Make UPDATE privileges distinct from INSERT privileges in RTEs

Previously, relation range table entries used a single Bitmapset field
representing which columns required either UPDATE or INSERT privileges,
despite the fact that INSERT and UPDATE privileges are separately
cataloged, and may be independently held.  This worked because
ExecCheckRTEPerms() was called with a ACL_INSERT or ACL_UPDATE
requiredPerms, and based on that it was evident which type of
optimizable statement was under consideration.  Since historically no
type of optimizable statement could directly INSERT and UPDATE at the
same time, there was no ambiguity as to which privileges were required.

This largely mechanical commit is required infrastructure for the
INSERT...ON CONFLICT UPDATE feature, which introduces an optimizable
statement that may be subject to both INSERT and UPDATE permissions
enforcement.  Tests follow in a later commit.

sepgsql is also affected by this commit.  Note that this commit
necessitates an initdb, since stored ACLs are broken.

diff --git a/contrib/postgres_fdw/postgres_fdw.c b/contrib/postgres_fdw/postgres_fdw.c
index b4a58d5cfcdbaac89b5a157e07a3cc238c688b65..d9466522183421d149c2a19fa9bfd7a0670459a1 100644 (file)
--- a/contrib/postgres_fdw/postgres_fdw.c
+++ b/contrib/postgres_fdw/postgres_fdw.c
@@ -1206,7 +1206,7 @@ postgresPlanForeignModify(PlannerInfo *root,
        int         col;
 
        col = -1;
-       while ((col = bms_next_member(rte->modifiedCols, col)) >= 0)
+       while ((col = bms_next_member(rte->updatedCols, col)) >= 0)
        {
            /* bit numbers are offset by FirstLowInvalidHeapAttributeNumber */
            AttrNumber  attno = col + FirstLowInvalidHeapAttributeNumber;

diff --git a/contrib/sepgsql/dml.c b/contrib/sepgsql/dml.c
index 36c6a37ac13fcd3fd60c408d1f31310dcff7c890..4a71753d3fb55a62bdd300a2e16aa4f3e72ee2f1 100644 (file)
--- a/contrib/sepgsql/dml.c
+++ b/contrib/sepgsql/dml.c
@@ -145,7 +145,8 @@ fixup_inherited_columns(Oid parentId, Oid childId, Bitmapset *columns)
 static bool
 check_relation_privileges(Oid relOid,
                          Bitmapset *selected,
-                         Bitmapset *modified,
+                         Bitmapset *inserted,
+                         Bitmapset *updated,
                          uint32 required,
                          bool abort_on_violation)
 {
@@ -231,8 +232,9 @@ check_relation_privileges(Oid relOid,
     * Check permissions on the columns
     */
    selected = fixup_whole_row_references(relOid, selected);
-   modified = fixup_whole_row_references(relOid, modified);
-   columns = bms_union(selected, modified);
+   inserted = fixup_whole_row_references(relOid, inserted);
+   updated = fixup_whole_row_references(relOid, updated);
+   columns = bms_union(selected, bms_union(inserted, updated));
 
    while ((index = bms_first_member(columns)) >= 0)
    {
@@ -241,13 +243,16 @@ check_relation_privileges(Oid relOid,
 
        if (bms_is_member(index, selected))
            column_perms |= SEPG_DB_COLUMN__SELECT;
-       if (bms_is_member(index, modified))
+       if (bms_is_member(index, inserted))
        {
-           if (required & SEPG_DB_TABLE__UPDATE)
-               column_perms |= SEPG_DB_COLUMN__UPDATE;
            if (required & SEPG_DB_TABLE__INSERT)
                column_perms |= SEPG_DB_COLUMN__INSERT;
        }
+       if (bms_is_member(index, updated))
+       {
+           if (required & SEPG_DB_TABLE__UPDATE)
+               column_perms |= SEPG_DB_COLUMN__UPDATE;
+       }
        if (column_perms == 0)
            continue;
 
@@ -304,7 +309,7 @@ sepgsql_dml_privileges(List *rangeTabls, bool abort_on_violation)
            required |= SEPG_DB_TABLE__INSERT;
        if (rte->requiredPerms & ACL_UPDATE)
        {
-           if (!bms_is_empty(rte->modifiedCols))
+           if (!bms_is_empty(rte->updatedCols))
                required |= SEPG_DB_TABLE__UPDATE;
            else
                required |= SEPG_DB_TABLE__LOCK;
@@ -333,7 +338,8 @@ sepgsql_dml_privileges(List *rangeTabls, bool abort_on_violation)
        {
            Oid         tableOid = lfirst_oid(li);
            Bitmapset  *selectedCols;
-           Bitmapset  *modifiedCols;
+           Bitmapset  *insertedCols;
+           Bitmapset  *updatedCols;
 
