("public"); + grantee_list = lappend(grantee_list, grantee_name); + } } List *privilege_list = NIL; for (auto perm: ctx->grant_statement()->permissions()->permission()) @@ -5637,6 +5652,11 @@ makeGrantdbStatement(TSqlParser::Security_statementContext *ctx) char *grantee_name = pstrdup(downcase_truncate_identifier(id_str.c_str(), id_str.length(), true)); grantee_list = lappend(grantee_list, grantee_name); } + if (prin->PUBLIC()) + { + char *grantee_name = pstrdup("public"); + grantee_list = lappend(grantee_list, grantee_name); + } } List *privilege_list = NIL; for (auto perm: ctx->revoke_statement()->permissions()->permission()) diff --git a/contrib/babelfishpg_tsql/src/tsqlUnsupportedFeatureHandler.cpp b/contrib/babelfishpg_tsql/src/tsqlUnsupportedFeatureHandler.cpp index 29cdc5ac320..64a4d12f89e 100644 --- a/contrib/babelfishpg_tsql/src/tsqlUnsupportedFeatureHandler.cpp +++ b/contrib/babelfishpg_tsql/src/tsqlUnsupportedFeatureHandler.cpp @@ -1704,7 +1704,8 @@ void TsqlUnsupportedFeatureHandlerImpl::checkSupportedGrantStmt(TSqlParser::Gran continue; else { - unsupported_feature = "GRANT PERMISSION " + perm->getText(); + unsupported_feature = "GRANT PERMISSION " + ::getFullText(single_perm); + std::transform(unsupported_feature.begin(), unsupported_feature.end(), unsupported_feature.begin(), ::toupper); handle(INSTR_UNSUPPORTED_TSQL_REVOKE_STMT, unsupported_feature.c_str(), getLineAndPos(perm)); } } @@ -1719,6 +1720,7 @@ void TsqlUnsupportedFeatureHandlerImpl::checkSupportedGrantStmt(TSqlParser::Gran if (obj_type && !(obj_type->OBJECT() || obj_type->SCHEMA())) { unsupported_feature = "GRANT ON " + obj_type->getText(); + std::transform(unsupported_feature.begin(), unsupported_feature.end(), unsupported_feature.begin(), ::toupper); handle(INSTR_UNSUPPORTED_TSQL_REVOKE_STMT, unsupported_feature.c_str(), getLineAndPos(obj_type)); } } @@ -1798,7 +1800,8 @@ void TsqlUnsupportedFeatureHandlerImpl::checkSupportedRevokeStmt(TSqlParser::Rev continue; else { - unsupported_feature = "REVOKE PERMISSION " + perm->getText(); + unsupported_feature = "REVOKE PERMISSION " + ::getFullText(single_perm); + std::transform(unsupported_feature.begin(), unsupported_feature.end(), unsupported_feature.begin(), ::toupper); handle(INSTR_UNSUPPORTED_TSQL_REVOKE_STMT, unsupported_feature.c_str(), getLineAndPos(perm)); } } @@ -1813,6 +1816,7 @@ void TsqlUnsupportedFeatureHandlerImpl::checkSupportedRevokeStmt(TSqlParser::Rev if (obj_type && !(obj_type->OBJECT() || obj_type->SCHEMA())) { unsupported_feature = "REVOKE ON " + obj_type->getText(); + std::transform(unsupported_feature.begin(), unsupported_feature.end(), unsupported_feature.begin(), ::toupper); handle(INSTR_UNSUPPORTED_TSQL_REVOKE_STMT, unsupported_feature.c_str(), getLineAndPos(obj_type)); } } diff --git a/test/JDBC/expected/BABEL-GRANT.out b/test/JDBC/expected/BABEL-GRANT.out index d3f48b241fe..2a59cf3dead 100644 --- a/test/JDBC/expected/BABEL-GRANT.out +++ b/test/JDBC/expected/BABEL-GRANT.out @@ -174,7 +174,7 @@ GO REVOKE SELECT ON SCHEMA::scm FROM guest; GO -GRANT SHOWPLAN ON OBJECT::t1 TO guest; -- unsupported permission +GRANT showplan ON OBJECT::t1 TO guest; -- unsupported permission GO ~~ERROR (Code: 33557097)~~ @@ -188,20 +188,48 @@ GO ~~ERROR (Message: 'REVOKE PERMISSION SHOWPLAN' is not currently supported in Babelfish)~~ -GRANT ALL ON SCHEMA::scm TO guest; -- unsupported class +GRANT ALL ON SCHEMA::scm TO guest; GO ~~ERROR (Code: 33557097)~~ ~~ERROR (Message: The all permission has been deprecated and is not available for this class of entity.)~~ -REVOKE ALL ON SCHEMA::scm TO guest; -- unsupported class +REVOKE ALL ON SCHEMA::scm TO guest; GO ~~ERROR (Code: 33557097)~~ ~~ERROR (Message: The all permission has been deprecated and is not available for this class of entity.)~~ +GRANT create table ON OBJECT::t1 TO guest; -- unsupported permission +GO +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: 'GRANT PERMISSION CREATE TABLE' is not currently supported in Babelfish)~~ + + +REVOKE create table ON OBJECT::t2 FROM alogin; -- unsupported permission +GO +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: 'REVOKE PERMISSION CREATE TABLE' is not currently supported in Babelfish)~~ + + +GRANT SELECT ON table::t1 TO guest; -- unsupported object +GO +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: 'GRANT ON TABLE' is not currently supported in Babelfish)~~ + + +REVOKE SELECT ON table::t1 FROM guest; -- unsupported object +GO +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: 'REVOKE ON TABLE' is not currently supported in Babelfish)~~ + + GRANT ALL ON OBJECT::t1 TO guest WITH GRANT OPTION AS superuser; GO ~~ERROR (Code: 33557097)~~ diff --git a/test/JDBC/expected/GRANT_SCHEMA.out b/test/JDBC/expected/GRANT_SCHEMA.out index 1891d685978..935acbe2f53 100644 --- a/test/JDBC/expected/GRANT_SCHEMA.out +++ b/test/JDBC/expected/GRANT_SCHEMA.out @@ -12,9 +12,18 @@ go create user babel_4344_u1 for login babel_4344_l1; go +create login αιώνια with password = '12345678' +go + +create user αιώνια for login αιώνια; +go + create schema babel_4344_s1; go +create schema αγάπη; +go + create schema babel_4344_s2 authorization babel_4344_u1; go @@ -27,6 +36,9 @@ go create table babel_4344_s2.babel_4344_t1(a int); go +create table αγάπη.abc(a int); +go + create table babel_4344_t3(a int, b int); go @@ -45,12 +57,69 @@ go create proc babel_4344_s1.babel_4344_p1 as select 2; go +create proc babel_4344_s1.babel_4344_p3 as select 3; +go + CREATE FUNCTION babel_4344_f1() RETURNS INT AS BEGIN RETURN (SELECT COUNT(*) FROM sys.tables) END go CREATE FUNCTION babel_4344_s1.babel_4344_f1() RETURNS INT AS BEGIN RETURN (SELECT COUNT(*) FROM sys.objects) END go +grant SELECT on schema::babel_4344_S1 to public, αιώνια; +go + +grant select on schema::αγάπη to αιώνια; +go + +-- tsql user=αιώνια password=12345678 +use babel_4344_d1; +go + +select * from αγάπη.abc; +go +~~START~~ +int +~~END~~ + + +select * from babel_4344_S1.babel_4344_t1; +go +~~START~~ +int +~~END~~ + + +use master; +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go + +-- User has select privileges, tables and views be accessible +select * from babel_4344_s1.babel_4344_t1 +go +~~START~~ +int +~~END~~ + +select * from babel_4344_s1.babel_4344_v1; +go +~~START~~ +int +2 +~~END~~ + +use master; +go + +-- tsql +use babel_4344_d1; +go +revoke select on schema::babel_4344_s1 from public, αιώνια; +go + -- tsql user=babel_4344_l1 password=12345678 use babel_4344_d1; go @@ -117,9 +186,9 @@ go -- GRANT OBJECT privilege use babel_4344_d1; go -grant select on babel_4344_t1 to babel_4344_u1; +grant SELECT on babel_4344_t1 to BABEL_4344_U1; go -grant select on babel_4344_s1.babel_4344_t1 to babel_4344_u1; +grant SELECT on babel_4344_s1.babel_4344_t1 to babel_4344_u1; go grant all on babel_4344_s1.babel_4344_t1 to babel_4344_u1; go @@ -135,7 +204,14 @@ grant execute on babel_4344_p1 to babel_4344_u1; go grant execute on babel_4344_s1.babel_4344_p1 to babel_4344_u1; go -grant execute on babel_4344_f1 to babel_4344_u1; +-- inside a transaction, permission will not be granted since it is rolled back +begin transaction; +exec sp_executesql N'grant execute on babel_4344_s1.babel_4344_p3 to babel_4344_u1;'; +rollback transaction; +go + +-- Mixed case +grant Execute on Babel_4344_F1 to babel_4344_u1; go grant execute on babel_4344_s1.babel_4344_f1 to babel_4344_u1; go @@ -152,8 +228,36 @@ go ~~ERROR (Message: Cannot find the principal 'jdbc_user', because it does not exist or you do not have permission.)~~ -grant select on schema::babel_4344_s2 to guest; -- should pass +grant SELECT on schema::babel_4344_s2 to guest; -- should pass +go +grant select on schema::"" to guest; -- should fail go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as "" or [] are not allowed. Change the alias to a valid name.)~~ + +grant select on schema::non_existing_schema to guest; -- should fail +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: schema "non_existing_schema" does not exist)~~ + +-- grant statement via a procedure +create procedure grant_perm_proc as begin exec('grant select on schema::[] to guest') end; +go +exec grant_perm_proc; -- should fail +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: An object or column name is missing or empty. For SELECT INTO statements, verify each column has a name. For other statements, look for empty alias names. Aliases defined as "" or [] are not allowed. Change the alias to a valid name.)