From 3e59ad8199833a99d14bf267b87cec7849e6e011 Mon Sep 17 00:00:00 2001 From: Virender Singla Date: Sun, 08 Aug 2026 12:48:29 +0530 Subject: [PATCH] Allow pg_read_all_stats to read replication origin status Grant pg_read_all_stats access to replication origin status Grant the pg_read_all_stats role access to the pg_replication_origin_status view and its backing function pg_show_replication_origin_status(). The regression test verifies that pg_read_all_stats can access both the view and its backing function. --- src/backend/catalog/system_views.sql | 2 + src/test/regress/expected/privileges.out | 30 ++++++++++++++++++++++++++++++ src/test/regress/sql/privileges.sql | 6 ++++++ 3 files changed, 38 insertions(+) diff --git a/src/backend/catalog/system_views.sql b/src/backend/catalog/system_views.sql index 6c1c5545cb5..0bf650cad4e 100644 --- a/src/backend/catalog/system_views.sql +++ b/src/backend/catalog/system_views.sql @@ -1531,6 +1531,8 @@ CREATE VIEW pg_replication_origin_status AS FROM pg_show_replication_origin_status(); REVOKE ALL ON pg_replication_origin_status FROM public; +GRANT SELECT ON pg_replication_origin_status TO pg_read_all_stats; +GRANT EXECUTE ON FUNCTION pg_show_replication_origin_status() TO pg_read_all_stats; -- All columns of pg_subscription except subconninfo are publicly readable. REVOKE ALL ON pg_subscription FROM public; diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out index f6cc1a1029c..170dc8d3fc5 100644 --- a/src/test/regress/expected/privileges.out +++ b/src/test/regress/expected/privileges.out @@ -3459,4 +3459,16 @@ SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations', f (1 row) +SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- no + has_table_privilege +--------------------- + f +(1 row) + +SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- no + has_function_privilege +------------------------ + f +(1 row) + GRANT pg_read_all_stats TO regress_readallstats; @@ -3490,4 +3490,16 @@ SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations', t (1 row) +SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- yes + has_table_privilege +--------------------- + t +(1 row) + +SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- yes + has_function_privilege +------------------------ + t +(1 row) + -- run query to ensure that functions within views can be executed @@ -3510,6 +3534,12 @@ SELECT COUNT(*) >= 0 AS ok FROM pg_shmem_allocations; t (1 row) +SELECT COUNT(*) >= 0 AS ok FROM pg_replication_origin_status; + ok +---- + t +(1 row) + RESET ROLE; -- clean up DROP ROLE regress_readallstats; diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql index 6cd9bb840ff..9de890613fa 100644 --- a/src/test/regress/sql/privileges.sql +++ b/src/test/regress/sql/privileges.sql @@ -2099,5 +2099,7 @@ SELECT has_table_privilege('regress_readallstats','pg_backend_memory_contexts',' SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations','SELECT'); -- no SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations_numa','SELECT'); -- no SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations','SELECT'); -- no +SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- no +SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- no GRANT pg_read_all_stats TO regress_readallstats; @@ -2107,9 +2109,11 @@ SELECT has_table_privilege('regress_readallstats','pg_backend_memory_contexts',' SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations','SELECT'); -- yes SELECT has_table_privilege('regress_readallstats','pg_shmem_allocations_numa','SELECT'); -- yes SELECT has_table_privilege('regress_readallstats','pg_dsm_registry_allocations','SELECT'); -- yes +SELECT has_table_privilege('regress_readallstats','pg_replication_origin_status','SELECT'); -- yes +SELECT has_function_privilege('regress_readallstats','pg_show_replication_origin_status()','EXECUTE'); -- yes -- run query to ensure that functions within views can be executed SET ROLE regress_readallstats; SELECT COUNT(*) >= 0 AS ok FROM pg_aios; SELECT COUNT(*) >= 0 AS ok FROM pg_backend_memory_contexts; SELECT COUNT(*) >= 0 AS ok FROM pg_shmem_allocations; +SELECT COUNT(*) >= 0 AS ok FROM pg_replication_origin_status; RESET ROLE; REVOKE ALL ON pg_subscription FROM public; -- 2.43.0