            /*
             * child table has different attribute numbers, so we need to fix
@@ -341,15 +347,18 @@ sepgsql_dml_privileges(List *rangeTabls, bool abort_on_violation)
             */
            selectedCols = fixup_inherited_columns(rte->relid, tableOid,
                                                   rte->selectedCols);
-           modifiedCols = fixup_inherited_columns(rte->relid, tableOid,
-                                                  rte->modifiedCols);
+           insertedCols = fixup_inherited_columns(rte->relid, tableOid,
+                                                  rte->insertedCols);
+           updatedCols = fixup_inherited_columns(rte->relid, tableOid,
+                                                 rte->updatedCols);
 
            /*
             * check permissions on individual tables
             */
            if (!check_relation_privileges(tableOid,
                                           selectedCols,
-                                          modifiedCols,
+                                          insertedCols,
+                                          updatedCols,
                                           required, abort_on_violation))
                return false;
        }

diff --git a/src/backend/commands/copy.c b/src/backend/commands/copy.c
index 669bca406e5a322ed6f2e92a13fd003a2f1d3754..ec25e13b44c7309b2c04c34898e1bbedc1252993 100644 (file)
--- a/src/backend/commands/copy.c
+++ b/src/backend/commands/copy.c
@@ -847,7 +847,7 @@ DoCopy(const CopyStmt *stmt, const char *queryString, uint64 *processed)
            FirstLowInvalidHeapAttributeNumber;
 
            if (is_from)
-               rte->modifiedCols = bms_add_member(rte->modifiedCols, attno);
+               rte->insertedCols = bms_add_member(rte->insertedCols, attno);
            else
                rte->selectedCols = bms_add_member(rte->selectedCols, attno);
        }

diff --git a/src/backend/commands/createas.c b/src/backend/commands/createas.c
index 54b2f382ea0e03f5c872711643ee4cbb8e1ccca9..e8f0d793b678ff620efe8a1efe403cb92b4f1ab8 100644 (file)
--- a/src/backend/commands/createas.c
+++ b/src/backend/commands/createas.c
@@ -433,7 +433,7 @@ intorel_startup(DestReceiver *self, int operation, TupleDesc typeinfo)
    rte->requiredPerms = ACL_INSERT;
 
    for (attnum = 1; attnum <= intoRelationDesc->rd_att->natts; attnum++)
-       rte->modifiedCols = bms_add_member(rte->modifiedCols,
+       rte->insertedCols = bms_add_member(rte->insertedCols,
                                attnum - FirstLowInvalidHeapAttributeNumber);
 
    ExecCheckRTPerms(list_make1(rte), true);

diff --git a/src/backend/commands/trigger.c b/src/backend/commands/trigger.c
index 098893f4944f487d61dbefa8e358126ab8249f6f..bb9f8a5e310ccf488f361c89cd00d77e58384107 100644 (file)
--- a/src/backend/commands/trigger.c
+++ b/src/backend/commands/trigger.c
@@ -71,8 +71,8 @@ static int    MyTriggerDepth = 0;
  * it uses, so we let them be duplicated.  Be sure to update both if one needs
  * to be changed, however.
  */
-#define GetModifiedColumns(relinfo, estate) \
-   (rt_fetch((relinfo)->ri_RangeTableIndex, (estate)->es_range_table)->modifiedCols)
+#define GetUpdatedColumns(relinfo, estate) \
+   (rt_fetch((relinfo)->ri_RangeTableIndex, (estate)->es_range_table)->updatedCols)
 
 /* Local function prototypes */
 static void ConvertTriggerToFK(CreateTrigStmt *stmt, Oid funcoid);
@@ -2347,7 +2347,7 @@ ExecBSUpdateTriggers(EState *estate, ResultRelInfo *relinfo)
    TriggerDesc *trigdesc;
    int         i;
    TriggerData LocTriggerData;
-   Bitmapset  *modifiedCols;
+   Bitmapset  *updatedCols;
 
    trigdesc = relinfo->ri_TrigDesc;
 
@@ -2356,7 +2356,7 @@ ExecBSUpdateTriggers(EState *estate, ResultRelInfo *relinfo)
    if (!trigdesc->trig_update_before_statement)
        return;
 
-   modifiedCols = GetModifiedColumns(relinfo, estate);
+   updatedCols = GetUpdatedColumns(relinfo, estate);
 
    LocTriggerData.type = T_TriggerData;
    LocTriggerData.tg_event = TRIGGER_EVENT_UPDATE |
@@ -2377,7 +2377,7 @@ ExecBSUpdateTriggers(EState *estate, ResultRelInfo *relinfo)
                                  TRIGGER_TYPE_UPDATE))
            continue;
        if (!TriggerEnabled(estate, relinfo, trigger, LocTriggerData.tg_event,
-                           modifiedCols, NULL, NULL))
+                           updatedCols, NULL, NULL))
            continue;
 
        LocTriggerData.tg_trigger = trigger;
@@ -2402,7 +2402,7 @@ ExecASUpdateTriggers(EState *estate, ResultRelInfo *relinfo)
    if (trigdesc && trigdesc->trig_update_after_statement)
        AfterTriggerSaveEvent(estate, relinfo, TRIGGER_EVENT_UPDATE,
                              false, NULL, NULL, NIL,
-                             GetModifiedColumns(relinfo, estate));
+                             GetUpdatedColumns(relinfo, estate));
 }
 