~~ + +-- non-existing role +grant SELECT on schema::dbo to guest, babel_4344_u3; -- should fail +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: Cannot find the principal 'babel_4344_u3', because it does not exist or you do not have permission.)~~ + -- tsql user=babel_4344_l1 password=12345678 -- User has OBJECT privileges, should be accessible. @@ -215,6 +319,12 @@ int 2 ~~END~~ +exec babel_4344_s1.babel_4344_p3; -- should fail, grant statement was rolled back +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: permission denied for procedure babel_4344_p3)~~ + select * from babel_4344_f1(); go ~~START~~ @@ -242,7 +352,7 @@ grant select on schema::babel_4344_s1 to babel_4344_u1; -- should fail go ~~ERROR (Code: 33557097)~~ -~~ERROR (Message: Cannot find the schema "babel_4344_s1", because it does not exist or you do not have permission.)~~ +~~ERROR (Message: Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself.)~~ use master; go @@ -256,6 +366,19 @@ go use master; go +-- psql +-- GRANT statement add an entry to the catalog +select schema_name, object_name, permission, grantee from sys.babelfish_schema_permissions +where schema_name = 'babel_4344_s1' collate "C" and object_name = 'ALL' collate "C" order by permission; +go +~~START~~ +name#!#name#!#name#!#name +babel_4344_s1#!#ALL#!#execute#!#babel_4344_d1_babel_4344_u1 +babel_4344_s1#!#ALL#!#insert#!#babel_4344_d1_babel_4344_u1 +babel_4344_s1#!#ALL#!#select#!#babel_4344_d1_babel_4344_u1 +~~END~~ + + -- tsql user=babel_4344_l1 password=12345678 -- User has OBJECT and SCHEMA privileges, should be accessible. use babel_4344_d1; @@ -295,7 +418,7 @@ select * from babel_4344_s1.babel_4344_f1(); go ~~START~~ int -10 +11 ~~END~~ use master; @@ -339,14 +462,14 @@ int 2 ~~END~~ -exec babel_4344_s1.babel_4344_p1; -- TODO: should be accessible +exec babel_4344_s1.babel_4344_p1; go ~~START~~ int 2 ~~END~~ -select * from babel_4344_s1.babel_4344_f1(); -- TODO: should be accessible +select * from babel_4344_s1.babel_4344_f1(); go ~~START~~ int @@ -412,7 +535,7 @@ select * from babel_4344_s1.babel_4344_f2(); go ~~START~~ int -14 +15 ~~END~~ use master; @@ -477,7 +600,7 @@ select * from babel_4344_s1.babel_4344_f1(); go ~~START~~ int -14 +15 ~~END~~ select * from babel_4344_s2.babel_4344_t1; @@ -498,6 +621,15 @@ go use master; go +-- psql +-- REVOKE on schema removes the entry from the catalog +select * from sys.babelfish_schema_permissions where schema_name = 'babel_4344_s1' collate sys.database_default; +go +~~START~~ +int2#!#name#!#name#!#name#!#name#!#name +~~END~~ + + -- tsql user=babel_4344_l1 password=12345678 -- User has no privileges, shouldn't be accessible. use babel_4344_d1; @@ -541,6 +673,54 @@ go use master; go +-- psql +-- grant object permission +grant select on babel_4344_s1.babel_4344_t1 to babel_4344_d1_babel_4344_u1; +go + +-- tsql +-- grant schema permission +use babel_4344_d1; +go +grant select on schema::babel_4344_s1 to babel_4344_u1; +go +use master +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go +select * from babel_4344_s1.babel_4344_t1; -- accessible +go +~~START~~ +int +2 +3 +3 +4 +5 +~~END~~ + +use master +go + +-- psql +-- revoke schema permission +revoke select on all tables in schema babel_4344_s1 from babel_4344_d1_babel_4344_u1; +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go +select * from babel_4344_s1.babel_4344_t1; -- not accessible +go +~~ERROR (Code: 33557097)~~ + +~~ERROR (Message: permission denied for table babel_4344_t1)~~ + +use master +go + -- tsql -- Drop objects use babel_4344_d1; @@ -579,6 +759,9 @@ go drop proc babel_4344_s1.babel_4344_p2; go +drop proc babel_4344_s1.babel_4344_p3; +go + drop function babel_4344_f1; go @@ -597,9 +780,18 @@ go drop schema babel_4344_s2; go +drop table αγάπη.abc; +go + +drop schema αγάπη; +go + drop user babel_4344_u1; go +drop user αιώνια; +go + use master; go @@ -629,3 +821,27 @@ void -- tsql drop login babel_4344_l1; go + +-- psql +-- Need to terminate active session before cleaning up the login +SELECT pg_terminate_backend(pid) FROM pg_stat_get_activity(NULL) +WHERE sys.suser_name(usesysid) = 'αιώνια' AND backend_type = 'client backend' AND usesysid IS NOT NULL; +go +~~START~~ +bool +t +~~END~~ + + +-- Wait to sync with another session +SELECT pg_sleep(1); +go +~~START~~ +void + +~~END~~ + + +-- tsql +drop login αιώνια; +go diff --git a/test/JDBC/input/BABEL-GRANT.sql b/test/JDBC/input/BABEL-GRANT.sql index 3e0155ea283..8388f782ffd 100644 --- a/test/JDBC/input/BABEL-GRANT.sql +++ b/test/JDBC/input/BABEL-GRANT.sql @@ -164,16 +164,28 @@ GO REVOKE SELECT ON SCHEMA::scm FROM guest; GO -GRANT SHOWPLAN ON OBJECT::t1 TO guest; -- unsupported permission +GRANT showplan ON OBJECT::t1 TO guest; -- unsupported permission GO REVOKE SHOWPLAN ON OBJECT::t2 TO alogin; -- unsupported permission GO -GRANT ALL ON SCHEMA::scm TO guest; -- unsupported class +GRANT ALL ON SCHEMA::scm TO guest; GO -REVOKE ALL ON SCHEMA::scm TO guest; -- unsupported class +REVOKE ALL ON SCHEMA::scm TO guest; +GO + +GRANT create table ON OBJECT::t1 TO guest; -- unsupported permission +GO + +REVOKE create table ON OBJECT::t2 FROM alogin; -- unsupported permission +GO + +GRANT SELECT ON table::t1 TO guest; -- unsupported object +GO + +REVOKE SELECT ON table::t1 FROM guest; -- unsupported object GO GRANT ALL ON OBJECT::t1 TO guest WITH GRANT OPTION AS superuser; diff --git a/test/JDBC/input/GRANT_SCHEMA.mix b/test/JDBC/input/GRANT_SCHEMA.mix index 1572bea803b..f4af9f7af76 100644 --- a/test/JDBC/input/GRANT_SCHEMA.mix +++ b/test/JDBC/input/GRANT_SCHEMA.mix @@ -12,9 +12,18 @@ go create user babel_4344_u1 for login babel_4344_l1; go +create login αιώνια with password = '12345678' +go + +create user αιώνια for login αιώνια; +go + create schema babel_4344_s1; go +create schema αγάπη; +go + create schema babel_4344_s2 authorization babel_4344_u1; go @@ -27,6 +36,9 @@ go create table babel_4344_s2.babel_4344_t1(a int); go +create table αγάπη.abc(a int); +go + create table babel_4344_t3(a int, b int); go @@ -45,12 +57,52 @@ go create proc babel_4344_s1.babel_4344_p1 as select 2; go +create proc babel_4344_s1.babel_4344_p3 as select 3; +go + CREATE FUNCTION babel_4344_f1() RETURNS INT AS BEGIN RETURN (SELECT COUNT(*) FROM sys.tables) END go CREATE FUNCTION babel_4344_s1.babel_4344_f1() RETURNS INT AS BEGIN RETURN (SELECT COUNT(*) FROM sys.objects) END go +grant SELECT on schema::babel_4344_S1 to public, αιώνια; +go + +grant select on schema::αγάπη to αιώνια; +go + +-- tsql user=αιώνια password=12345678 +use babel_4344_d1; +go + +select * from αγάπη.abc; +go + +select * from babel_4344_S1.babel_4344_t1; +go + +use master; +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go + +-- User has select privileges, tables and views be accessible +select * from babel_4344_s1.babel_4344_t1 +go +select * from babel_4344_s1.babel_4344_v1; +go +use master; +go + +-- tsql +use babel_4344_d1; +go +revoke select on schema::babel_4344_s1 from public, αιώνια; +go + -- tsql user=babel_4344_l1 password=12345678 use babel_4344_d1; go @@ -81,9 +133,9 @@ go -- GRANT OBJECT privilege use babel_4344_d1; go -grant select on babel_4344_t1 to babel_4344_u1; +grant SELECT on babel_4344_t1 to BABEL_4344_U1; go -grant select on babel_4344_s1.babel_4344_t1 to babel_4344_u1; +grant SELECT on babel_4344_s1.babel_4344_t1 to babel_4344_u1; go grant all on babel_4344_s1.babel_4344_t1 to babel_4344_u1; go @@ -99,7 +151,14 @@ grant execute on babel_4344_p1 to babel_4344_u1; go grant execute on babel_4344_s1.babel_4344_p1 to babel_4344_u1; go -grant execute on babel_4344_f1 to babel_4344_u1; +-- inside a transaction, permission will not be granted since it is rolled back +begin transaction; +exec sp_executesql N'grant execute on babel_4344_s1.babel_4344_p3 to babel_4344_u1;'; +rollback transaction; +go + +-- Mixed case +grant Execute on Babel_4344_F1 to babel_4344_u1; go grant execute on babel_4344_s1.babel_4344_f1 to babel_4344_u1; go @@ -108,7 +167,19 @@ grant select on schema::babel_4344_s2 to babel_4344_u1; -- should fail go grant select on schema::babel_4344_s2 to jdbc_user; -- should fail go -grant select on schema::babel_4344_s2 to guest; -- should