Restrict accesses to non-system views and foreign tables during pg_dump.

When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.

This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.

To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.

Back-patch to all supported branches.

Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index a6fd3f6ff02134e0af6a42c93c1d831ae9f03c30..9b7a7eed057cc0bf5948c7e63e334a9006b0da78 100644 (file)
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -637,6 +637,17 @@ EXPLAIN (VERBOSE, COSTS OFF) SELECT * FROM ft_empty ORDER BY c1;
    Remote SQL: SELECT c1, c2 FROM public.loct_empty ORDER BY c1 ASC NULLS LAST
 (3 rows)
 
+-- test restriction on non-system foreign tables.
+SET restrict_nonsystem_relation_kind TO 'foreign-table';
+SELECT * from ft1 where c1 < 1; -- ERROR
+ERROR:  access to non-system foreign table is restricted
+INSERT INTO ft1 (c1) VALUES (1); -- ERROR
+ERROR:  access to non-system foreign table is restricted
+DELETE FROM ft1 WHERE c1 = 1; -- ERROR
+ERROR:  access to non-system foreign table is restricted
+TRUNCATE ft1; -- ERROR
+ERROR:  access to non-system foreign table is restricted
+RESET restrict_nonsystem_relation_kind;
 -- ===================================================================
 -- WHERE with remotely-executable conditions
 -- ===================================================================

diff --git a/contrib/postgres_fdw/sql/postgres_fdw.sql b/contrib/postgres_fdw/sql/postgres_fdw.sql
index 1c1dedd991ad096f41f10a676e91eea862c9bdb9..80cc3f9d8e72d656c47d965a3daea2040020113c 100644 (file)
--- a/contrib/postgres_fdw/sql/postgres_fdw.sql
+++ b/contrib/postgres_fdw/sql/postgres_fdw.sql
@@ -327,6 +327,14 @@ DELETE FROM loct_empty;
 ANALYZE ft_empty;
 EXPLAIN (VERBOSE, COSTS OFF) SELECT * FROM ft_empty ORDER BY c1;
 
+-- test restriction on non-system foreign tables.
+SET restrict_nonsystem_relation_kind TO 'foreign-table';
+SELECT * from ft1 where c1 < 1; -- ERROR
+INSERT INTO ft1 (c1) VALUES (1); -- ERROR
+DELETE FROM ft1 WHERE c1 = 1; -- ERROR
+TRUNCATE ft1; -- ERROR
+RESET restrict_nonsystem_relation_kind;
+
 -- ===================================================================
 -- WHERE with remotely-executable conditions
 -- ===================================================================

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index e8c5d2a3b7f97643439e359149d79b4acf855cf1..69c4bc614f814b2d56a0725c95ad8fdffae61c32 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -9564,6 +9564,23 @@ SET XML OPTION { DOCUMENT | CONTENT };
       </listitem>
      </varlistentry>
 
+     <varlistentry id="guc-restrict-nonsystem-relation-kind" xreflabel="restrict_nonsystem_relation_kind">
+      <term><varname>restrict_nonsystem_relation_kind</varname> (<type>string</type>)
+      <indexterm>
+       <primary><varname>restrict_nonsystem_relation_kind</varname></primary>
+       <secondary>configuration parameter</secondary>
+     </indexterm>
+     </term>
+     <listitem>
+      <para>
+       This variable specifies relation kind to which access is restricted.
+       It contains a comma-separated list of relation kind.  Currently, the
+       supported relation kinds are <literal>view</literal> and
+       <literal>foreign-table</literal>.
+      </para>
+     </listitem>
+     </varlistentry>
+
      </variablelist>
     </sect2>
      <sect2 id="runtime-config-client-format">

diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml
index 7ff5d04c73d408e46141cf9a42bca79dbccbf54b..b879c30c1805ea5b7589bfafcc1aa5360fcdbf3b 100644 (file)
--- a/doc/src/sgml/ref/pg_dump.sgml
+++ b/doc/src/sgml/ref/pg_dump.sgml
@@ -868,6 +868,14 @@ PostgreSQL documentation
         The only exception is that an empty pattern is disallowed.
        </para>
 
+       <note>
+        <para>
+         Using wildcards in <option>--include-foreign-data</option> may result
+         in access to unexpected foreign servers. Also, to use this option securely,
+         make sure that the named server must have a trusted owner.
+        </para>
+       </note>
+
        <note>
         <para>
          When <option>--include-foreign-data</option> is specified,

diff --git a/src/backend/foreign/foreign.c b/src/backend/foreign/foreign.c
index ca3ad55b628f10035685dc3190379a8461b92206..7335838af351a97b1e8b5c757b8aacc984cf6178 100644 (file)
--- a/src/backend/foreign/foreign.c
+++ b/src/backend/foreign/foreign.c
@@ -23,6 +23,7 @@
 #include "funcapi.h"
 #include "lib/stringinfo.h"
 #include "miscadmin.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/memutils.h"
 #include "utils/rel.h"
@@ -323,6 +324,15 @@ GetFdwRoutine(Oid fdwhandler)
    Datum       datum;
    FdwRoutine *routine;
 