 TupleTableSlot *
@@ -2420,7 +2420,7 @@ ExecBRUpdateTriggers(EState *estate, EPQState *epqstate,
    HeapTuple   oldtuple;
    TupleTableSlot *newSlot;
    int         i;
-   Bitmapset  *modifiedCols;
+   Bitmapset  *updatedCols;
    Bitmapset  *keyCols;
    LockTupleMode lockmode;
 
@@ -2429,10 +2429,10 @@ ExecBRUpdateTriggers(EState *estate, EPQState *epqstate,
     * been modified, then we can use a weaker lock, allowing for better
     * concurrency.
     */
-   modifiedCols = GetModifiedColumns(relinfo, estate);
+   updatedCols = GetUpdatedColumns(relinfo, estate);
    keyCols = RelationGetIndexAttrBitmap(relinfo->ri_RelationDesc,
                                         INDEX_ATTR_BITMAP_KEY);
-   if (bms_overlap(keyCols, modifiedCols))
+   if (bms_overlap(keyCols, updatedCols))
        lockmode = LockTupleExclusive;
    else
        lockmode = LockTupleNoKeyExclusive;
@@ -2486,7 +2486,7 @@ ExecBRUpdateTriggers(EState *estate, EPQState *epqstate,
                                  TRIGGER_TYPE_UPDATE))
            continue;
        if (!TriggerEnabled(estate, relinfo, trigger, LocTriggerData.tg_event,
-                           modifiedCols, trigtuple, newtuple))
+                           updatedCols, trigtuple, newtuple))
            continue;
 
        LocTriggerData.tg_trigtuple = trigtuple;
@@ -2556,7 +2556,7 @@ ExecARUpdateTriggers(EState *estate, ResultRelInfo *relinfo,
 
        AfterTriggerSaveEvent(estate, relinfo, TRIGGER_EVENT_UPDATE,
                              true, trigtuple, newtuple, recheckIndexes,
-                             GetModifiedColumns(relinfo, estate));
+                             GetUpdatedColumns(relinfo, estate));
        if (trigtuple != fdw_trigtuple)
            heap_freetuple(trigtuple);
    }

diff --git a/src/backend/executor/execMain.c b/src/backend/executor/execMain.c
index ba85577f6c5f02907fd2acfdcee1b85f90c7a39a..9101e7298ab7dd8e5df4b2a5bd1ba013d0b1223c 100644 (file)
--- a/src/backend/executor/execMain.c
+++ b/src/backend/executor/execMain.c
@@ -82,6 +82,9 @@ static void ExecutePlan(EState *estate, PlanState *planstate,
            ScanDirection direction,
            DestReceiver *dest);
 static bool ExecCheckRTEPerms(RangeTblEntry *rte);
+static bool ExecCheckRTEPermsModified(Oid relOid, Oid userid,
+                         Bitmapset *modifiedCols,
+                         AclMode requiredPerms);
 static void ExecCheckXactReadOnly(PlannedStmt *plannedstmt);
 static char *ExecBuildSlotValueDescription(Oid reloid,
                              TupleTableSlot *slot,
@@ -97,8 +100,10 @@ static void EvalPlanQualStart(EPQState *epqstate, EState *parentestate,
  * it uses, so we let them be duplicated.  Be sure to update both if one needs
  * to be changed, however.
  */
-#define GetModifiedColumns(relinfo, estate) \
-   (rt_fetch((relinfo)->ri_RangeTableIndex, (estate)->es_range_table)->modifiedCols)
+#define GetUpdatedColumns(relinfo, estate) \
+   (rt_fetch((relinfo)->ri_RangeTableIndex, (estate)->es_range_table)->updatedCols)
+#define GetInsertedColumns(relinfo, estate) \
+   (rt_fetch((relinfo)->ri_RangeTableIndex, (estate)->es_range_table)->insertedCols)
 
 /* end of local decls */
 
@@ -559,7 +564,6 @@ ExecCheckRTEPerms(RangeTblEntry *rte)
    AclMode     remainingPerms;
    Oid         relOid;
    Oid         userid;
-   int         col;
 
    /*
     * Only plain-relation RTEs need to be checked here.  Function RTEs are
@@ -597,6 +601,8 @@ ExecCheckRTEPerms(RangeTblEntry *rte)
    remainingPerms = requiredPerms & ~relPerms;
    if (remainingPerms != 0)
    {
+       int         col = -1;
+
        /*
         * If we lack any permissions that exist only as relation permissions,
         * we can fail straight away.
@@ -625,7 +631,6 @@ ExecCheckRTEPerms(RangeTblEntry *rte)
                    return false;
            }
 