pass +grant SELECT on schema::babel_4344_s2 to guest; -- should pass +go +grant select on schema::"" to guest; -- should fail +go +grant select on schema::non_existing_schema to guest; -- should fail +go +-- grant statement via a procedure +create procedure grant_perm_proc as begin exec('grant select on schema::[] to guest') end; +go +exec grant_perm_proc; -- should fail +go +-- non-existing role +grant SELECT on schema::dbo to guest, babel_4344_u3; -- should fail go -- tsql user=babel_4344_l1 password=12345678 @@ -133,6 +204,8 @@ exec babel_4344_p1; go exec babel_4344_s1.babel_4344_p1; go +exec babel_4344_s1.babel_4344_p3; -- should fail, grant statement was rolled back +go select * from babel_4344_f1(); go select * from babel_4344_s1.babel_4344_f1(); @@ -156,6 +229,12 @@ go use master; go +-- psql +-- GRANT statement add an entry to the catalog +select schema_name, object_name, permission, grantee from sys.babelfish_schema_permissions +where schema_name = 'babel_4344_s1' collate "C" and object_name = 'ALL' collate "C" order by permission; +go + -- tsql user=babel_4344_l1 password=12345678 -- User has OBJECT and SCHEMA privileges, should be accessible. use babel_4344_d1; @@ -196,9 +275,9 @@ select * from babel_4344_s1.babel_4344_t3 -- not accessible go select * from babel_4344_s1.babel_4344_v1; go -exec babel_4344_s1.babel_4344_p1; -- TODO: should be accessible +exec babel_4344_s1.babel_4344_p1; go -select * from babel_4344_s1.babel_4344_f1(); -- TODO: should be accessible +select * from babel_4344_s1.babel_4344_f1(); go select * from babel_4344_s2.babel_4344_t1; go @@ -287,6 +366,11 @@ go use master; go +-- psql +-- REVOKE on schema removes the entry from the catalog +select * from sys.babelfish_schema_permissions where schema_name = 'babel_4344_s1' collate sys.database_default; +go + -- tsql user=babel_4344_l1 password=12345678 -- User has no privileges, shouldn't be accessible. use babel_4344_d1; @@ -306,6 +390,41 @@ go use master; go +-- psql +-- grant object permission +grant select on babel_4344_s1.babel_4344_t1 to babel_4344_d1_babel_4344_u1; +go + +-- tsql +-- grant schema permission +use babel_4344_d1; +go +grant select on schema::babel_4344_s1 to babel_4344_u1; +go +use master +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go +select * from babel_4344_s1.babel_4344_t1; -- accessible +go +use master +go + +-- psql +-- revoke schema permission +revoke select on all tables in schema babel_4344_s1 from babel_4344_d1_babel_4344_u1; +go + +-- tsql user=babel_4344_l1 password=12345678 +use babel_4344_d1; +go +select * from babel_4344_s1.babel_4344_t1; -- not accessible +go +use master +go + -- tsql -- Drop objects use babel_4344_d1; @@ -344,6 +463,9 @@ go drop proc babel_4344_s1.babel_4344_p2; go +drop proc babel_4344_s1.babel_4344_p3; +go + drop function babel_4344_f1; go @@ -362,9 +484,18 @@ go drop schema babel_4344_s2; go +drop table αγάπη.abc; +go + +drop schema αγάπη; +go + drop user babel_4344_u1; go +drop user αιώνια; +go + use master; go @@ -384,3 +515,17 @@ go -- tsql drop login babel_4344_l1; go + +-- psql +-- Need to terminate active session before cleaning up the login +SELECT pg_terminate_backend(pid) FROM pg_stat_get_activity(NULL) +WHERE sys.suser_name(usesysid) = 'αιώνια' AND backend_type = 'client backend' AND usesysid IS NOT NULL; +go + +-- Wait to sync with another session +SELECT pg_sleep(1); +go + +-- tsql +drop login αιώνια; +go diff --git a/test/python/expected/sql_validation_framework/expected_create.out b/test/python/expected/sql_validation_framework/expected_create.out index 26777ae841c..6be51616c03 100644 --- a/test/python/expected/sql_validation_framework/expected_create.out +++ b/test/python/expected/sql_validation_framework/expected_create.out @@ -72,7 +72,6 @@ Could not find tests for procedure sys.printarg Could not find tests for procedure sys.sp_cursor_list Could not find tests for procedure sys.sp_describe_cursor Could not find tests for table sys.babelfish_helpcollation -Could not find tests for table sys.babelfish_schema_permissions Could not find tests for table sys.babelfish_syslanguages Could not find tests for table sys.service_settings Could not find tests for table sys.spt_datatype_info_table From 48277423c556d89e7b1c727f4dbc2442c36e62b5 Mon Sep 17 00:00:00 2001 From: Shalini Lohia Date: Tue, 21 Nov 2023 09:27:32 +0000 Subject: [PATCH 2/2] Stored the permissions in a single column using bits --- contrib/babelfishpg_tsql/sql/ownership.sql | 4 +- .../babelfishpg_tsql--3.3.0--3.4.0.sql | 4 +- contrib/babelfishpg_tsql/src/catalog.c | 346 +++++++++++++----- contrib/babelfishpg_tsql/src/catalog.h | 29 +- contrib/babelfishpg_tsql/src/pl_exec-2.c | 166 +++++---- contrib/babelfishpg_tsql/src/pl_handler.c | 245 +++++++------ contrib/babelfishpg_tsql/src/pltsql.h | 10 + contrib/babelfishpg_tsql/src/pltsql_utils.c | 33 ++ test/JDBC/expected/GRANT_SCHEMA.out | 8 +- 9 files changed, 562 insertions(+), 283 deletions(-) diff --git a/contrib/babelfishpg_tsql/sql/ownership.sql b/contrib/babelfishpg_tsql/sql/ownership.sql index a632a918157..1b0af43e697 100644 --- a/contrib/babelfishpg_tsql/sql/ownership.sql +++ b/contrib/babelfishpg_tsql/sql/ownership.sql @@ -19,10 +19,10 @@ CREATE TABLE sys.babelfish_schema_permissions ( dbid smallint NOT NULL, schema_name NAME NOT NULL COLLATE sys.database_default, object_name NAME NOT NULL COLLATE sys.database_default, - permission NAME NOT NULL COLLATE sys.database_default, + permission SMALLINT, grantee NAME NOT NULL COLLATE sys.database_default, object_type NAME COLLATE sys.database_default, - PRIMARY KEY(dbid, schema_name, object_name, permission, grantee) + PRIMARY KEY(dbid, schema_name, object_name, grantee) ); -- BABELFISH_FUNCTION_EXT diff --git a/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql b/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql index 88085d95304..0f33dff48b0 100644 --- a/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql +++ b/contrib/babelfishpg_tsql/sql/upgrades/babelfishpg_tsql--3.3.0--3.4.0.sql @@ -894,10 +894,10 @@ CREATE TABLE IF NOT EXISTS sys.babelfish_schema_permissions ( dbid smallint NOT NULL, schema_name NAME NOT NULL COLLATE sys.database_default, object_name NAME NOT NULL COLLATE sys.database_default, - permission NAME NOT NULL COLLATE sys.database_default, + permission SMALLINT, grantee NAME NOT NULL COLLATE sys.database_default, object_type NAME COLLATE sys.database_default, - PRIMARY KEY(dbid, schema_name, object_name, permission, grantee) + PRIMARY KEY(dbid, schema_name, object_name, grantee) ); create or replace function sys.babelfish_timezone_mapping(IN tmz text) returns text diff --git a/contrib/babelfishpg_tsql/src/catalog.c b/contrib/babelfishpg_tsql/src/catalog.c index 2d832e6a6e6..16909df5377 100644 --- a/contrib/babelfishpg_tsql/src/catalog.c +++ b/contrib/babelfishpg_tsql/src/catalog.c @@ -2832,7 +2832,7 @@ rename_procfunc_update_bbf_catalog(RenameStmt *stmt) void add_entry_to_bbf_schema(const char *schema_name, const char *object_name, - const char *permission, + int16 permission, const char *grantee, const char *object_type) { @@ -2859,7 +2859,7 @@ add_entry_to_bbf_schema(const char *schema_name, new_record_bbf_schema[BBF_SCHEMA_PERMS_DBID] = Int16GetDatum(dbid); new_record_bbf_schema[BBF_SCHEMA_PERMS_SCHEMA_NAME] = CStringGetDatum(pstrdup(schema_name)); new_record_bbf_schema[BBF_SCHEMA_PERMS_OBJECT_NAME] = CStringGetDatum(pstrdup(object_name)); - new_record_bbf_schema[BBF_SCHEMA_PERMS_PERMISSION] = CStringGetDatum(pstrdup(permission)); + new_record_bbf_schema[BBF_SCHEMA_PERMS_PERMISSION] = Int16GetDatum(permission); new_record_bbf_schema[BBF_SCHEMA_PERMS_GRANTEE] = CStringGetDatum(pstrdup(grantee)); if (object_type != NULL) new_record_bbf_schema[BBF_SCHEMA_PERMS_OBJECT_TYPE] = CStringGetDatum(pstrdup(object_type)); @@ -2880,16 +2880,181 @@ add_entry_to_bbf_schema(const char *schema_name, CommandCounterIncrement(); } +/* + * Get the value of permission column from BABELFISH_SCHEMA_PERMISSIONS table. + */ +int16 +get_bbf_schema_privilege(const char *schema_name, + const char *object_name, + const char *grantee) +{ + Relation bbf_schema_rel; + HeapTuple tuple_bbf_schema; + ScanKeyData scanKey[4]; + SysScanDesc scan; + int16 dbid = get_cur_db_id(); + int16 permission = 0; + + bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), + AccessShareLock); + ScanKeyInit(&scanKey[0], + Anum_bbf_schema_perms_dbid, + BTEqualStrategyNumber, F_INT2EQ, + Int16GetDatum(dbid)); + ScanKeyEntryInitialize(&scanKey[1], 0, + Anum_bbf_schema_perms_schema_name, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, + CStringGetDatum(schema_name)); + ScanKeyEntryInitialize(&scanKey[2], 0, + Anum_bbf_schema_perms_object_name, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, + CStringGetDatum(object_name)); + ScanKeyEntryInitialize(&scanKey[3], 0, + Anum_bbf_schema_perms_grantee, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, + CStringGetDatum(grantee)); + + scan = systable_beginscan(bbf_schema_rel, + get_bbf_schema_perms_idx_oid(), + true, NULL, 4, scanKey); + tuple_bbf_schema = systable_getnext(scan); + + if (HeapTupleIsValid(tuple_bbf_schema)) + { + Form_bbf_schema_perms bbf_schema = (Form_bbf_schema_perms) GETSTRUCT(tuple_bbf_schema); + permission = bbf_schema->permission; + } + + systable_endscan(scan); + table_close(bbf_schema_rel, AccessShareLock); + return permission; +} + +/* + * Update permission column in the catalog when privilege on an object is changed. + */ +void +update_bbf_schema_privilege(const char *schema_name, + const char *object_name, + int16 new_priv, + int16 old_priv, + const char *grantee, + const char *object_type, + bool is_grant) +{ + Relation bbf_schema_rel; + HeapTuple tuple_bbf_schema; + TupleDesc bbf_schema_dsc; + HeapTuple new_tuple; + ScanKeyData scanKey[5]; + TableScanDesc scan; + int16 dbid = get_cur_db_id(); + int16 permission = 0; + Datum new_record_bbf_schema[BBF_SCHEMA_PERMS_NUM_OF_COLS]; + bool new_record_nulls_bbf_schema[BBF_SCHEMA_PERMS_NUM_OF_COLS]; + bool new_record_repl_bbf_schema[BBF_SCHEMA_PERMS_NUM_OF_COLS]; + + if(is_grant) + { + /* + * In case of GRANT, we add the new privilege along with the previous privilege in the column. + */ + permission = new_priv | old_priv; + } + else + { + /* + * In case of REVOKE, we remove the new privilege and keep the previous privilege as it is. + */ + permission = ~new_priv & old_priv; + } + + if(permission == 0) + { + del_from_bbf_schema(schema_name, object_name, grantee); + return; + } + + bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), + RowExclusiveLock); + + ScanKeyInit(&scanKey[0], + Anum_bbf_schema_perms_dbid, + BTEqualStrategyNumber, F_INT2EQ, + Int16GetDatum(dbid)); + ScanKeyEntryInitialize(&scanKey[1], 0, + Anum_bbf_schema_perms_schema_name, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, + CStringGetDatum(schema_name)); + ScanKeyEntryInitialize(&scanKey[2], 0, + Anum_bbf_schema_perms_object_name, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, + CStringGetDatum(object_name)); + ScanKeyInit(&scanKey[3], + Anum_bbf_schema_perms_permission, + BTEqualStrategyNumber, F_INT2EQ, + Int16GetDatum(old_priv)); + ScanKeyEntryInitialize(&scanKey[4], 0, + Anum_bbf_schema_perms_grantee, + BTEqualStrategyNumber, + InvalidOid, + tsql_get_server_collation_oid_internal(false), + F_NAMEEQ, + CStringGetDatum(grantee)); + + scan = table_beginscan_catalog(bbf_schema_rel, 5, scanKey); + tuple_bbf_schema = heap_getnext(scan, ForwardScanDirection); + if (HeapTupleIsValid(tuple_bbf_schema)) + { + bbf_schema_dsc = RelationGetDescr(bbf_schema_rel); + /* Build a tuple to insert */ + MemSet(new_record_bbf_schema, 0, sizeof(new_record_bbf_schema)); + MemSet(new_record_nulls_bbf_schema, false, sizeof(new_record_nulls_bbf_schema)); + MemSet(new_record_repl_bbf_schema, false, sizeof(new_record_repl_bbf_schema)); + + new_record_bbf_schema[BBF_SCHEMA_PERMS_PERMISSION] = Int16GetDatum(permission); + new_record_repl_bbf_schema[BBF_SCHEMA_PERMS_PERMISSION] = true; + + new_tuple = heap_modify_tuple(tuple_bbf_schema, + bbf_schema_dsc, + new_record_bbf_schema, + new_record_nulls_bbf_schema, + new_record_repl_bbf_schema); + + CatalogTupleUpdate(bbf_schema_rel, &new_tuple->t_self, new_tuple); + heap_freetuple(new_tuple); + } + + table_endscan(scan); + table_close(bbf_schema_rel, RowExclusiveLock); + + CommandCounterIncrement(); +} + /* Check if the catalog entry exists. */ bool check_bbf_schema_for_entry(const char *schema_name, const char *object_name, - const char *permission, const char *grantee) { Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; - ScanKeyData scanKey[5]; + ScanKeyData scanKey[4]; SysScanDesc scan; bool catalog_entry_exists = false; int16 dbid = get_cur_db_id(); @@ -2919,13 +3084,6 @@ check_bbf_schema_for_entry(const char *schema_name, F_NAMEEQ, CStringGetDatum(object_name)); ScanKeyEntryInitialize(&scanKey[3], 0, - Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, - InvalidOid, - tsql_get_server_collation_oid_internal(false), - F_NAMEEQ, - CStringGetDatum(permission)); - ScanKeyEntryInitialize(&scanKey[4], 0, Anum_bbf_schema_perms_grantee, BTEqualStrategyNumber, InvalidOid, @@ -2934,7 +3092,7 @@ check_bbf_schema_for_entry(const char *schema_name, CStringGetDatum(grantee)); scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), - true, NULL, 5, scanKey); + true, NULL, 4, scanKey); tuple_bbf_schema = systable_getnext(scan); if (HeapTupleIsValid(tuple_bbf_schema)) @@ -2951,14 +3109,14 @@ check_bbf_schema_for_entry(const char *schema_name, bool check_bbf_schema_for_schema(const char *schema_name, const char *object_name, - const char *permission) + int16 permission) { Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; - ScanKeyData key[4]; + ScanKeyData key[3]; SysScanDesc scan; - bool catalog_entry_exists = false; int16 dbid = get_cur_db_id(); + int16 priv = 0; bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), AccessShareLock); @@ -2980,36 +3138,35 @@ check_bbf_schema_for_schema(const char *schema_name, tsql_get_server_collation_oid_internal(false), F_NAMEEQ, CStringGetDatum(object_name)); - ScanKeyEntryInitialize(&key[3], 0, - Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, - InvalidOid, - tsql_get_server_collation_oid_internal(false), - F_NAMEEQ, - CStringGetDatum(permission)); scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), - true, NULL, 4, key); + true, NULL, 3, key); tuple_bbf_schema = systable_getnext(scan); - if (HeapTupleIsValid(tuple_bbf_schema)) - catalog_entry_exists = true; + while (HeapTupleIsValid(tuple_bbf_schema)) + { + Form_bbf_schema_perms schemaform; + schemaform = (Form_bbf_schema_perms) GETSTRUCT(tuple_bbf_schema); + priv = schemaform->permission; + + if((permission & priv) == permission) + return true; + } systable_endscan(scan); table_close(bbf_schema_rel, AccessShareLock); - return catalog_entry_exists; + return false; } void del_from_bbf_schema(const char *schema_name, const char *object_name, - const char *permission, const char *grantee) { Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; - ScanKeyData scanKey[5]; + ScanKeyData scanKey[4]; SysScanDesc scan; int16 dbid = get_cur_db_id(); @@ -3038,13 +3195,6 @@ del_from_bbf_schema(const char *schema_name, F_NAMEEQ, CStringGetDatum(object_name)); ScanKeyEntryInitialize(&scanKey[3], 0, - Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, - InvalidOid, - tsql_get_server_collation_oid_internal(false), - F_NAMEEQ, - CStringGetDatum(permission)); - ScanKeyEntryInitialize(&scanKey[4], 0, Anum_bbf_schema_perms_grantee, BTEqualStrategyNumber, InvalidOid, @@ -3053,7 +3203,7 @@ del_from_bbf_schema(const char *schema_name, CStringGetDatum(grantee)); scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), - true, NULL, 5, scanKey); + true, NULL, 4, scanKey); tuple_bbf_schema = systable_getnext(scan); @@ -3133,6 +3283,58 @@ clean_up_bbf_schema(const char *schema_name, table_close(bbf_schema_rel, RowExclusiveLock); } +void +grant_perms_to_each_obj(const char *db_name, + const char *object_type, + const char *schema_name, + const char *object_name, + const char *grantee, + const char *permission) +{ + StringInfoData query; + char *schema; + List *res; + Node *res_stmt; + PlannedStmt *wrapper; + + schema = get_physical_schema_name((char *)db_name, schema_name); + initStringInfo(&query); + if (strcmp(permission, "execute") != 0) + appendStringInfo(&query, "GRANT \"%s\" ON \"%s\".\"%s\" TO \"%s\"; ", permission, schema, object_name, grantee); + else + { + if (object_type != NULL && strcmp(object_type, "f") == 0) + appendStringInfo(&query, "GRANT \"%s\" ON FUNCTION \"%s\".