I wrote:
> [ squint... ]  There is something wrong here, because a superuser should
> certainly pass the aclcheck test.  I don't know where the bug is but
> this is not the correct fix.

OK, after looking, the issue is this wart in pg_tablespace_aclmask():

     * Only shared relations can be stored in global space; don't let even
     * superusers override this
    if (spc_oid == GLOBALTABLESPACE_OID && !IsBootstrapProcessingMode())
        return 0;

    /* Otherwise, superusers bypass all permission checking. */

There are a number of ways that we could deal with this:

* Just remove the above-quoted lines.  Superusers should be allowed to
shoot themselves in the foot.  (I'm not actually sure that there would
be any bad consequences from putting an ordinary table into pg_global
anyway.  I think I wrote the above code in fear that some parts of the
system would equate reltablespace = pg_global with relisshared, but
AFAICS that's not the case now.)

* Remove the above lines and instead put a defense into heap_create.
This might be better design anyway since a more specific error could
be reported.

* Leave aclchk.c as-is and apply Magnus' patch to allow superusers
to bypass the check in pg_tablespace_size.

* Decide that we should allow anyone to do pg_tablespace_size('pg_global')
and put in a special wart for that in dbsize.c.  This wasn't part of
the original agreement but maybe there's a case to be made for it.


                        regards, tom lane

---------------------------(end of broadcast)---------------------------
TIP 4: Have you searched our list archives?


Reply via email to