Re: A Question about InvokeObjectPostAlterHook
On Tue, Apr 18, 2023 at 01:34:00PM +0900, Michael Paquier wrote:
> Note that the development of PostgreSQL 16 has just finished, so now
> may not be the best moment to add these extra AOT calls, but these
> could be added in 17~ for sure at the beginning of July once the next
> development cycle begins.
The OAT hooks are added in ALTER TABLE for the following subcommands:
- { ENABLE | DISABLE | [NO] FORCE } ROW LEVEL SECURITY
- { ENABLE | DISABLE } TRIGGER
- { ENABLE | DISABLE } RULE
> Attached would be what I think would be required to add OATs for RLS,
> triggers and rules, for example. There are much more of these at
> quick glance, still that's one step in providing more checks. Perhaps
> you'd like to expand this patch with more ALTER TABLE subcommands
> covered?
Now that we are at the middle of the development cycle of 17~, it is
time to come back to this one (it was registered in the CF, but I did
not come back to it). Would there be any objections if I apply this
patch with its tests? This would cover most of the ground requested
by Legs at the start of this thread.
(The patch had one diff because of a namespace lookup not happening
anymore, so rebased.)
--
Michael
From b5bf282bdf68689670979846a963b2f11ae6d077 Mon Sep 17 00:00:00 2001
From: Michael Paquier
Date: Tue, 15 Aug 2023 15:47:30 +0900
Subject: [PATCH v2] Add OAT calls for more flavors of ALTER TABLE
---
src/backend/commands/tablecmds.c | 12 ++
src/test/modules/test_oat_hooks/Makefile | 2 +-
.../test_oat_hooks/expected/alter_table.out | 163 ++
src/test/modules/test_oat_hooks/meson.build | 1 +
.../test_oat_hooks/sql/alter_table.sql| 48 ++
5 files changed, 225 insertions(+), 1 deletion(-)
create mode 100644 src/test/modules/test_oat_hooks/expected/alter_table.out
create mode 100644 src/test/modules/test_oat_hooks/sql/alter_table.sql
diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c
index 727f151750..f77de4e7c9 100644
--- a/src/backend/commands/tablecmds.c
+++ b/src/backend/commands/tablecmds.c
@@ -14843,6 +14843,9 @@ ATExecEnableDisableTrigger(Relation rel, const char *trigname,
EnableDisableTrigger(rel, trigname, InvalidOid,
fires_when, skip_system, recurse,
lockmode);
+
+ InvokeObjectPostAlterHook(RelationRelationId,
+ RelationGetRelid(rel), 0);
}
/*
@@ -14855,6 +14858,9 @@ ATExecEnableDisableRule(Relation rel, const char *rulename,
char fires_when, LOCKMODE lockmode)
{
EnableDisableRule(rel, rulename, fires_when);
+
+ InvokeObjectPostAlterHook(RelationRelationId,
+ RelationGetRelid(rel), 0);
}
/*
@@ -16134,6 +16140,9 @@ ATExecSetRowSecurity(Relation rel, bool rls)
((Form_pg_class) GETSTRUCT(tuple))->relrowsecurity = rls;
CatalogTupleUpdate(pg_class, >t_self, tuple);
+ InvokeObjectPostAlterHook(RelationRelationId,
+ RelationGetRelid(rel), 0);
+
table_close(pg_class, RowExclusiveLock);
heap_freetuple(tuple);
}
@@ -16160,6 +16169,9 @@ ATExecForceNoForceRowSecurity(Relation rel, bool force_rls)
((Form_pg_class) GETSTRUCT(tuple))->relforcerowsecurity = force_rls;
CatalogTupleUpdate(pg_class, >t_self, tuple);
+ InvokeObjectPostAlterHook(RelationRelationId,
+ RelationGetRelid(rel), 0);
+
table_close(pg_class, RowExclusiveLock);
heap_freetuple(tuple);
}
diff --git a/src/test/modules/test_oat_hooks/Makefile b/src/test/modules/test_oat_hooks/Makefile
index 2b5d2687f8..dcaf3a7727 100644
--- a/src/test/modules/test_oat_hooks/Makefile
+++ b/src/test/modules/test_oat_hooks/Makefile
@@ -6,7 +6,7 @@ OBJS = \
test_oat_hooks.o
PGFILEDESC = "test_oat_hooks - example use of object access hooks"
-REGRESS = test_oat_hooks
+REGRESS = test_oat_hooks alter_table
# disable installcheck for now
NO_INSTALLCHECK = 1
diff --git a/src/test/modules/test_oat_hooks/expected/alter_table.out b/src/test/modules/test_oat_hooks/expected/alter_table.out
new file mode 100644
index 00..19adb28ffb
--- /dev/null
+++ b/src/test/modules/test_oat_hooks/expected/alter_table.out
@@ -0,0 +1,163 @@
+--
+-- OAT checks for ALTER TABLE
+--
+-- This test script fails if debug_discard_caches is enabled, because cache
+-- flushes cause extra calls of the OAT hook in recomputeNamespacePath,
+-- resulting in more NOTICE messages than are in the expected output.