\"%s\" TO \"%s\"; ", permission, schema, object_name, grantee); + else + appendStringInfo(&query, "GRANT \"%s\" ON PROCEDURE \"%s\".\"%s\" TO \"%s\"; ", permission, schema, object_name, grantee); + } + res = raw_parser(query.data, RAW_PARSE_DEFAULT); + res_stmt = ((RawStmt *) linitial(res))->stmt; + + /* need to make a wrapper PlannedStmt */ + wrapper = makeNode(PlannedStmt); + wrapper->commandType = CMD_UTILITY; + wrapper->canSetTag = false; + wrapper->utilityStmt = res_stmt; + wrapper->stmt_location = 0; + wrapper->stmt_len = 1; + + /* do this step */ + ProcessUtility(wrapper, + "(GRANT STATEMENT )", + false, + PROCESS_UTILITY_SUBCOMMAND, + NULL, + NULL, + None_Receiver, + NULL); + + /* make sure later steps can see the object created here */ + CommandCounterIncrement(); + pfree(query.data); +} + + /* * For all objects belonging to a schema which has OBJECT level permission, * It grants the permission explicitly when REVOKE has been executed on that @@ -3141,17 +3343,18 @@ clean_up_bbf_schema(const char *schema_name, void grant_perms_to_objects_in_schema(const char *schema_name, - const char *permission, - const char *grantee) + int16 priv, + const char *grantee) { SysScanDesc scan; Relation bbf_schema_rel; HeapTuple tuple_bbf_schema; const char *object_name; const char *object_type; - ScanKeyData scanKey[4]; + ScanKeyData scanKey[3]; int16 dbid = get_cur_db_id(); const char *db_name = get_cur_db_name(); + int16 permission = 0; /* Fetch the relation */ bbf_schema_rel = table_open(get_bbf_schema_perms_oid(), @@ -3168,13 +3371,6 @@ grant_perms_to_objects_in_schema(const char *schema_name, F_NAMEEQ, CStringGetDatum(schema_name)); ScanKeyEntryInitialize(&scanKey[2], 0, - Anum_bbf_schema_perms_permission, - BTEqualStrategyNumber, - InvalidOid, - tsql_get_server_collation_oid_internal(false), - F_NAMEEQ, - CStringGetDatum(permission)); - ScanKeyEntryInitialize(&scanKey[3], 0, Anum_bbf_schema_perms_grantee, BTEqualStrategyNumber, InvalidOid, @@ -3183,7 +3379,7 @@ grant_perms_to_objects_in_schema(const char *schema_name, CStringGetDatum(grantee)); scan = systable_beginscan(bbf_schema_rel, get_bbf_schema_perms_idx_oid(), - true, NULL, 4, scanKey); + true, NULL, 3, scanKey); tuple_bbf_schema = systable_getnext(scan); while (HeapTupleIsValid(tuple_bbf_schema)) @@ -3192,50 +3388,22 @@ grant_perms_to_objects_in_schema(const char *schema_name, schemaform = (Form_bbf_schema_perms) GETSTRUCT(tuple_bbf_schema); object_name = pstrdup(NameStr(schemaform->object_name)); object_type = pstrdup(NameStr(schemaform->object_type)); - + permission = (priv & (schemaform->permission)); /* For each object, grant the permission explicitly. */ - if (strcmp(object_name, "ALL") != 0) + if (strcmp(object_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA) != 0) { - StringInfoData query; - char *schema; - List *res; - Node *res_stmt; - PlannedStmt *wrapper; - - schema = get_physical_schema_name((char *)db_name, schema_name); - initStringInfo(&query); - if (strcmp(permission, "execute") != 0) - appendStringInfo(&query, "GRANT \"%s\" ON \"%s\".\"%s\" TO \"%s\"; ", permission, schema, object_name, grantee); - else - { - if (object_type != NULL && strcmp(object_type, "f") == 0) - appendStringInfo(&query, "GRANT \"%s\" ON FUNCTION \"%s\".\"%s\" TO \"%s\"; ", permission, schema, object_name, grantee); - else - appendStringInfo(&query, "GRANT \"%s\" ON PROCEDURE \"%s\".\"%s\" TO \"%s\"; ", permission, schema, object_name, grantee); - } - res = raw_parser(query.data, RAW_PARSE_DEFAULT); - res_stmt = ((RawStmt *) linitial(res))->stmt; - - /* need to make a wrapper PlannedStmt */ - wrapper = makeNode(PlannedStmt); - wrapper->commandType = CMD_UTILITY; - wrapper->canSetTag = false; - wrapper->utilityStmt = res_stmt; - wrapper->stmt_location = 0; - wrapper->stmt_len = 1; - - /* do this step */ - ProcessUtility(wrapper, - "(GRANT STATEMENT )", - false, - PROCESS_UTILITY_SUBCOMMAND, - NULL, - NULL, - None_Receiver, - NULL); - - /* make sure later steps can see the object created here */ - CommandCounterIncrement(); + if((permission & PRIVILEGE_BIT_FOR_EXECUTE) == PRIVILEGE_BIT_FOR_EXECUTE) + grant_perms_to_each_obj(db_name, object_type, schema_name, object_name, grantee, "execute"); + if((permission & PRIVILEGE_BIT_FOR_SELECT) == PRIVILEGE_BIT_FOR_SELECT) + grant_perms_to_each_obj(db_name, object_type, schema_name, object_name, grantee, "select"); + if((permission & PRIVILEGE_BIT_FOR_INSERT) == PRIVILEGE_BIT_FOR_INSERT) + grant_perms_to_each_obj(db_name, object_type, schema_name, object_name, grantee, "insert"); + if((permission & PRIVILEGE_BIT_FOR_UPDATE) == PRIVILEGE_BIT_FOR_UPDATE) + grant_perms_to_each_obj(db_name, object_type, schema_name, object_name, grantee, "update"); + if((permission & PRIVILEGE_BIT_FOR_DELETE) == PRIVILEGE_BIT_FOR_DELETE) + grant_perms_to_each_obj(db_name, object_type, schema_name, object_name, grantee, "delete"); + if((permission & PRIVILEGE_BIT_FOR_REFERENCES) == PRIVILEGE_BIT_FOR_REFERENCES) + grant_perms_to_each_obj(db_name, object_type, schema_name, object_name, grantee, "references"); } tuple_bbf_schema = systable_getnext(scan); } diff --git a/contrib/babelfishpg_tsql/src/catalog.h b/contrib/babelfishpg_tsql/src/catalog.h index c3a7de00859..c39090c78fe 100644 --- a/contrib/babelfishpg_tsql/src/catalog.h +++ b/contrib/babelfishpg_tsql/src/catalog.h @@ -312,7 +312,7 @@ typedef struct FormData_bbf_schema_perms int16 dbid; NameData schema_name; NameData object_name; - NameData permission; + int16 permission; NameData grantee; NameData object_type; } FormData_bbf_schema_perms; @@ -321,30 +321,47 @@ typedef FormData_bbf_schema_perms *Form_bbf_schema_perms; extern void add_entry_to_bbf_schema(const char *schema_name, const char *object_name, - const char *permission, + int16 permission, const char *grantee, const char *object_type); +extern int16 get_bbf_schema_privilege(const char *schema_name, + const char *object_name, + const char *grantee); + +extern void update_bbf_schema_privilege(const char *schema_name, + const char *object_name, + int16 new_priv, + int16 old_priv, + const char *grantee, + const char *object_type, + bool is_grant); + extern bool check_bbf_schema_for_entry(const char *schema_name, const char *object_name, - const char *permission, const char *grantee); extern void del_from_bbf_schema(const char *schema_name, const char *object_name, - const char *permission, const char *grantee); extern bool check_bbf_schema_for_schema(const char *schema_name, const char *object_name, - const char *permission); + int16 permission); extern void clean_up_bbf_schema(const char *schema_name, const char *object_name, bool is_schema); +extern void grant_perms_to_each_obj(const char *db_name, + const char *object_type, + const char *schema_name, + const char *object_name, + const char *grantee, + const char *permission); + extern void grant_perms_to_objects_in_schema(const char *schema_name, - const char *permission, + int16 permission, const char *grantee); /***************************************** diff --git a/contrib/babelfishpg_tsql/src/pl_exec-2.c b/contrib/babelfishpg_tsql/src/pl_exec-2.c index 3e98b678e85..e9cd62f8256 100644 --- a/contrib/babelfishpg_tsql/src/pl_exec-2.c +++ b/contrib/babelfishpg_tsql/src/pl_exec-2.c @@ -55,6 +55,7 @@ static int exec_stmt_usedb_explain(PLtsql_execstate *estate, PLtsql_stmt_usedb * static int exec_stmt_grantdb(PLtsql_execstate *estate, PLtsql_stmt_grantdb *stmt); static int exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt); static int exec_stmt_fulltextindex(PLtsql_execstate *estate, PLtsql_stmt_fulltextindex *stmt); +static void exec_gen_grantschema(char *schema_name, char *rolname, PLtsql_stmt_grantschema *stmt, char *priv_name); static int exec_stmt_insert_execute_select(PLtsql_execstate *estate, PLtsql_expr *expr); static int exec_stmt_insert_bulk(PLtsql_execstate *estate, PLtsql_stmt_insert_bulk *expr); static int exec_stmt_dbcc(PLtsql_execstate *estate, PLtsql_stmt_dbcc *stmt); @@ -3675,20 +3676,53 @@ get_insert_bulk_kilobytes_per_batch() return insert_bulk_kilobytes_per_batch; } -static int -exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) +static void +exec_gen_grantschema(char *schema_name, char *rolname, PLtsql_stmt_grantschema *stmt, char *priv_name) { List *parsetree_list; ListCell *parsetree_item; - char *dbname = get_cur_db_name(); - char *login = GetUserNameFromId(GetSessionUserId(), false); + parsetree_list = gen_grantschema_subcmds(schema_name, rolname, stmt->is_grant, stmt->with_grant_option, priv_name); + /* Run all subcommands */ + foreach(parsetree_item, parsetree_list) + { + Node *stmt = ((RawStmt *) lfirst(parsetree_item))->stmt; + PlannedStmt *wrapper; + + /* need to make a wrapper PlannedStmt */ + wrapper = makeNode(PlannedStmt); + wrapper->commandType = CMD_UTILITY; + wrapper->canSetTag = false; + wrapper->utilityStmt = stmt; + wrapper->stmt_location = 0; + wrapper->stmt_len = 0; + + /* do this step */ + ProcessUtility(wrapper, + "(GRANT SCHEMA )", + false, + PROCESS_UTILITY_SUBCOMMAND, + NULL, + NULL, + None_Receiver, + NULL); + + /* make sure later steps can see the object created here */ + CommandCounterIncrement(); + } +} + +static int +exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) +{ + char *dbname = get_cur_db_name(); + char *login = GetUserNameFromId(GetSessionUserId(), false); bool login_is_db_owner; char *rolname; char *schema_name; - ListCell *lc; - ListCell *lc1; - Oid schemaOid; - char *user = GetUserNameFromId(GetUserId(), false); + ListCell *lc; + Oid schemaOid; + int16 privilege_maskInt = create_privilege_bitmask(stmt->privileges, true); + char *user = GetUserNameFromId(GetUserId(), false); /* * If the login is not the db owner or the login is not the member of @@ -3714,75 +3748,63 @@ exec_stmt_grantschema(PLtsql_execstate *estate, PLtsql_stmt_grantschema *stmt) errmsg("schema \"%s\" does not exist", schema_name))); - foreach(lc1, stmt->privileges) + foreach(lc, stmt->grantees) { - char *priv_name = (char *) lfirst(lc1); - foreach(lc, stmt->grantees) - { - char *grantee_name = (char *) lfirst(lc); - Oid role_oid; - bool grantee_is_db_owner; - if (strcmp(grantee_name, "public") != 0) - rolname = get_physical_user_name(dbname, grantee_name); - else - rolname = pstrdup("public"); - role_oid = get_role_oid(rolname, true); - grantee_is_db_owner = 0 == strncmp(grantee_name, get_owner_of_db(dbname), NAMEDATALEN); - - if (strcmp(grantee_name, "public") != 0 && role_oid == InvalidOid) - ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("Cannot find the principal '%s', because it does not exist or you do not have permission.", grantee_name))); + char *grantee_name = (char *) lfirst(lc); + Oid role_oid; + int16 old_priv = 0; + if (strcmp(grantee_name, "public") != 0) + rolname = get_physical_user_name(dbname, grantee_name); + else + rolname = pstrdup("public"); + role_oid = get_role_oid(rolname, true); - if ((strcmp(rolname, user) == 0) || pg_namespace_ownercheck(schemaOid, role_oid) || is_member_of_role(role_oid, get_sysadmin_oid()) || grantee_is_db_owner) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself."))); + if (strcmp(grantee_name, "public") != 0 && role_oid == InvalidOid) + ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("Cannot find the principal '%s', because it does not exist or you do not have permission.", grantee_name))); - if (!is_member_of_role(GetSessionUserId(), get_sysadmin_oid()) && !login_is_db_owner && !pg_namespace_ownercheck(schemaOid, GetUserId())) - ereport(ERROR, - (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), - errmsg("Cannot find the schema \"%s\", because it does not exist or you do not have permission.", stmt->schema_name))); + if ((strcmp(rolname, user) == 0) || pg_namespace_ownercheck(schemaOid, role_oid) || is_member_of_role(role_oid, get_sysadmin_oid())) + ereport(ERROR, + (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("Cannot grant, deny, or revoke permissions to sa, dbo, entity owner, information_schema, sys, or yourself."))); - parsetree_list = gen_grantschema_subcmds(schema_name, rolname, stmt->is_grant, stmt->with_grant_option, priv_name); - /* Run all subcommands */ - foreach(parsetree_item, parsetree_list) - { - Node *stmt = ((RawStmt *) lfirst(parsetree_item))->stmt; - PlannedStmt *wrapper; - - /* need to make a wrapper PlannedStmt */ - wrapper = makeNode(PlannedStmt); - wrapper->commandType = CMD_UTILITY; - wrapper->canSetTag = false; - wrapper->utilityStmt = stmt; - wrapper->stmt_location = 0; - wrapper->stmt_len = 0; - - /* do this step */ - ProcessUtility(wrapper, - "(GRANT SCHEMA )", - false, - PROCESS_UTILITY_SUBCOMMAND, - NULL, - NULL, - None_Receiver, - NULL); - - /* make sure later steps can see the object created here */ - CommandCounterIncrement(); - } - /* Add entry for each grant statement. */ - if (stmt->is_grant && !check_bbf_schema_for_entry(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname)) - add_entry_to_bbf_schema(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname, NULL); - /* Remove entry for each revoke statement. */ - if (!stmt->is_grant && check_bbf_schema_for_entry(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname)) - { - /* If any object in the schema has the OBJECT level permission. Then, internally grant that permission back. */ - grant_perms_to_objects_in_schema(stmt->schema_name, priv_name, rolname); - del_from_bbf_schema(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, priv_name, rolname); - } - pfree(rolname); + if (!is_member_of_role(GetSessionUserId(), get_sysadmin_oid()) && !login_is_db_owner && !pg_namespace_ownercheck(schemaOid, GetUserId())) + ereport(ERROR, + (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("Cannot find the schema \"%s\", because it does not exist or you do not have permission.", stmt->schema_name))); + + if((privilege_maskInt & PRIVILEGE_BIT_FOR_EXECUTE) == PRIVILEGE_BIT_FOR_EXECUTE) + exec_gen_grantschema(schema_name, rolname, stmt, "execute"); + if((privilege_maskInt & PRIVILEGE_BIT_FOR_SELECT) == PRIVILEGE_BIT_FOR_SELECT) + exec_gen_grantschema(schema_name, rolname, stmt, "select"); + if((privilege_maskInt & PRIVILEGE_BIT_FOR_INSERT) == PRIVILEGE_BIT_FOR_INSERT) + exec_gen_grantschema(schema_name, rolname, stmt, "insert"); + if((privilege_maskInt & PRIVILEGE_BIT_FOR_UPDATE) == PRIVILEGE_BIT_FOR_UPDATE) + exec_gen_grantschema(schema_name, rolname, stmt, "update"); + if((privilege_maskInt & PRIVILEGE_BIT_FOR_DELETE) == PRIVILEGE_BIT_FOR_DELETE) + exec_gen_grantschema(schema_name, rolname, stmt, "delete"); + if((privilege_maskInt & PRIVILEGE_BIT_FOR_REFERENCES) == PRIVILEGE_BIT_FOR_REFERENCES) + exec_gen_grantschema(schema_name, rolname, stmt, "references"); + + /* Add entry for each grant statement. */ + if (stmt->is_grant && !check_bbf_schema_for_entry(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, rolname)) + add_entry_to_bbf_schema(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, privilege_maskInt, rolname, NULL); + else if(stmt->is_grant) + { + int16 old_priv = get_bbf_schema_privilege(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, rolname); + if(old_priv!= privilege_maskInt || ((old_priv|privilege_maskInt) != old_priv)) + update_bbf_schema_privilege(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, privilege_maskInt, old_priv, rolname, NULL, stmt->is_grant); + } + /* Remove entry for each revoke statement. */ + else if (!stmt->is_grant && check_bbf_schema_for_entry(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, rolname)) + { + /* If any object in the schema has the OBJECT level permission. Then, internally grant that permission back. */ + grant_perms_to_objects_in_schema(stmt->schema_name, privilege_maskInt, rolname); + old_priv = get_bbf_schema_privilege(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, rolname); + if(old_priv!