-           col = -1;
            while ((col = bms_next_member(rte->selectedCols, col)) >= 0)
            {
                /* bit #s are offset by FirstLowInvalidHeapAttributeNumber */
@@ -648,43 +653,63 @@ ExecCheckRTEPerms(RangeTblEntry *rte)
        }
 
        /*
-        * Basically the same for the mod columns, with either INSERT or
-        * UPDATE privilege as specified by remainingPerms.
+        * Basically the same for the mod columns, for both INSERT and UPDATE
+        * privilege as specified by remainingPerms.
         */
-       remainingPerms &= ~ACL_SELECT;
-       if (remainingPerms != 0)
-       {
-           /*
-            * When the query doesn't explicitly change any columns, allow the
-            * query if we have permission on any column of the rel.  This is
-            * to handle SELECT FOR UPDATE as well as possible corner cases in
-            * INSERT and UPDATE.
-            */
-           if (bms_is_empty(rte->modifiedCols))
-           {
-               if (pg_attribute_aclcheck_all(relOid, userid, remainingPerms,
-                                             ACLMASK_ANY) != ACLCHECK_OK)
-                   return false;
-           }
+       if (remainingPerms & ACL_INSERT && !ExecCheckRTEPermsModified(relOid,
+                                                                     userid,
+                                                                     rte->insertedCols,
+                                                                     ACL_INSERT))
+           return false;
 
-           col = -1;
-           while ((col = bms_next_member(rte->modifiedCols, col)) >= 0)
-           {
-               /* bit #s are offset by FirstLowInvalidHeapAttributeNumber */
-               AttrNumber  attno = col + FirstLowInvalidHeapAttributeNumber;
+       if (remainingPerms & ACL_UPDATE && !ExecCheckRTEPermsModified(relOid,
+                                                                     userid,
+                                                                     rte->updatedCols,
+                                                                     ACL_UPDATE))
+           return false;
+   }
+   return true;
+}
 
-               if (attno == InvalidAttrNumber)
-               {
-                   /* whole-row reference can't happen here */
-                   elog(ERROR, "whole-row update is not implemented");
-               }
-               else
-               {
-                   if (pg_attribute_aclcheck(relOid, attno, userid,
-                                             remainingPerms) != ACLCHECK_OK)
-                       return false;
-               }
-           }
+/*
+ * ExecCheckRTEPermsModified
+ *     Check INSERT or UPDATE access permissions for a single RTE (these
+ *     are processed uniformly).
+ */
+static bool
+ExecCheckRTEPermsModified(Oid relOid, Oid userid, Bitmapset *modifiedCols,
+                         AclMode requiredPerms)
+{
+   int         col = -1;
+
+   /*
+    * When the query doesn't explicitly update any columns, allow the
+    * query if we have permission on any column of the rel.  This is
+    * to handle SELECT FOR UPDATE as well as possible corner cases in
+    * UPDATE.
+    */
+   if (bms_is_empty(modifiedCols))
+   {
+       if (pg_attribute_aclcheck_all(relOid, userid, requiredPerms,
+                                     ACLMASK_ANY) != ACLCHECK_OK)
+           return false;
+   }
+
+   while ((col = bms_next_member(modifiedCols, col)) >= 0)
+   {
+       /* bit #s are offset by FirstLowInvalidHeapAttributeNumber */
+       AttrNumber  attno = col + FirstLowInvalidHeapAttributeNumber;
+
+       if (attno == InvalidAttrNumber)
+       {
+           /* whole-row reference can't happen here */
+           elog(ERROR, "whole-row update is not implemented");
+       }
+       else
+       {
+           if (pg_attribute_aclcheck(relOid, attno, userid,
+                                     requiredPerms) != ACLCHECK_OK)
+               return false;
        }
    }
    return true;
@@ -1629,7 +1654,8 @@ ExecConstraints(ResultRelInfo *resultRelInfo,
                char       *val_desc;
                Bitmapset  *modifiedCols;
 
-               modifiedCols = GetModifiedColumns(resultRelInfo, estate);
+               modifiedCols = GetUpdatedColumns(resultRelInfo, estate);
+               modifiedCols = bms_union(modifiedCols, GetInsertedColumns(resultRelInfo, estate));
                val_desc = ExecBuildSlotValueDescription(RelationGetRelid(rel),
                                                         slot,
                                                         tupdesc,
@@ -1655,7 +1681,8 @@ ExecConstraints(ResultRelInfo *resultRelInfo,
            char       *val_desc;
            Bitmapset  *modifiedCols;
 
-           modifiedCols = GetModifiedColumns(resultRelInfo, estate);
+           modifiedCols = GetUpdatedColumns(resultRelInfo, estate);
+           modifiedCols = bms_union(modifiedCols, GetInsertedColumns(resultRelInfo, estate));
            val_desc = ExecBuildSlotValueDescription(RelationGetRelid(rel),
                                                     slot,
                                                     tupdesc,
@@ -1714,7 +1741,8 @@ ExecWithCheckOptions(ResultRelInfo *resultRelInfo,
            char       *val_desc;
            Bitmapset  *modifiedCols;
 
