Skip to content

Commit 29dac20

Browse files
za-arthursoedirgo
za-arthur
and
soedirgo
authored
fix: grant execute on pg_reload_conf() to postgres (#1892)
* fix: grant execute on pg_reload_conf() to postgres * Update migrations/db/migrations/20251105172723_grant_pg_reload_conf_to_postgres.sql Co-authored-by: Bobbie Soedirgo <[email protected]> --------- Co-authored-by: Bobbie Soedirgo <[email protected]>
1 parent 974db6c commit 29dac20

File tree

6 files changed

+86
-3
lines changed

6 files changed

+86
-3
lines changed

‎ansible/vars.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,9 @@ postgres_major:
1010

1111
# Full version strings for each major version
1212
postgres_release:
13-
postgresorioledb-17: "17.5.1.061-orioledb"
14-
postgres17: "17.6.1.040"
15-
postgres15: "15.14.1.040"
13+
postgresorioledb-17: "17.5.1.062-orioledb"
14+
postgres17: "17.6.1.041"
15+
postgres15: "15.14.1.041"
1616

1717
# Non Postgres Extensions
1818
pgbouncer_release: 1.19.0

‎migrations/db/migrations/20251105172723_grant_pg_reload_conf_to_postgres.sql‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-- migrate:up
2+
grant execute on function pg_catalog.pg_reload_conf() to postgres with grant option;
3+
4+
-- migrate:down
5+

‎nix/tests/expected/z_15_roles.out‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,29 @@ order by
3636
supabase_storage_admin | authenticator | f
3737
(21 rows)
3838

39+
-- Check all privileges of non-superuser roles on functions
40+
select
41+
p.pronamespace::regnamespace as schema,
42+
p.proname as object_name,
43+
acl.grantee::regrole::text as grantee,
44+
acl.privilege_type
45+
from pg_catalog.pg_proc p
46+
cross join lateral pg_catalog.aclexplode(p.proacl) as acl
47+
where p.pronamespace::regnamespace::text = 'pg_catalog'
48+
and acl.grantee::regrole::text != 'supabase_admin'
49+
order by object_name, grantee, privilege_type;
50+
schema | object_name | grantee | privilege_type
51+
------------+--------------------------------+-------------------+----------------
52+
pg_catalog | pg_get_backend_memory_contexts | pg_read_all_stats | EXECUTE
53+
pg_catalog | pg_get_shmem_allocations | pg_read_all_stats | EXECUTE
54+
pg_catalog | pg_ls_archive_statusdir | pg_monitor | EXECUTE
55+
pg_catalog | pg_ls_logdir | pg_monitor | EXECUTE
56+
pg_catalog | pg_ls_logicalmapdir | pg_monitor | EXECUTE
57+
pg_catalog | pg_ls_logicalsnapdir | pg_monitor | EXECUTE
58+
pg_catalog | pg_ls_replslotdir | pg_monitor | EXECUTE
59+
pg_catalog | pg_ls_tmpdir | pg_monitor | EXECUTE
60+
pg_catalog | pg_ls_tmpdir | pg_monitor | EXECUTE
61+
pg_catalog | pg_ls_waldir | pg_monitor | EXECUTE
62+
pg_catalog | pg_reload_conf | postgres | EXECUTE
63+
(11 rows)
64+

‎nix/tests/expected/z_17_roles.out‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,3 +167,31 @@ order by
167167
supabase_storage_admin | authenticator | f
168168
(22 rows)
169169

170+
-- Check all privileges of non-superuser roles on functions
171+
select
172+
p.pronamespace::regnamespace as schema,
173+
p.proname as object_name,
174+
acl.grantee::regrole::text as grantee,
175+
acl.privilege_type
176+
from pg_catalog.pg_proc p
177+
cross join lateral pg_catalog.aclexplode(p.proacl) as acl
178+
where p.pronamespace::regnamespace::text = 'pg_catalog'
179+
and acl.grantee::regrole::text != 'supabase_admin'
180+
order by object_name, grantee, privilege_type;
181+
schema | object_name | grantee | privilege_type
182+
------------+--------------------------------+-------------------+----------------
183+
pg_catalog | pg_current_logfile | pg_monitor | EXECUTE
184+
pg_catalog | pg_current_logfile | pg_monitor | EXECUTE
185+
pg_catalog | pg_get_backend_memory_contexts | pg_read_all_stats | EXECUTE
186+
pg_catalog | pg_get_shmem_allocations | pg_read_all_stats | EXECUTE
187+
pg_catalog | pg_ls_archive_statusdir | pg_monitor | EXECUTE
188+
pg_catalog | pg_ls_logdir | pg_monitor | EXECUTE
189+
pg_catalog | pg_ls_logicalmapdir | pg_monitor | EXECUTE
190+
pg_catalog | pg_ls_logicalsnapdir | pg_monitor | EXECUTE
191+
pg_catalog | pg_ls_replslotdir | pg_monitor | EXECUTE
192+
pg_catalog | pg_ls_tmpdir | pg_monitor | EXECUTE
193+
pg_catalog | pg_ls_tmpdir | pg_monitor | EXECUTE
194+
pg_catalog | pg_ls_waldir | pg_monitor | EXECUTE
195+
pg_catalog | pg_reload_conf | postgres | EXECUTE
196+
(13 rows)
197+

‎nix/tests/sql/z_15_roles.sql‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,3 +11,15 @@ left join
1111
pg_roles g on m.roleid = g.oid
1212
order by
1313
r.rolname, g.rolname;
14+
15+
-- Check all privileges of non-superuser roles on functions
16+
select
17+
p.pronamespace::regnamespace as schema,
18+
p.proname as object_name,
19+
acl.grantee::regrole::text as grantee,
20+
acl.privilege_type
21+
from pg_catalog.pg_proc p
22+
cross join lateral pg_catalog.aclexplode(p.proacl) as acl
23+
where p.pronamespace::regnamespace::text = 'pg_catalog'
24+
and acl.grantee::regrole::text != 'supabase_admin'
25+
order by object_name, grantee, privilege_type;

‎nix/tests/sql/z_17_roles.sql‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,15 @@ where r.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserve
7272
and g.rolname not in ('pg_create_subscription', 'pg_maintain', 'pg_use_reserved_connections')
7373
order by
7474
r.rolname, g.rolname;
75+
76+
-- Check all privileges of non-superuser roles on functions
77+
select
78+
p.pronamespace::regnamespace as schema,
79+
p.proname as object_name,
80+
acl.grantee::regrole::text as grantee,
81+
acl.privilege_type
82+
from pg_catalog.pg_proc p
83+
cross join lateral pg_catalog.aclexplode(p.proacl) as acl
84+
where p.pronamespace::regnamespace::text = 'pg_catalog'
85+
and acl.grantee::regrole::text != 'supabase_admin'
86+
order by object_name, grantee, privilege_type;

0 commit comments

Comments
 (0)