= privilege_maskInt || ((old_priv)&(~privilege_maskInt)) != old_priv) + update_bbf_schema_privilege(stmt->schema_name, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, privilege_maskInt, old_priv, rolname, NULL, stmt->is_grant); } + pfree(rolname); } pfree(user); pfree(schema_name); diff --git a/contrib/babelfishpg_tsql/src/pl_handler.c b/contrib/babelfishpg_tsql/src/pl_handler.c index ab83ccdf4af..b45df3ea094 100644 --- a/contrib/babelfishpg_tsql/src/pl_handler.c +++ b/contrib/babelfishpg_tsql/src/pl_handler.c @@ -3608,6 +3608,9 @@ bbf_ProcessUtility(PlannedStmt *pstmt, GrantStmt *grant = (GrantStmt *) parsetree; char *dbname = get_cur_db_name(); const char *current_user = GetUserNameFromId(GetUserId(), false); + int16 privilege_maskInt = create_privilege_bitmask(grant->privileges, false); + ListCell *lc1; + /* Ignore when GRANT statement has no specific named object. */ if (sql_dialect != SQL_DIALECT_TSQL || grant->targtype != ACL_TARGET_OBJECT) break; @@ -3623,7 +3626,6 @@ bbf_ProcessUtility(PlannedStmt *pstmt, const char *logical_schema = NULL; char *obj = rv->relname; ListCell *lc; - ListCell *lc1; const char *obj_type = "r"; if (rv->schemaname != NULL) logical_schema = get_logical_schema_name(rv->schemaname, true); @@ -3637,15 +3639,15 @@ bbf_ProcessUtility(PlannedStmt *pstmt, foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - int i = 0; - char *permissions[] = {"select", "insert", "update", "references", "delete"}; - for(i = 0; i < 5; i++) + if (!check_bbf_schema_for_entry(logical_schema, obj,rol_spec->rolename)) { - /* - * If object permission doesn't exist already, add an entry to the catalog. - */ - if (!check_bbf_schema_for_entry(logical_schema, obj, permissions[i], rol_spec->rolename)) - add_entry_to_bbf_schema(logical_schema, obj, permissions[i], rol_spec->rolename, obj_type); + add_entry_to_bbf_schema(logical_schema, obj, ALL_PRIVILEGE_EXCEPT_EXECUTE, rol_spec->rolename, obj_type); + } + else + { + int16 old_priv = get_bbf_schema_privilege(logical_schema, obj,rol_spec->rolename); + if(old_priv!= ALL_PRIVILEGE_EXCEPT_EXECUTE || (old_priv|(ALL_PRIVILEGE_EXCEPT_EXECUTE)) != old_priv) + update_bbf_schema_privilege(logical_schema, obj, ALL_PRIVILEGE_EXCEPT_EXECUTE, old_priv, rol_spec->rolename, obj_type, grant->is_grant); } } break; @@ -3655,20 +3657,14 @@ bbf_ProcessUtility(PlannedStmt *pstmt, foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - int i = 0; bool has_schema_perms = false; - char *permissions[] = {"select", "insert", "update", "references", "delete"}; - for(i = 0; i < 5; i++) + if (check_bbf_schema_for_entry(logical_schema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, rol_spec->rolename) && !has_schema_perms) + has_schema_perms = true; + if (check_bbf_schema_for_entry(logical_schema, obj, rol_spec->rolename)) { - /* - * 1. If only schema permission exists, don't revoke any permission. - * 2. If only object permission exists, delete entry from the catalog and revoke permission. - * 3. If both schema and object permission exist, don't revoke any permission but delete object - * entry from the catalog. - */ - if (check_bbf_schema_for_entry(logical_schema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, permissions[i], rol_spec->rolename) && !has_schema_perms) - has_schema_perms = true; - del_from_bbf_schema(logical_schema, obj, permissions[i], rol_spec->rolename); + int16 old_priv = get_bbf_schema_privilege(logical_schema, obj,rol_spec->rolename); + if(old_priv!= ALL_PRIVILEGE_EXCEPT_EXECUTE || ((old_priv)&(~(ALL_PRIVILEGE_EXCEPT_EXECUTE))) != old_priv) + update_bbf_schema_privilege(logical_schema, obj, ALL_PRIVILEGE_EXCEPT_EXECUTE, old_priv, rol_spec->rolename, obj_type, grant->is_grant); } if (has_schema_perms) return; @@ -3676,61 +3672,82 @@ bbf_ProcessUtility(PlannedStmt *pstmt, break; } } - foreach(lc1, grant->privileges) + if (grant->is_grant) { - AccessPriv *ap = (AccessPriv *) lfirst(lc1); - if (grant->is_grant) + /* + * 1. Execute the GRANT statement. + * 2. Add its corresponding entry in the catalog, if doesn't exist already. + * 3. Don't add an entry, if the permission is granted on column list. + */ + if (prev_ProcessUtility) + prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, + queryEnv, dest, qc); + else + standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, + queryEnv, dest, qc); + foreach(lc, grant->grantees) { - /* - * 1. Execute the GRANT statement. - * 2. Add its corresponding entry in the catalog, if doesn't exist already. - * 3. Don't add an entry, if the permission is granted on column list. - */ - if (prev_ProcessUtility) - prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, - queryEnv, dest, qc); - else - standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, - queryEnv, dest, qc); - foreach(lc, grant->grantees) + RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); + bool flag = false; + foreach(lc1, grant->privileges) { - RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - /* - * Don't add an entry, if the permission is granted on column list. - */ - if (ap->cols != NULL) + AccessPriv *ap = (AccessPriv *) lfirst(lc1); + if(ap->cols != NULL) + { + flag = true; break; - if (!check_bbf_schema_for_entry(logical_schema, obj, ap->priv_name, rol_spec->rolename)) - add_entry_to_bbf_schema(logical_schema, obj, ap->priv_name, rol_spec->rolename, obj_type); + } + } + if(flag) + break; + if (!check_bbf_schema_for_entry(logical_schema, obj, rol_spec->rolename)) + add_entry_to_bbf_schema(logical_schema, obj, privilege_maskInt, rol_spec->rolename, obj_type); + else + { + int16 old_priv = get_bbf_schema_privilege(logical_schema, obj, rol_spec->rolename); + if(old_priv!= privilege_maskInt || ((old_priv)|(privilege_maskInt)) != old_priv) + update_bbf_schema_privilege(logical_schema, obj, privilege_maskInt, old_priv, rol_spec->rolename, obj_type, grant->is_grant); } } - else + } + else + { + foreach(lc, grant->grantees) { - foreach(lc, grant->grantees) + RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); + bool flag = false; + /* + * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. + * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. + */ + if ((logical_schema != NULL) && !check_bbf_schema_for_entry(logical_schema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, rol_spec->rolename)) { - RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - /* - * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. - * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. - */ - if ((logical_schema != NULL) && !check_bbf_schema_for_entry(logical_schema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, ap->priv_name, rol_spec->rolename)) - { - if (prev_ProcessUtility) - prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, + if (prev_ProcessUtility) + prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, + queryEnv, dest, qc); + else + standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, queryEnv, dest, qc); - else - standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, - queryEnv, dest, qc); - } - /* - * Don't remove an entry, if the permission is revoked on column list. - */ - if (ap->cols != NULL) + } + foreach(lc1, grant->privileges) + { + AccessPriv *ap = (AccessPriv *) lfirst(lc1); + if(ap->cols != NULL) + { + flag = true; break; - del_from_bbf_schema(logical_schema, obj, ap->priv_name, rol_spec->rolename); + } + } + if(flag) + continue; + if (check_bbf_schema_for_entry(logical_schema, obj, rol_spec->rolename)) + { + int16 old_priv = get_bbf_schema_privilege(logical_schema, obj,rol_spec->rolename); + if(old_priv!= privilege_maskInt || ((old_priv)&(~(privilege_maskInt))) != old_priv) + update_bbf_schema_privilege(logical_schema, obj, privilege_maskInt, old_priv, rol_spec->rolename, obj_type, grant->is_grant); } } - } + } return; } } @@ -3738,7 +3755,6 @@ bbf_ProcessUtility(PlannedStmt *pstmt, { ObjectWithArgs *ob = (ObjectWithArgs *) linitial(grant->objects); ListCell *lc; - ListCell *lc1; const char *logicalschema = NULL; char *funcname = NULL; const char *obj_type = NULL; @@ -3760,7 +3776,6 @@ bbf_ProcessUtility(PlannedStmt *pstmt, logicalschema = get_logical_schema_name(schemaname, true); funcname = strVal(func); } - /* If ALL PRIVILEGES is granted/revoked. */ if (list_length(grant->privileges) == 0) { @@ -3770,7 +3785,7 @@ bbf_ProcessUtility(PlannedStmt *pstmt, */ if (pstmt->stmt_len == 0) { - if(check_bbf_schema_for_schema(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, "execute")) + if(check_bbf_schema_for_schema(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, PRIVILEGE_BIT_FOR_EXECUTE)) return; } @@ -3779,8 +3794,14 @@ bbf_ProcessUtility(PlannedStmt *pstmt, foreach(lc, grant->grantees) { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - if (!check_bbf_schema_for_entry(logicalschema, funcname, "execute", rol_spec->rolename)) - add_entry_to_bbf_schema(logicalschema, funcname, "execute", rol_spec->rolename, obj_type); + if (!check_bbf_schema_for_entry(logicalschema, funcname, rol_spec->rolename)) + add_entry_to_bbf_schema(logicalschema, funcname, 32, rol_spec->rolename, obj_type); + else + { + int16 old_priv = get_bbf_schema_privilege(logicalschema, funcname, rol_spec->rolename); + if(old_priv!