Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support db_securityadmin #100

Merged
merged 8 commits into from
Oct 31, 2024
Merged

Support db_securityadmin #100

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
2af8275
engine changes
HarshLunagariya Oct 20, 2024
85d6c5f
dump/restore changes
HarshLunagariya Oct 21, 2024
8697a73
fix
HarshLunagariya Oct 21, 2024
537c473
Merge pull request #98 from amazon-aurora/babel-3883
shalinilohia50 Oct 23, 2024
6114c5f
Merge branch 'server-database-roles-4-x' into babel_dbsecadmin
HarshLunagariya Oct 24, 2024
3f89485
Update dump_babel_utils.c
HarshLunagariya Oct 24, 2024
bdff47c
Update dumpall_babel_utils.c
HarshLunagariya Oct 24, 2024
d5b2779
Merge branch 'server-database-roles-4-x' into babel_dbsecadmin
HarshLunagariya Oct 27, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions src/backend/catalog/aclchk.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,6 +161,7 @@ static void recordExtensionInitPrivWorker(Oid objoid, Oid classoid, int objsubid
Acl *new_acl);

tsql_has_linked_srv_permissions_hook_type tsql_has_linked_srv_permissions_hook = NULL;
bbf_execute_grantstmt_as_dbsecadmin_hook_type bbf_execute_grantstmt_as_dbsecadmin_hook = NULL;

/*
* If is_grant is true, adds the given privileges for the list of
Expand Down Expand Up @@ -1722,6 +1723,11 @@ ExecGrant_Attribute(InternalGrant *istmt, Oid relOid, const char *relname,

pfree(merged_acl);

if (bbf_execute_grantstmt_as_dbsecadmin_hook)
tanscorpio7 marked this conversation as resolved.
Show resolved Hide resolved
{
(*bbf_execute_grantstmt_as_dbsecadmin_hook) (OBJECT_COLUMN, relOid, ownerId, col_privileges, &grantorId, &avail_goptions);
}

/*
* Restrict the privileges to what we can actually grant, and emit the
* standards-mandated warning and error messages. Note: we don't track
Expand Down Expand Up @@ -2003,6 +2009,11 @@ ExecGrant_Relation(InternalGrant *istmt)
break;
}

if (bbf_execute_grantstmt_as_dbsecadmin_hook)
{
(*bbf_execute_grantstmt_as_dbsecadmin_hook) (objtype, relOid, ownerId, this_privileges, &grantorId, &avail_goptions);
}

/*
* Restrict the privileges to what we can actually grant, and emit
* the standards-mandated warning and error messages.
Expand Down Expand Up @@ -2205,6 +2216,11 @@ ExecGrant_common(InternalGrant *istmt, Oid classid, AclMode default_privs,
old_acl, ownerId,
&grantorId, &avail_goptions);

if (bbf_execute_grantstmt_as_dbsecadmin_hook)
{
(*bbf_execute_grantstmt_as_dbsecadmin_hook) (get_object_type(classid, objectid), objectid, ownerId, istmt->privileges, &grantorId, &avail_goptions);
}

tanscorpio7 marked this conversation as resolved.
Show resolved Hide resolved
nameDatum = SysCacheGetAttrNotNull(cacheid, tuple,
get_object_attnum_name(classid));

Expand Down
16 changes: 11 additions & 5 deletions src/bin/pg_dump/dump_babel_utils.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,9 +53,15 @@ typedef enum {
static babelfish_status bbf_status = NONE;

static char *default_bbf_db_principals =
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

isnt this list the same as default_bbf_roles defined in other file?

"('master_dbo', 'master_db_owner', 'master_guest', 'master_db_accessadmin', 'master_db_datareader', 'master_db_datawriter', "
"'msdb_dbo', 'msdb_db_owner', 'msdb_guest', 'msdb_db_accessadmin', 'msdb_db_datareader', 'msdb_db_datawriter', "
"'tempdb_dbo', 'tempdb_db_owner', 'tempdb_guest', 'tempdb_db_accessadmin', 'tempdb_db_datareader', 'tempdb_db_datawriter') ";
"('master_dbo', 'master_db_owner', 'master_guest', "
"'master_db_accessadmin', 'master_db_securityadmin', "
"'master_db_datareader', 'master_db_datawriter', "
"'msdb_dbo', 'msdb_db_owner', 'msdb_guest', "
"'msdb_db_accessadmin', 'msdb_db_securityadmin', "
"'msdb_db_datareader', 'msdb_db_datawriter', "
"'tempdb_dbo', 'tempdb_db_owner', 'tempdb_guest', "
"'tempdb_db_accessadmin', 'tempdb_db_securityadmin', "
"'tempdb_db_datareader', 'tempdb_db_datawriter')" ;