+SET debug_discard_caches = 0;
+LOAD 'test_oat_hooks';
+SET test_oat_hooks.audit = true;
+NOTICE: in object_access_hook_str: superuser attempting alter (subId=0x1000, set) [test_oat_hooks.audit]
+NOTICE: in object_access_hook_str: superuser finished alter (subId=0x1000, set) [test_oat_hooks.audit]
+NOTICE: in process utility: superuser finished SET
+CREATE SCHEMA test_oat_schema;
+NOTICE: in process utility: superuser attempting CREATE SCHEMA
+NOTICE: in object access: superuser attempting create (subId=0x0) [explicit]
+NOTICE: in object access: superuser finished create (subId=0x0) [explicit]
+NOTICE: in process utility:
Re: A Question about InvokeObjectPostAlterHook
On Fri, Apr 21, 2023 at 04:16:10PM +0800, Legs Mansion wrote: > actually, some location can be tricky to add. > it looks like CREATE, but it’s actually ALTER, should call > InvokeObjectPostAlterHook instead > ofInvokeObjectPostCreateHook? eg.,CREATE OR REPLACE, CREATE > TYPE(perfecting shell type) Sure, it could be possible to plaster more of these depending on the control one may want with OATs. Coming back to the main you point of the thread you were making, what are the use cases with ALTER TABLE you were interested in for sepgsql on top of what the patch I sent upthread is doing? Note that it is perfectly fine to do the changes incrementally, though I'd rather add some proper coverage for each one of them using the module I've patched (sepgsql's tests are annoying to setup and run). -- Michael signature.asc Description: PGP signature
Re: A Question about InvokeObjectPostAlterHook
Hi Michael thank you for your explanation. actually, some location can be tricky to add. it looks like CREATE, but it’s actually ALTER, should call InvokeObjectPostAlterHook instead ofInvokeObjectPostCreateHook? eg.,CREATE OR REPLACE, CREATE TYPE(perfecting shell type) Thank you -- Original -- From: Michael Paquier
Re: A Question about InvokeObjectPostAlterHook
On Tue, Apr 18, 2023 at 09:51:30AM +0800, Legs Mansion wrote:
> Recently, I ran into a problem, InvokeObjectPostAlterHook was
> implemented for sepgsql, sepgsql use it to determine whether to
> check permissions during certain operations. But
> InvokeObjectPostAlterHook doesn't handle all of the alter's
> behavior, at least the table is not controlled.e.g., ALTER
> TABLE... ENABLE/DISABLE ROW LEVEL SECURITY，ALTER TABLE ... DISABLE
> TRIGGER, GRANT and REVOKE and so on.
> Whether InvokeObjectPostAlterHookis not fully controlled? it's
> a bug?
Yes, tablecmds.c has some holes and these are added when there is a
ask for it, as far as I recall. In some cases, these locations can be
tricky to add, so usually they require an independent analysis. For
example, EnableDisableTrigger() has one AOT for the trigger itself,
but not for the relation changed in tablecmds.c, as you say, anyway we
should be careful with cross-dependencies.
Note that 90efa2f has made the tests for OATs much easier, and there
is no need to rely only on sepgsql for that. (Even if test_oat_hooks
has been having some stability issues with namespace lookups because
of the position on the namespace search hook.)
Also, the additions of InvokeObjectPostAlterHook() are historically
conservative because they create behavior changes in stable branches,
meaning no backpatch. See a995b37 or 7b56584 as past examples, for
example.
Note that the development of PostgreSQL 16 has just finished, so now
may not be the best moment to add these extra AOT calls, but these
could be added in 17~ for sure at the beginning of July once the next
development cycle begins.
Attached would be what I think would be required to add OATs for RLS,
triggers and rules, for example. There are much more of these at
quick glance, still that's one step in providing more checks. Perhaps
you'd like to expand this patch with more ALTER TABLE subcommands
covered?