= 32 || ((old_priv)|(32)) != old_priv) + update_bbf_schema_privilege(logicalschema, funcname, 32, old_priv, rol_spec->rolename, obj_type, grant->is_grant); + } } } else @@ -3789,59 +3810,69 @@ bbf_ProcessUtility(PlannedStmt *pstmt, { RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); bool has_schema_perms = false; - if (check_bbf_schema_for_entry(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, "execute", rol_spec->rolename) && !has_schema_perms) + if (check_bbf_schema_for_entry(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, rol_spec->rolename) && !has_schema_perms) has_schema_perms = true; - del_from_bbf_schema(logicalschema, funcname, "execute", rol_spec->rolename); + + if (check_bbf_schema_for_entry(logicalschema, funcname, rol_spec->rolename)) + { + int16 old_priv = get_bbf_schema_privilege(logicalschema, funcname,rol_spec->rolename); + if(old_priv!= 32 || ((old_priv)&(~(32))) != old_priv) + update_bbf_schema_privilege(logicalschema, funcname, 32, old_priv, rol_spec->rolename, obj_type, grant->is_grant); + } if (has_schema_perms) return; } } break; } - foreach(lc1, grant->privileges) + + if (grant->is_grant) { - AccessPriv *ap = (AccessPriv *) lfirst(lc1); - if (grant->is_grant) + /* Execute the GRANT statement. */ + if (prev_ProcessUtility) + prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, + queryEnv, dest, qc); + else + standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, + queryEnv, dest, qc); + /* Add entry to the catalog if it doesn't exist already. */ + foreach(lc, grant->grantees) { - /* Execute the GRANT statement. */ - if (prev_ProcessUtility) - prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, - queryEnv, dest, qc); + RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); + if (!check_bbf_schema_for_entry(logicalschema, funcname, rol_spec->rolename)) + add_entry_to_bbf_schema(logicalschema, funcname, privilege_maskInt, rol_spec->rolename, obj_type); else - standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, - queryEnv, dest, qc); - /* Add entry to the catalog if it doesn't exist already. */ - foreach(lc, grant->grantees) { - RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - /* Add an entry to the catalog, if an entry doesn't exist already. */ - if (!check_bbf_schema_for_entry(logicalschema, funcname, ap->priv_name, rol_spec->rolename)) - { - add_entry_to_bbf_schema(logicalschema, funcname, ap->priv_name, rol_spec->rolename, obj_type); - } + int16 old_priv = get_bbf_schema_privilege(logicalschema, funcname, rol_spec->rolename); + if(old_priv!= privilege_maskInt || ((old_priv)|(privilege_maskInt)) != old_priv) + update_bbf_schema_privilege(logicalschema, funcname, privilege_maskInt, old_priv, rol_spec->rolename, obj_type, grant->is_grant); } } - else + } + else + { + foreach(lc, grant->grantees) { - foreach(lc, grant->grantees) + RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); + /* + * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. + * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. + */ + if (!check_bbf_schema_for_entry(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, rol_spec->rolename)) { - RoleSpec *rol_spec = (RoleSpec *) lfirst(lc); - /* - * 1. If GRANT on schema does not exist, execute REVOKE statement and remove the catalog entry if exists. - * 2. If GRANT on schema exist, only remove the entry from the catalog if exists. - */ - if (!check_bbf_schema_for_entry(logicalschema, PERMISSIONS_FOR_ALL_OBJECTS_IN_SCHEMA, ap->priv_name, rol_spec->rolename)) - { - /* Execute REVOKE statement. */ - if (prev_ProcessUtility) - prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, + /* Execute REVOKE statement. */ + if (prev_ProcessUtility) + prev_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, + queryEnv, dest, qc); + else + standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, queryEnv, dest, qc); - else - standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, - queryEnv, dest, qc); - } - /* Remove an entry from the catalog, if it exists. */ - del_from_bbf_schema(logicalschema, funcname, ap->priv_name, rol_spec->rolename); + } + if (check_bbf_schema_for_entry(logicalschema, funcname, rol_spec->rolename)) + { + int16 old_priv = get_bbf_schema_privilege(logicalschema, funcname, rol_spec->rolename); + if(old_priv!= privilege_maskInt || ((old_priv)&(~(privilege_maskInt))) != old_priv) + update_bbf_schema_privilege(logicalschema, funcname, privilege_maskInt, old_priv, rol_spec->rolename, obj_type, grant->is_grant); } } } @@ -6109,4 +6140,4 @@ bbf_set_tran_isolation(char *new_isolation_level_str) } } return ; -} +} \ No newline at end of file diff --git a/contrib/babelfishpg_tsql/src/pltsql.h b/contrib/babelfishpg_tsql/src/pltsql.h index ae94b0ddf16..be7bb071bc1 100644 --- a/contrib/babelfishpg_tsql/src/pltsql.h +++ b/contrib/babelfishpg_tsql/src/pltsql.h @@ -1914,6 +1914,15 @@ extern int insert_bulk_rows_per_batch; extern int insert_bulk_kilobytes_per_batch; extern bool insert_bulk_keep_nulls; +/* Privilege Bits for GRANT SCHEMA */ +#define PRIVILEGE_BIT_FOR_EXECUTE 32 +#define ALL_PRIVILEGE_EXCEPT_EXECUTE 31 +#define PRIVILEGE_BIT_FOR_SELECT 16 +#define PRIVILEGE_BIT_FOR_INSERT 8 +#define PRIVILEGE_BIT_FOR_UPDATE 4 +#define PRIVILEGE_BIT_FOR_DELETE 2 +#define PRIVILEGE_BIT_FOR_REFERENCES 1 + /********************************************************************** * Function declarations **********************************************************************/ @@ -2119,6 +2128,7 @@ extern bool pltsql_createFunction(ParseState *pstate, PlannedStmt *pstmt, const ParamListInfo params); extern Oid get_sys_varcharoid(void); extern Oid get_sysadmin_oid(void); +extern int16 create_privilege_bitmask(const List *l, bool grant_schema_stmt); typedef struct { diff --git a/contrib/babelfishpg_tsql/src/pltsql_utils.c b/contrib/babelfishpg_tsql/src/pltsql_utils.c index d635d81ab7a..5c9987f5fbb 100644 --- a/contrib/babelfishpg_tsql/src/pltsql_utils.c +++ b/contrib/babelfishpg_tsql/src/pltsql_utils.c @@ -1040,6 +1040,7 @@ update_GrantStmt(Node *n, const char *object, const char *obj_schema, const char { tmp->roletype = ROLESPEC_PUBLIC; } + tmp->rolename = pstrdup(grantee); } @@ -1999,3 +2000,35 @@ char appendStringInfo(&query, "\"%s\".\"%s\"", schema_name, index_name); return query.data; } + +/* Creates integer bitmask for permissions to be referenced in the catalog. */ +int16 +create_privilege_bitmask(const List *l, bool grant_schema_stmt) +{ + int16 privilege_maskInt = 0; + ListCell *lc; + foreach(lc, l) + { + char *priv_name; + if (grant_schema_stmt) + priv_name = (char *) lfirst(lc); + else + { + AccessPriv *ap = (AccessPriv *) lfirst(lc); + priv_name = ap->priv_name; + } + if (!strcmp(priv_name,"execute")) + privilege_maskInt |= PRIVILEGE_BIT_FOR_EXECUTE; + else if (!strcmp(priv_name,"select")) + privilege_maskInt |= PRIVILEGE_BIT_FOR_SELECT; + else if (!strcmp(priv_name,"insert")) + privilege_maskInt |= PRIVILEGE_BIT_FOR_INSERT; + else if (!strcmp(priv_name,"update")) + privilege_maskInt |= PRIVILEGE_BIT_FOR_UPDATE; + else if (!strcmp(priv_name,"delete")) + privilege_maskInt |= PRIVILEGE_BIT_FOR_DELETE; + else if (!strcmp(priv_name,"references")) + privilege_maskInt |= PRIVILEGE_BIT_FOR_REFERENCES; + } + return privilege_maskInt; +} diff --git a/test/JDBC/expected/GRANT_SCHEMA.out b/test/JDBC/expected/GRANT_SCHEMA.out index 935acbe2f53..9e87407783a 100644 --- a/test/JDBC/expected/GRANT_SCHEMA.out +++ b/test/JDBC/expected/GRANT_SCHEMA.out @@ -372,10 +372,8 @@ select schema_name, object_name, permission, grantee from sys.babelfish_schema_p where schema_name = 'babel_4344_s1' collate "C" and object_name = 'ALL' collate "C" order by permission; go ~~START~~ -name#!#name#!#name#!#name -babel_4344_s1#!#ALL#!#execute#!#babel_4344_d1_babel_4344_u1 -babel_4344_s1#!#ALL#!#insert#!#babel_4344_d1_babel_4344_u1 -babel_4344_s1#!#ALL#!#select#!#babel_4344_d1_babel_4344_u1 +name#!#name#!#int2#!#name +babel_4344_s1#!#ALL#!#56#!#babel_4344_d1_babel_4344_u1 ~~END~~ @@ -626,7 +624,7 @@ go select * from sys.babelfish_schema_permissions where schema_name = 'babel_4344_s1' collate sys.database_default; go ~~START~~ -int2#!#name#!#name#!#name#!#name#!#name +int2#!#name#!#name#!#int2#!#name#!#name ~~END~~