Expand Down Expand Up @@ -1996,7 +2002,7 @@ dumpBabelPhysicalDatabaseACLs(Archive *fout)
"\n SET LOCAL ROLE sysadmin;"
"\n FOR rolname, original_name IN ("
"\n SELECT a.rolname, a.orig_username FROM sys.babelfish_authid_user_ext a"
"\n WHERE orig_username IN ('dbo','db_accessadmin') AND"
"\n WHERE orig_username IN ('dbo','db_accessadmin','db_securityadmin') AND"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

redeisgn/rethink this query so that we dont need to re-write this everytime

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This needs to be backward compatible, so this will be an interesting challenge

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need @rishabhtanwar29 's opinion on this.

"\n database_name NOT IN ('master', 'tempdb', 'msdb')");

if (bbf_db_name)
Expand All @@ -2007,7 +2013,7 @@ dumpBabelPhysicalDatabaseACLs(Archive *fout)
"\n ) LOOP"
"\n CASE WHEN original_name = 'dbo' THEN"
"\n EXECUTE format('GRANT CREATE, CONNECT, TEMPORARY ON DATABASE \"%%s\" TO \"%%s\"; ', CURRENT_DATABASE(), rolname);"
"\n WHEN original_name = 'db_accessadmin' THEN"
"\n WHEN original_name IN ('db_securityadmin','db_accessadmin') THEN"
"\n EXECUTE format('GRANT CREATE ON DATABASE \"%%s\" TO \"%%s\"; ', CURRENT_DATABASE(), rolname);"
"\n END CASE;"
"\n END LOOP;"
Expand Down
12 changes: 9 additions & 3 deletions src/bin/pg_dump/dumpall_babel_utils.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,9 +36,15 @@ typedef enum {
static babelfish_status bbf_status = NONE;

static char default_bbf_roles[] = "('sysadmin', 'bbf_role_admin', 'securityadmin', 'dbcreator', "
"'master_dbo', 'master_db_owner', 'master_guest', 'master_db_accessadmin', 'master_db_datareader', 'master_db_datawriter', "
"'msdb_dbo', 'msdb_db_owner', 'msdb_guest', 'msdb_db_accessadmin', 'msdb_db_datareader', 'msdb_db_datawriter', "
"'tempdb_dbo', 'tempdb_db_owner', 'tempdb_guest', 'tempdb_db_accessadmin', 'tempdb_db_datareader', 'tempdb_db_datawriter')";
"'master_dbo', 'master_db_owner', 'master_guest', "
"'master_db_accessadmin', 'master_db_securityadmin', "
"'master_db_datareader', 'master_db_datawriter', "
"'msdb_dbo', 'msdb_db_owner', 'msdb_guest', "
"'msdb_db_accessadmin', 'msdb_db_securityadmin', "
"'msdb_db_datareader', 'msdb_db_datawriter', "
"'tempdb_dbo', 'tempdb_db_owner', 'tempdb_guest', "
"'tempdb_db_accessadmin', 'tempdb_db_securityadmin', "
"'tempdb_db_datareader', 'tempdb_db_datawriter')" ;

/*
* Run a query, return the results, exit program on failure.
Expand Down
4 changes: 4 additions & 0 deletions src/include/utils/acl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@
#include "access/htup.h"
#include "nodes/parsenodes.h"
#include "parser/parse_node.h"
#include "utils/aclchk_internal.h"
#include "utils/snapshot.h"


Expand Down Expand Up @@ -284,4 +285,7 @@ extern PGDLLEXPORT bbf_get_sysadmin_oid_hook_type bbf_get_sysadmin_oid_hook;
typedef Oid (*get_bbf_admin_oid_hook_type) (void);
extern PGDLLEXPORT get_bbf_admin_oid_hook_type get_bbf_admin_oid_hook;

typedef void (*bbf_execute_grantstmt_as_dbsecadmin_hook_type) (ObjectType objType, Oid objId, Oid ownerId, AclMode privileges, Oid *grantorId, AclMode *grantOptions);
extern PGDLLEXPORT bbf_execute_grantstmt_as_dbsecadmin_hook_type bbf_execute_grantstmt_as_dbsecadmin_hook;

#endif /* ACL_H */
Loading