* sepgsql_proc_post_create * * This routine assigns a default security label on a newly defined * procedure. */
| 34 | * procedure. |
| 35 | */ |
| 36 | void |
| 37 | sepgsql_proc_post_create(Oid functionId) |
| 38 | { |
| 39 | Relation rel; |
| 40 | ScanKeyData skey; |
| 41 | SysScanDesc sscan; |
| 42 | HeapTuple tuple; |
| 43 | char *nsp_name; |
| 44 | char *scontext; |
| 45 | char *tcontext; |
| 46 | char *ncontext; |
| 47 | uint32 required; |
| 48 | int i; |
| 49 | StringInfoData audit_name; |
| 50 | ObjectAddress object; |
| 51 | Form_pg_proc proForm; |
| 52 | |
| 53 | /* |
| 54 | * Fetch namespace of the new procedure. Because pg_proc entry is not |
| 55 | * visible right now, we need to scan the catalog using SnapshotSelf. |
| 56 | */ |
| 57 | rel = table_open(ProcedureRelationId, AccessShareLock); |
| 58 | |
| 59 | ScanKeyInit(&skey, |
| 60 | Anum_pg_proc_oid, |
| 61 | BTEqualStrategyNumber, F_OIDEQ, |
| 62 | ObjectIdGetDatum(functionId)); |
| 63 | |
| 64 | sscan = systable_beginscan(rel, ProcedureOidIndexId, true, |
| 65 | SnapshotSelf, 1, &skey); |
| 66 | |
| 67 | tuple = systable_getnext(sscan); |
| 68 | if (!HeapTupleIsValid(tuple)) |
| 69 | elog(ERROR, "could not find tuple for function %u", functionId); |
| 70 | |
| 71 | proForm = (Form_pg_proc) GETSTRUCT(tuple); |
| 72 | |
| 73 | /* |
| 74 | * check db_schema:{add_name} permission of the namespace |
| 75 | */ |
| 76 | object.classId = NamespaceRelationId; |
| 77 | object.objectId = proForm->pronamespace; |
| 78 | object.objectSubId = 0; |
| 79 | sepgsql_avc_check_perms(&object, |
| 80 | SEPG_CLASS_DB_SCHEMA, |
| 81 | SEPG_DB_SCHEMA__ADD_NAME, |
| 82 | getObjectIdentity(&object, false), |
| 83 | true); |
| 84 | |
| 85 | /* |
| 86 | * XXX - db_language:{implement} also should be checked here |
| 87 | */ |
| 88 | |
| 89 | |
| 90 | /* |
| 91 | * Compute a default security label when we create a new procedure object |
| 92 | * under the specified namespace. |
| 93 | */ |
no test coverage detected