Skip to content

Commit 1de71e0

Browse files
hunleydhunleyd
authored
Merge branch 'develop' into INDATA-152
2 parents db993d5 + 29dac20 commit 1de71e0

File tree

6 files changed

+88
-5
lines changed

6 files changed

+88
-5
lines changed

‎ansible/vars.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ postgres_major:
1010

1111
# Full version strings for each major version
1212
postgres_release:
13-
postgresorioledb-17: "17.5.1.061-orioledb-dir-1"
14-
postgres17: "17.6.1.040-dir-1"
15-
postgres15: "15.14.1.040-dir-1"
13+
postgresorioledb-17: "17.5.1.062-orioledb-INDATA152-1"
14+
postgres17: "17.6.1.041-INDATA152-1"
15+
postgres15: "15.14.1.041-INDATA152-1"
1616

1717
# Non Postgres Extensions
1818
pgbouncer_release: 1.19.0

‎migrations/db/migrations/20251105172723_grant_pg_reload_conf_to_postgres.sql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-- migrate:up
2+
grant execute on function pg_catalog.pg_reload_conf() to postgres with grant option;
3+
4+
-- migrate:down
5+

‎nix/tests/expected/z_15_roles.out‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,3 +35,29 @@ order by
3535
supabase_storage_admin | authenticator | f
3636
(20 rows)
3737

38+
-- Check all privileges of non-superuser roles on functions
39+
select
40+
p.pronamespace::regnamespace as schema,
41+
p.proname as object_name,
42+
acl.grantee::regrole::text as grantee,
43+
acl.privilege_type
44+
from pg_catalog.pg_proc p
45+
cross join lateral pg_catalog.aclexplode(p.proacl) as acl
46+
where p.pronamespace::regnamespace::text = 'pg_catalog'
47+
and acl.grantee::regrole::text != 'supabase_admin'
48+
order by object_name, grantee, privilege_type;
49+
schema | object_name | grantee | privilege_type
50+
------------+--------------------------------+-------------------+----------------
51+
pg_catalog | pg_get_backend_memory_contexts | pg_read_all_stats | EXECUTE
52+
pg_catalog | pg_get_shmem_allocations | pg_read_all_stats | EXECUTE
53+
pg_catalog | pg_ls_archive_statusdir | pg_monitor | EXECUTE
54+
pg_catalog | pg_ls_logdir | pg_monitor | EXECUTE
55+
pg_catalog | pg_ls_logicalmapdir | pg_monitor | EXECUTE
56+
pg_catalog | pg_ls_logicalsnapdir | pg_monitor | EXECUTE
57+
pg_catalog | pg_ls_replslotdir | pg_monitor | EXECUTE
58+
pg_catalog | pg_ls_tmpdir | pg_monitor | EXECUTE
59+
pg_catalog | pg_ls_tmpdir | pg_monitor | EXECUTE
60+
pg_catalog | pg_ls_waldir | pg_monitor | EXECUTE
61+
pg_catalog | pg_reload_conf | postgres | EXECUTE
62+
(11 rows)
63+

‎nix/tests/expected/z_17_roles.out‎

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -174,5 +174,33 @@ order by
174174
supabase_storage_admin | authenticator | f
175175
(22 rows)
176176

177+
-- Check all privileges of non-superuser roles on functions
178+
select
179+
p.pronamespace::regnamespace as schema,
180+
p.proname as object_name,
181+
acl.grantee::regrole::text as grantee,
182+
acl.privilege_type
183+
from pg_catalog.pg_proc p
184+
cross join lateral pg_catalog.aclexplode(p.proacl) as acl
185+
where p.pronamespace::regnamespace::text = 'pg_catalog'
186+
and acl.grantee::regrole::text != 'supabase_admin'
187+
order by object_name, grantee, privilege_type;
188+
schema | object_name | grantee | privilege_type
189+
------------+--------------------------------+-------------------+----------------
190+
pg_catalog | pg_current_logfile | pg_monitor | EXECUTE
191+
pg_catalog | pg_current_logfile | pg_monitor | EXECUTE
192+
pg_catalog | pg_get_backend_memory_contexts | pg_read_all_stats | EXECUTE
193+
pg_catalog | pg_get_shmem_allocations | pg_read_all_stats | EXECUTE
194+
pg_catalog | pg_ls_archive_statusdir | pg_monitor | EXECUTE
195+
pg_catalog | pg_ls_logdir | pg_monitor | EXECUTE
196+
pg_catalog | pg_ls_logicalmapdir | pg_monitor | EXECUTE
197+
pg_catalog | pg_ls_logicalsnapdir | pg_monitor | EXECUTE
198+
pg_catalog | pg_ls_replslotdir | pg_monitor | EXECUTE
199+
pg_catalog | pg_ls_tmpdir | pg_monitor | EXECUTE
200+
pg_catalog | pg_ls_tmpdir | pg_monitor | EXECUTE
201+
pg_catalog | pg_ls_waldir | pg_monitor | EXECUTE
202+
pg_catalog | pg_reload_conf | postgres | EXECUTE
203+
(13 rows)
204+
177205
-- Rollback to clean up pg_tle extension
178-
ROLLBACK;
206+
ROLLBACK;

‎nix/tests/sql/z_15_roles.sql‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,15 @@ left join
1111
pg_roles g on m.roleid = g.oid
1212
order by
1313
r.rolname, g.rolname;
14+
15+
-- Check all privileges of non-superuser roles on functions
16+
select
17+
p.pronamespace::regnamespace as schema,
18+
p.proname as object_name,
19+
acl.grantee::regrole::text as grantee,
20+
acl.privilege_type
21+
from pg_catalog.pg_proc p
22+
cross join lateral pg_catalog.aclexplode(p.proacl) as acl
23+
where p.pronamespace::regnamespace::text = 'pg_catalog'
24+
and acl.grantee::regrole::text != 'supabase_admin'
25+
order by object_name, grantee, privilege_type;

‎nix/tests/sql/z_17_roles.sql‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,5 +82,17 @@ and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_
8282
order by
8383
r.rolname, g.rolname;
8484

85+
-- Check all privileges of non-superuser roles on functions
86+
select
87+
p.pronamespace::regnamespace as schema,
88+
p.proname as object_name,
89+
acl.grantee::regrole::text as grantee,
90+
acl.privilege_type
91+
from pg_catalog.pg_proc p
92+
cross join lateral pg_catalog.aclexplode(p.proacl) as acl
93+
where p.pronamespace::regnamespace::text = 'pg_catalog'
94+
and acl.grantee::regrole::text != 'supabase_admin'
95+
order by object_name, grantee, privilege_type;
96+
8597
-- Rollback to clean up pg_tle extension
86-
ROLLBACK;
98+
ROLLBACK;

0 commit comments

Comments
 (0)