mirror of
https://github.com/postgres/postgres.git
synced 2026-03-19 00:52:42 -04:00
e5b8a4c098
Can be set to the empty string, or to either or both of "set" or "inherit". If set to a non-empty value, a non-superuser who creates a role (necessarily by relying up the CREATEROLE privilege) will grant that role back to themselves with the specified options. This isn't a security feature, because the grant that this feature triggers can also be performed explicitly. Instead, it's a user experience feature. A superuser would necessarily inherit the privileges of any created role and be able to access all such roles via SET ROLE; with this patch, you can configure createrole_self_grant = 'set, inherit' to provide a similar experience for a user who has CREATEROLE but not SUPERUSER. Discussion: https://postgr.es/m/CA+TgmobN59ct+Emmz6ig1Nua2Q-_o=r6DSD98KfU53kctq_kQw@mail.gmail.com
43 lines
1.6 KiB
C
43 lines
1.6 KiB
C
/*-------------------------------------------------------------------------
|
|
*
|
|
* user.h
|
|
* Commands for manipulating roles (formerly called users).
|
|
*
|
|
*
|
|
* src/include/commands/user.h
|
|
*
|
|
*-------------------------------------------------------------------------
|
|
*/
|
|
#ifndef USER_H
|
|
#define USER_H
|
|
|
|
#include "catalog/objectaddress.h"
|
|
#include "libpq/crypt.h"
|
|
#include "nodes/parsenodes.h"
|
|
#include "parser/parse_node.h"
|
|
#include "utils/guc.h"
|
|
|
|
/* GUCs */
|
|
extern PGDLLIMPORT int Password_encryption; /* values from enum PasswordType */
|
|
extern PGDLLIMPORT char *createrole_self_grant;
|
|
|
|
/* Hook to check passwords in CreateRole() and AlterRole() */
|
|
typedef void (*check_password_hook_type) (const char *username, const char *shadow_pass, PasswordType password_type, Datum validuntil_time, bool validuntil_null);
|
|
|
|
extern PGDLLIMPORT check_password_hook_type check_password_hook;
|
|
|
|
extern Oid CreateRole(ParseState *pstate, CreateRoleStmt *stmt);
|
|
extern Oid AlterRole(ParseState *pstate, AlterRoleStmt *stmt);
|
|
extern Oid AlterRoleSet(AlterRoleSetStmt *stmt);
|
|
extern void DropRole(DropRoleStmt *stmt);
|
|
extern void GrantRole(ParseState *pstate, GrantRoleStmt *stmt);
|
|
extern ObjectAddress RenameRole(const char *oldname, const char *newname);
|
|
extern void DropOwnedObjects(DropOwnedStmt *stmt);
|
|
extern void ReassignOwnedObjects(ReassignOwnedStmt *stmt);
|
|
extern List *roleSpecsToIds(List *memberNames);
|
|
|
|
extern bool check_createrole_self_grant(char **newval, void **extra,
|
|
GucSource source);
|
|
extern void assign_createrole_self_grant(const char *newval, void *extra);
|
|
|
|
#endif /* USER_H */
|