* sepgsql_dml_privileges * * Entrypoint of the DML permission checks */
| 277 | * Entrypoint of the DML permission checks |
| 278 | */ |
| 279 | bool |
| 280 | sepgsql_dml_privileges(List *rangeTabls, bool abort_on_violation) |
| 281 | { |
| 282 | ListCell *lr; |
| 283 | |
| 284 | foreach(lr, rangeTabls) |
| 285 | { |
| 286 | RangeTblEntry *rte = lfirst(lr); |
| 287 | uint32 required = 0; |
| 288 | List *tableIds; |
| 289 | ListCell *li; |
| 290 | |
| 291 | /* |
| 292 | * Only regular relations shall be checked |
| 293 | */ |
| 294 | if (rte->rtekind != RTE_RELATION) |
| 295 | continue; |
| 296 | |
| 297 | /* |
| 298 | * Find out required permissions |
| 299 | */ |
| 300 | if (rte->requiredPerms & ACL_SELECT) |
| 301 | required |= SEPG_DB_TABLE__SELECT; |
| 302 | if (rte->requiredPerms & ACL_INSERT) |
| 303 | required |= SEPG_DB_TABLE__INSERT; |
| 304 | if (rte->requiredPerms & ACL_UPDATE) |
| 305 | { |
| 306 | if (!bms_is_empty(rte->updatedCols)) |
| 307 | required |= SEPG_DB_TABLE__UPDATE; |
| 308 | else |
| 309 | required |= SEPG_DB_TABLE__LOCK; |
| 310 | } |
| 311 | if (rte->requiredPerms & ACL_DELETE) |
| 312 | required |= SEPG_DB_TABLE__DELETE; |
| 313 | |
| 314 | /* |
| 315 | * Skip, if nothing to be checked |
| 316 | */ |
| 317 | if (required == 0) |
| 318 | continue; |
| 319 | |
| 320 | /* |
| 321 | * If this RangeTblEntry is also supposed to reference inherited |
| 322 | * tables, we need to check security label of the child tables. So, we |
| 323 | * expand rte->relid into list of OIDs of inheritance hierarchy, then |
| 324 | * checker routine will be invoked for each relations. |
| 325 | */ |
| 326 | if (!rte->inh) |
| 327 | tableIds = list_make1_oid(rte->relid); |
| 328 | else |
| 329 | tableIds = find_all_inheritors(rte->relid, NoLock, NULL); |
| 330 | |
| 331 | foreach(li, tableIds) |
| 332 | { |
| 333 | Oid tableOid = lfirst_oid(li); |
| 334 | Bitmapset *selectedCols; |
| 335 | Bitmapset *insertedCols; |
| 336 | Bitmapset *updatedCols; |
no test coverage detected