From 74a92cfbf38872945ed9362bbbd4e90fb3639787 Mon Sep 17 00:00:00 2001 From: jian he Date: Thu, 3 Jul 2025 22:13:43 +0800 Subject: [PATCH v2 3/3] not restore security labels if the associated object is excluded When --no-publications or --no-subscriptions is specified in pg_restore, security labels associated with those objects should be excluded. pg_dump.c, dumpSecLabel function and the Security Label synopsis section [1] helps verify that the TocEntry->tag string for a security label begins with the object type it is associated with. So this patch change should be fine. [1] https://www.postgresql.org/docs/current/sql-security-label.html discussion: https://postgr.es/m/CACJufxHCt00pR9h51AVu6+yPD5J7JQn=7dQXxqacj0XyDhc-fA@mail.gmail.com commitfest entry: https://commitfest.postgresql.org/ --- src/bin/pg_dump/pg_backup_archiver.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/src/bin/pg_dump/pg_backup_archiver.c b/src/bin/pg_dump/pg_backup_archiver.c index 44bcce71712..f407f9fc280 100644 --- a/src/bin/pg_dump/pg_backup_archiver.c +++ b/src/bin/pg_dump/pg_backup_archiver.c @@ -3051,6 +3051,21 @@ _tocEntryRequired(TocEntry *te, teSection curSection, ArchiveHandle *AH) if (ropt->no_security_labels && strcmp(te->desc, "SECURITY LABEL") == 0) return 0; + + if (strcmp(te->desc, "SECURITY LABEL") == 0) + { + /* + * If --no-publications, or --no-subscriptions is specified, security + * label related to those objects should also be skipped during restore. + * see dumpSecLabel also. + */ + if (ropt->no_publications && strncmp(te->tag, "PUBLICATION", strlen("PUBLICATION")) == 0) + return 0; + + if (ropt->no_subscriptions && strncmp(te->tag, "SUBSCRIPTION", strlen("SUBSCRIPTION")) == 0) + return 0; + } + /* If it's a subscription, maybe ignore it */ if (ropt->no_subscriptions && strcmp(te->desc, "SUBSCRIPTION") == 0) return 0; -- 2.34.1