sepgsql: Enforce db_procedure:{execute} permission.
Robert Haas <rhaas@postgresql.org>
sepgsql: Enforce db_procedure:{execute} permission.
To do this, we add an additional object access hook type,
OAT_FUNCTION_EXECUTE.
KaiGai Kohei
Files
| Path | Change | +/− |
|---|---|---|
| contrib/sepgsql/expected/label.out | modified | +17 −0 |
| contrib/sepgsql/expected/misc.out | modified | +67 −0 |
| contrib/sepgsql/hooks.c | modified | +7 −0 |
| contrib/sepgsql/label.c | modified | +21 −2 |
| contrib/sepgsql/proc.c | modified | +26 −0 |
| contrib/sepgsql/sepgsql.h | modified | +1 −0 |
| contrib/sepgsql/sepgsql-regtest.te | modified | +6 −17 |
| contrib/sepgsql/sql/label.sql | modified | +2 −0 |
| contrib/sepgsql/sql/misc.sql | modified | +25 −0 |
| doc/src/sgml/sepgsql.sgml | modified | +5 −2 |
| src/backend/catalog/objectaccess.c | modified | +17 −0 |
| src/backend/executor/execQual.c | modified | +3 −0 |
| src/backend/executor/nodeAgg.c | modified | +4 −0 |
| src/backend/executor/nodeWindowAgg.c | modified | +4 −0 |
| src/backend/tcop/fastpath.c | modified | +1 −0 |
| src/include/catalog/objectaccess.h | modified | +14 −0 |