-           modifiedCols = GetModifiedColumns(resultRelInfo, estate);
+           modifiedCols = GetUpdatedColumns(resultRelInfo, estate);
+           modifiedCols = bms_union(modifiedCols, GetInsertedColumns(resultRelInfo, estate));
            val_desc = ExecBuildSlotValueDescription(RelationGetRelid(rel),
                                                     slot,
                                                     tupdesc,

diff --git a/src/backend/nodes/copyfuncs.c b/src/backend/nodes/copyfuncs.c
index 75e4efaeedd28f2dc69781a452646d4a04f2f189..1238ec3b1e8a1eda7814b0c77c613a67e50a6594 100644 (file)
--- a/src/backend/nodes/copyfuncs.c
+++ b/src/backend/nodes/copyfuncs.c
@@ -2055,7 +2055,8 @@ _copyRangeTblEntry(const RangeTblEntry *from)
    COPY_SCALAR_FIELD(requiredPerms);
    COPY_SCALAR_FIELD(checkAsUser);
    COPY_BITMAPSET_FIELD(selectedCols);
-   COPY_BITMAPSET_FIELD(modifiedCols);
+   COPY_BITMAPSET_FIELD(insertedCols);
+   COPY_BITMAPSET_FIELD(updatedCols);
    COPY_NODE_FIELD(securityQuals);
 
    return newnode;

diff --git a/src/backend/nodes/equalfuncs.c b/src/backend/nodes/equalfuncs.c
index 42cc7f9ecb9d229a6985b7ace08e39ecc5719390..0554d37f615f4f34bef3e575d966a1f53ac745a9 100644 (file)
--- a/src/backend/nodes/equalfuncs.c
+++ b/src/backend/nodes/equalfuncs.c
@@ -2355,7 +2355,8 @@ _equalRangeTblEntry(const RangeTblEntry *a, const RangeTblEntry *b)
    COMPARE_SCALAR_FIELD(requiredPerms);
    COMPARE_SCALAR_FIELD(checkAsUser);
    COMPARE_BITMAPSET_FIELD(selectedCols);
-   COMPARE_BITMAPSET_FIELD(modifiedCols);
+   COMPARE_BITMAPSET_FIELD(insertedCols);
+   COMPARE_BITMAPSET_FIELD(updatedCols);
    COMPARE_NODE_FIELD(securityQuals);
 
    return true;

diff --git a/src/backend/nodes/outfuncs.c b/src/backend/nodes/outfuncs.c
index a64af82d432acf819268ae2360ec0773428b0b8b..081bf61bde7bb08a34469a7efe32c4eab1c32938 100644 (file)
--- a/src/backend/nodes/outfuncs.c
+++ b/src/backend/nodes/outfuncs.c
@@ -2485,7 +2485,8 @@ _outRangeTblEntry(StringInfo str, const RangeTblEntry *node)
    WRITE_UINT_FIELD(requiredPerms);
    WRITE_OID_FIELD(checkAsUser);
    WRITE_BITMAPSET_FIELD(selectedCols);
-   WRITE_BITMAPSET_FIELD(modifiedCols);
+   WRITE_BITMAPSET_FIELD(insertedCols);
+   WRITE_BITMAPSET_FIELD(updatedCols);
    WRITE_NODE_FIELD(securityQuals);
 }
 

diff --git a/src/backend/nodes/readfuncs.c b/src/backend/nodes/readfuncs.c
index 64e153c14c6509c1a69885daf125f9a9f8e8500e..1b48e40b2fbfdaff934f571f1edffe2b923a1a66 100644 (file)
--- a/src/backend/nodes/readfuncs.c
+++ b/src/backend/nodes/readfuncs.c
@@ -1274,7 +1274,8 @@ _readRangeTblEntry(void)
    READ_UINT_FIELD(requiredPerms);
    READ_OID_FIELD(checkAsUser);
    READ_BITMAPSET_FIELD(selectedCols);
-   READ_BITMAPSET_FIELD(modifiedCols);
+   READ_BITMAPSET_FIELD(insertedCols);
+   READ_BITMAPSET_FIELD(updatedCols);
    READ_NODE_FIELD(securityQuals);
 
    READ_DONE();

diff --git a/src/backend/optimizer/plan/setrefs.c b/src/backend/optimizer/plan/setrefs.c
index 94b12ab8ca1132867cd3a1b3f830eb52942c2d22..06fc7ba34d39cf9386fbe4839ddf88e7094e44ac 100644 (file)
--- a/src/backend/optimizer/plan/setrefs.c
+++ b/src/backend/optimizer/plan/setrefs.c
@@ -367,9 +367,9 @@ flatten_rtes_walker(Node *node, PlannerGlobal *glob)
  *
  * In the flat rangetable, we zero out substructure pointers that are not
  * needed by the executor; this reduces the storage space and copying cost
- * for cached plans.  We keep only the alias and eref Alias fields, which
- * are needed by EXPLAIN, and the selectedCols and modifiedCols bitmaps,
- * which are needed for executor-startup permissions checking and for
+ * for cached plans.  We keep only the alias and eref Alias fields, which are
+ * needed by EXPLAIN, and the selectedCols, insertedCols and updatedCols
+ * bitmaps, which are needed for executor-startup permissions checking and for
  * trigger event checking.
  */
 static void