--
Michael
From bb693411864399f41d93819adf8caa0f073a9a2f Mon Sep 17 00:00:00 2001
From: Michael Paquier
Date: Tue, 18 Apr 2023 13:32:42 +0900
Subject: [PATCH] Add OAT calls for more flavors of ALTER TABLE
---
src/backend/commands/tablecmds.c | 12 ++
src/test/modules/test_oat_hooks/Makefile | 2 +-
.../test_oat_hooks/expected/alter_table.out | 165 ++
src/test/modules/test_oat_hooks/meson.build | 1 +
.../test_oat_hooks/sql/alter_table.sql| 48 +
5 files changed, 227 insertions(+), 1 deletion(-)
create mode 100644 src/test/modules/test_oat_hooks/expected/alter_table.out
create mode 100644 src/test/modules/test_oat_hooks/sql/alter_table.sql
diff --git a/src/backend/commands/tablecmds.c b/src/backend/commands/tablecmds.c
index 343fe61115..5b6f8f0376 100644
--- a/src/backend/commands/tablecmds.c
+++ b/src/backend/commands/tablecmds.c
@@ -14843,6 +14843,9 @@ ATExecEnableDisableTrigger(Relation rel, const char *trigname,
EnableDisableTrigger(rel, trigname, InvalidOid,
fires_when, skip_system, recurse,
lockmode);
+
+ InvokeObjectPostAlterHook(RelationRelationId,
+ RelationGetRelid(rel), 0);
}
/*
@@ -14855,6 +14858,9 @@ ATExecEnableDisableRule(Relation rel, const char *rulename,
char fires_when, LOCKMODE lockmode)
{
EnableDisableRule(rel, rulename, fires_when);
+
+ InvokeObjectPostAlterHook(RelationRelationId,
+ RelationGetRelid(rel), 0);
}
/*
@@ -16134,6 +16140,9 @@ ATExecSetRowSecurity(Relation rel, bool rls)
((Form_pg_class) GETSTRUCT(tuple))->relrowsecurity = rls;
CatalogTupleUpdate(pg_class, >t_self, tuple);
+ InvokeObjectPostAlterHook(RelationRelationId,
+ RelationGetRelid(rel), 0);
+
table_close(pg_class, RowExclusiveLock);
heap_freetuple(tuple);
}
@@ -16160,6 +16169,9 @@ ATExecForceNoForceRowSecurity(Relation rel, bool force_rls)
((Form_pg_class) GETSTRUCT(tuple))->relforcerowsecurity = force_rls;
CatalogTupleUpdate(pg_class, >t_self, tuple);
+ InvokeObjectPostAlterHook(RelationRelationId,
+ RelationGetRelid(rel), 0);
+
table_close(pg_class, RowExclusiveLock);
heap_freetuple(tuple);
}
diff --git a/src/test/modules/test_oat_hooks/Makefile b/src/test/modules/test_oat_hooks/Makefile
index 2b5d2687f8..dcaf3a7727 100644
--- a/src/test/modules/test_oat_hooks/Makefile
+++ b/src/test/modules/test_oat_hooks/Makefile
@@ -6,7 +6,7 @@ OBJS = \
test_oat_hooks.o
PGFILEDESC = "test_oat_hooks - example use of object access hooks"
-REGRESS = test_oat_hooks
+REGRESS = test_oat_hooks alter_table
# disable installcheck for now
NO_INSTALLCHECK = 1
diff --git a/src/test/modules/test_oat_hooks/expected/alter_table.out b/src/test/modules/test_oat_hooks/expected/alter_table.out
new file mode 100644
index 00..eac5071977
--- /dev/null
+++ b/src/test/modules/test_oat_hooks/expected/alter_table.out
@@ -0,0 +1,165 @@
+--
+-- OAT checks for ALTER TABLE
+--
+-- This test script fails if debug_discard_caches is enabled, because cache
+-- flushes cause extra calls of the OAT
A Question about InvokeObjectPostAlterHook
Recently, I ran into a problem, InvokeObjectPostAlterHook was implemented for sepgsql, sepgsql use it to determine whether to check permissions during certain operations. But InvokeObjectPostAlterHook doesn't handle all of the alter's behavior, at least the table is not controlled.e.g., ALTER TABLE... ENABLE/DISABLE ROW LEVEL SECURITY，ALTER TABLE ... DISABLE TRIGGER, GRANT and REVOKE and so on. Whether InvokeObjectPostAlterHookis not fully controlled? it's a bug? 发自我的iPhone