diff --git a/src/backend/optimizer/prep/prepsecurity.c b/src/backend/optimizer/prep/prepsecurity.c
index 0be44c1c2f7ccca8f8d1e546964939d3591999c4..c4b61df3003128c491f8389fd88c8f63ba940e61 100644 (file)
--- a/src/backend/optimizer/prep/prepsecurity.c
+++ b/src/backend/optimizer/prep/prepsecurity.c
@@ -125,7 +125,8 @@ expand_security_quals(PlannerInfo *root, List *tlist)
            rte->requiredPerms = 0;
            rte->checkAsUser = InvalidOid;
            rte->selectedCols = NULL;
-           rte->modifiedCols = NULL;
+           rte->insertedCols = NULL;
+           rte->updatedCols = NULL;
 
            /*
             * For the most part, Vars referencing the original relation
@@ -224,7 +225,8 @@ expand_security_qual(PlannerInfo *root, List *tlist, int rt_index,
            rte->requiredPerms = 0;
            rte->checkAsUser = InvalidOid;
            rte->selectedCols = NULL;
-           rte->modifiedCols = NULL;
+           rte->insertedCols = NULL;
+           rte->updatedCols = NULL;
 
            /*
             * Now deal with any PlanRowMark on this RTE by requesting a lock

diff --git a/src/backend/optimizer/prep/prepunion.c b/src/backend/optimizer/prep/prepunion.c
index 51b3da21b30c9696bbe73bd0d26732c3d9ce9102..5859748df8eeda5812ad9674a3146cca13d08846 100644 (file)
--- a/src/backend/optimizer/prep/prepunion.c
+++ b/src/backend/optimizer/prep/prepunion.c
@@ -1368,14 +1368,16 @@ expand_inherited_rtentry(PlannerInfo *root, RangeTblEntry *rte, Index rti)
         * if this is the parent table, leave copyObject's result alone.
         *
         * Note: we need to do this even though the executor won't run any
-        * permissions checks on the child RTE.  The modifiedCols bitmap may
-        * be examined for trigger-firing purposes.
+        * permissions checks on the child RTE.  The insertedCols/updatedCols
+        * bitmaps may be examined for trigger-firing purposes.
         */
        if (childOID != parentOID)
        {
            childrte->selectedCols = translate_col_privs(rte->selectedCols,
                                                   appinfo->translated_vars);
-           childrte->modifiedCols = translate_col_privs(rte->modifiedCols,
+           childrte->insertedCols = translate_col_privs(rte->insertedCols,
+                                                  appinfo->translated_vars);
+           childrte->updatedCols = translate_col_privs(rte->updatedCols,
                                                   appinfo->translated_vars);
        }
 

diff --git a/src/backend/parser/analyze.c b/src/backend/parser/analyze.c
index 642e4e0e2d1b9f03f5f3837ef6a22aa7fd45360c..f30b9c301ae333273208dcc499d38a2f5ef49ee5 100644 (file)
--- a/src/backend/parser/analyze.c
+++ b/src/backend/parser/analyze.c
@@ -735,7 +735,7 @@ transformInsertStmt(ParseState *pstate, InsertStmt *stmt)
                              false);
        qry->targetList = lappend(qry->targetList, tle);
 
-       rte->modifiedCols = bms_add_member(rte->modifiedCols,
+       rte->insertedCols = bms_add_member(rte->insertedCols,
                              attr_num - FirstLowInvalidHeapAttributeNumber);
 
        icols = lnext(icols);
@@ -2020,7 +2020,7 @@ transformUpdateStmt(ParseState *pstate, UpdateStmt *stmt)
                              origTarget->location);
 
        /* Mark the target column as requiring update permissions */
-       target_rte->modifiedCols = bms_add_member(target_rte->modifiedCols,
+       target_rte->updatedCols = bms_add_member(target_rte->updatedCols,
                                attrno - FirstLowInvalidHeapAttributeNumber);
 
        origTargetList = lnext(origTargetList);

diff --git a/src/backend/parser/parse_relation.c b/src/backend/parser/parse_relation.c
index ca560ccee1b5bd5272139ddb5766111c8e29c6c0..562c2f54f92385a82de7ea1336a0fd175d8e1fac 100644 (file)
--- a/src/backend/parser/parse_relation.c
+++ b/src/backend/parser/parse_relation.c
@@ -1218,7 +1218,8 @@ addRangeTableEntry(ParseState *pstate,
    rte->requiredPerms = ACL_SELECT;
    rte->checkAsUser = InvalidOid;      /* not set-uid by default, either */
    rte->selectedCols = NULL;
-   rte->modifiedCols = NULL;
+   rte->insertedCols = NULL;
+   rte->updatedCols = NULL;
 
    /*
     * Add completed RTE to pstate's range table list, but not to join list
@@ -1272,7 +1273,8 @@ addRangeTableEntryForRelation(ParseState *pstate,
    rte->requiredPerms = ACL_SELECT;
    rte->checkAsUser = InvalidOid;      /* not set-uid by default, either */
    rte->selectedCols = NULL;
-   rte->modifiedCols = NULL;
+   rte->insertedCols = NULL;
+   rte->updatedCols = NULL;
 
    /*
     * Add completed RTE to pstate's range table list, but not to join list
@@ -1351,7 +1353,8 @@ addRangeTableEntryForSubquery(ParseState *pstate,
    rte->requiredPerms = 0;
    rte->checkAsUser = InvalidOid;
    rte->selectedCols = NULL;
-   rte->modifiedCols = NULL;
+   rte->insertedCols = NULL;
+   rte->updatedCols = NULL;
 
    /*
     * Add completed RTE to pstate's range table list, but not to join list
@@ -1606,7 +1609,8 @@ addRangeTableEntryForFunction(ParseState *pstate,
    rte->requiredPerms = 0;
    rte->checkAsUser = InvalidOid;
    rte->selectedCols = NULL;
-   rte->modifiedCols = NULL;
+   rte->insertedCols = NULL;
+   rte->updatedCols = NULL;
 
    /*
     * Add completed RTE to pstate's range table list, but not to join list
@@ -1679,7 +1683,8 @@ addRangeTableEntryForValues(ParseState *pstate,
    rte->requiredPerms = 0;
    rte->checkAsUser = InvalidOid;
    rte->selectedCols = NULL;
-   rte->modifiedCols = NULL;
+   rte->insertedCols = NULL;
+   rte->updatedCols = NULL;
 
    /*
     * Add completed RTE to pstate's range table list, but not to join list
@@ -1748,7 +1753,8 @@ addRangeTableEntryForJoin(ParseState *pstate,
    rte->requiredPerms = 0;
    rte->checkAsUser = InvalidOid;
    rte->selectedCols = NULL;
-   rte->modifiedCols = NULL;
+   rte->insertedCols = NULL;
+   rte->updatedCols = NULL;
 
    /*
     * Add completed RTE to pstate's range table list, but not to join list
@@ -1849,7 +1855,8 @@ addRangeTableEntryForCTE(ParseState *pstate,
    rte->requiredPerms = 0;
    rte->checkAsUser = InvalidOid;
    rte->selectedCols = NULL;
-   rte->modifiedCols = NULL;
+   rte->insertedCols = NULL;
+   rte->updatedCols = NULL;
 
    /*
     * Add completed RTE to pstate's range table list, but not to join list

diff --git a/src/backend/rewrite/rewriteHandler.c b/src/backend/rewrite/rewriteHandler.c
index 70c8e089312335c495f7ab6c56490fe518ebf874..d83a4352a0e0b92413aae3583fce9e3f3fdbd04c 100644 (file)
--- a/src/backend/rewrite/rewriteHandler.c
+++ b/src/backend/rewrite/rewriteHandler.c
@@ -1407,7 +1407,8 @@ ApplyRetrieveRule(Query *parsetree,
            rte->requiredPerms = 0;
            rte->checkAsUser = InvalidOid;
            rte->selectedCols = NULL;
-           rte->modifiedCols = NULL;
+           rte->insertedCols = NULL;
+           rte->updatedCols = NULL;
 
            /*
             * For the most part, Vars referencing the view should remain as
@@ -1470,12 +1471,14 @@ ApplyRetrieveRule(Query *parsetree,
    subrte->requiredPerms = rte->requiredPerms;
    subrte->checkAsUser = rte->checkAsUser;
    subrte->selectedCols = rte->selectedCols;
-   subrte->modifiedCols = rte->modifiedCols;
+   subrte->insertedCols = rte->insertedCols;
+   subrte->updatedCols = rte->updatedCols;
 
    rte->requiredPerms = 0;     /* no permission check on subquery itself */
    rte->checkAsUser = InvalidOid;
    rte->selectedCols = NULL;
-   rte->modifiedCols = NULL;
+   rte->insertedCols = NULL;
+   rte->updatedCols = NULL;
 
    /*
     * If FOR [KEY] UPDATE/SHARE of view, mark all the contained tables as
@@ -2588,9 +2591,9 @@ rewriteTargetView(Query *parsetree, Relation view)
    /*
     * For INSERT/UPDATE the modified columns must all be updatable. Note that
     * we get the modified columns from the query's targetlist, not from the
-    * result RTE's modifiedCols set, since rewriteTargetListIU may have added
-    * additional targetlist entries for view defaults, and these must also be
-    * updatable.
+    * result RTE's insertedCols and/or updatedCols set, since
+    * rewriteTargetListIU may have added additional targetlist entries for
+    * view defaults, and these must also be updatable.
     */
    if (parsetree->commandType != CMD_DELETE)
    {
@@ -2727,28 +2730,33 @@ rewriteTargetView(Query *parsetree, Relation view)
     *
     * Initially, new_rte contains selectedCols permission check bits for all
     * base-rel columns referenced by the view, but since the view is a SELECT
-    * query its modifiedCols is empty.  We set modifiedCols to include all
-    * the columns the outer query is trying to modify, adjusting the column
-    * numbers as needed.  But we leave selectedCols as-is, so the view owner
-    * must have read permission for all columns used in the view definition,
-    * even if some of them are not read by the outer query.  We could try to
-    * limit selectedCols to only columns used in the transformed query, but
-    * that does not correspond to what happens in ordinary SELECT usage of a
-    * view: all referenced columns must have read permission, even if
-    * optimization finds that some of them can be discarded during query
-    * transformation.  The flattening we're doing here is an optional
-    * optimization, too.  (If you are unpersuaded and want to change this,
-    * note that applying adjust_view_column_set to view_rte->selectedCols is
-    * clearly *not* the right answer, since that neglects base-rel columns
-    * used in the view's WHERE quals.)
+    * query its insertedCols/updatedCols is empty.  We set insertedCols and
+    * updatedCols to include all the columns the outer query is trying to
+    * modify, adjusting the column numbers as needed.  But we leave
+    * selectedCols as-is, so the view owner must have read permission for all
+    * columns used in the view definition, even if some of them are not read
+    * by the outer query.  We could try to limit selectedCols to only columns
+    * used in the transformed query, but that does not correspond to what
+    * happens in ordinary SELECT usage of a view: all referenced columns must
+    * have read permission, even if optimization finds that some of them can
+    * be discarded during query transformation.  The flattening we're doing
+    * here is an optional optimization, too.  (If you are unpersuaded and want
+    * to change this, note that applying adjust_view_column_set to
+    * view_rte->selectedCols is clearly *not* the right answer, since that
+    * neglects base-rel columns used in the view's WHERE quals.)
     *
     * This step needs the modified view targetlist, so we have to do things
     * in this order.
     */
-   Assert(bms_is_empty(new_rte->modifiedCols));
-   new_rte->modifiedCols = adjust_view_column_set(view_rte->modifiedCols,
+   Assert(bms_is_empty(new_rte->insertedCols) &&
+          bms_is_empty(new_rte->updatedCols));
+
+   new_rte->insertedCols = adjust_view_column_set(view_rte->insertedCols,
                                                   view_targetlist);
 
+   new_rte->updatedCols = adjust_view_column_set(view_rte->updatedCols,
+                                                 view_targetlist);
+
    /*
     * Move any security barrier quals from the view RTE onto the new target
     * RTE.  Any such quals should now apply to the new target RTE and will

diff --git a/src/include/nodes/parsenodes.h b/src/include/nodes/parsenodes.h
index 704b0ef7b2bd640e82058f9b5e53aee81271d94c..ff9e40367f1a22fab9b308eefdeacc92d96e4536 100644 (file)
--- a/src/include/nodes/parsenodes.h
+++ b/src/include/nodes/parsenodes.h
@@ -739,11 +739,12 @@ typedef struct XmlSerialize
  *   For SELECT/INSERT/UPDATE permissions, if the user doesn't have
  *   table-wide permissions then it is sufficient to have the permissions
  *   on all columns identified in selectedCols (for SELECT) and/or
- *   modifiedCols (for INSERT/UPDATE; we can tell which from the query type).
- *   selectedCols and modifiedCols are bitmapsets, which cannot have negative
- *   integer members, so we subtract FirstLowInvalidHeapAttributeNumber from
- *   column numbers before storing them in these fields.  A whole-row Var
- *   reference is represented by setting the bit for InvalidAttrNumber.
+ *   insertedCols and/or updatedCols (INSERT with ON CONFLICT UPDATE may
+ *   have all 3).  selectedCols, insertedCols and updatedCols are
+ *   bitmapsets, which cannot have negative integer members, so we subtract
+ *   FirstLowInvalidHeapAttributeNumber from column numbers before storing
+ *   them in these fields.  A whole-row Var reference is represented by
+ *   setting the bit for InvalidAttrNumber.
  *--------------------
  */
 typedef enum RTEKind
@@ -838,7 +839,8 @@ typedef struct RangeTblEntry
    AclMode     requiredPerms;  /* bitmask of required access permissions */
    Oid         checkAsUser;    /* if valid, check access as this role */
    Bitmapset  *selectedCols;   /* columns needing SELECT permission */
-   Bitmapset  *modifiedCols;   /* columns needing INSERT/UPDATE permission */
+   Bitmapset  *insertedCols;   /* columns needing INSERT permission */
+   Bitmapset  *updatedCols;    /* columns needing UPDATE permission */
    List       *securityQuals;  /* any security barrier quals to apply */
 } RangeTblEntry;