+   /* Check if the access to foreign tables is restricted */
+   if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+   {
+       /* there must not be built-in FDW handler  */
+       ereport(ERROR,
+               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                errmsg("access to non-system foreign table is restricted")));
+   }
+
    datum = OidFunctionCall0(fdwhandler);
    routine = (FdwRoutine *) DatumGetPointer(datum);
 

diff --git a/src/backend/optimizer/plan/createplan.c b/src/backend/optimizer/plan/createplan.c
index 4bb38160b338a61c18d91edc749a68cebc5f8a38..974c50b29f9b5c47e7489083e4b64b9ec0c69b0b 100644 (file)
--- a/src/backend/optimizer/plan/createplan.c
+++ b/src/backend/optimizer/plan/createplan.c
@@ -40,6 +40,7 @@
 #include "parser/parse_clause.h"
 #include "parser/parsetree.h"
 #include "partitioning/partprune.h"
+#include "tcop/tcopprot.h"
 #include "utils/lsyscache.h"
 
 
@@ -7090,7 +7091,19 @@ make_modifytable(PlannerInfo *root, Plan *subplan,
 
            if (rte->rtekind == RTE_RELATION &&
                rte->relkind == RELKIND_FOREIGN_TABLE)
+           {
+               /* Check if the access to foreign tables is restricted */
+               if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+               {
+                   /* there must not be built-in foreign tables */
+                   Assert(rte->relid >= FirstNormalObjectId);
+                   ereport(ERROR,
+                           (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                            errmsg("access to non-system foreign table is restricted")));
+               }
+
                fdwroutine = GetFdwRoutineByRelId(rte->relid);
+           }
            else
                fdwroutine = NULL;
        }

diff --git a/src/backend/optimizer/util/plancat.c b/src/backend/optimizer/util/plancat.c
index 07c4ba384ab6ef6eb02b51b5f4a106438403a776..1a3045479ff4738279d6c24c155bee1d3b45b6b7 100644 (file)
--- a/src/backend/optimizer/util/plancat.c
+++ b/src/backend/optimizer/util/plancat.c
@@ -47,6 +47,7 @@
 #include "rewrite/rewriteManip.h"
 #include "statistics/statistics.h"
 #include "storage/bufmgr.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/lsyscache.h"
 #include "utils/partcache.h"
@@ -500,6 +501,17 @@ get_relation_info(PlannerInfo *root, Oid relationObjectId, bool inhparent,
    /* Grab foreign-table info using the relcache, while we have it */
    if (relation->rd_rel->relkind == RELKIND_FOREIGN_TABLE)
    {
+       /* Check if the access to foreign tables is restricted */
+       if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+       {
+           /* there must not be built-in foreign tables */
+           Assert(RelationGetRelid(relation) >= FirstNormalObjectId);
+
+           ereport(ERROR,
+                   (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                    errmsg("access to non-system foreign table is restricted")));
+       }
+
        rel->serverid = GetForeignServerIdByRelId(RelationGetRelid(relation));
        rel->fdwroutine = GetFdwRoutineForRelation(relation, true);
    }

diff --git a/src/backend/rewrite/rewriteHandler.c b/src/backend/rewrite/rewriteHandler.c
index 6cef936f8240f8d4dbd5574db9a38349e73fa842..9cd96fd17efe2897d958e9cc5ff3958ec6f11002 100644 (file)
--- a/src/backend/rewrite/rewriteHandler.c
+++ b/src/backend/rewrite/rewriteHandler.c
@@ -41,6 +41,7 @@
 #include "rewrite/rewriteManip.h"
 #include "rewrite/rewriteSearchCycle.h"
 #include "rewrite/rowsecurity.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -1740,6 +1741,14 @@ ApplyRetrieveRule(Query *parsetree,
    if (rule->qual != NULL)
        elog(ERROR, "cannot handle qualified ON SELECT rule");
 
+   /* Check if the expansion of non-system views are restricted */
+   if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_VIEW) != 0 &&
+                RelationGetRelid(relation) >= FirstNormalObjectId))
+       ereport(ERROR,
+               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                errmsg("access to non-system view \"%s\" is restricted",
+                       RelationGetRelationName(relation))));
+
    if (rt_index == parsetree->resultRelation)
    {
        /*
@@ -3108,6 +3117,14 @@ rewriteTargetView(Query *parsetree, Relation view)
        }
    }
 
+   /* Check if the expansion of non-system views are restricted */
+   if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_VIEW) != 0 &&
+                RelationGetRelid(view) >= FirstNormalObjectId))
+       ereport(ERROR,
+               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                errmsg("access to non-system view \"%s\" is restricted",
+                       RelationGetRelationName(view))));
+
    /*
     * For INSERT/UPDATE the modified columns must all be updatable.
     */

diff --git a/src/backend/tcop/postgres.c b/src/backend/tcop/postgres.c
index 36cc99ec9cf5124af257e1fed07afa19692557dd..e7d486ca2fc49b2f0c276de26796bc901482e3b4 100644 (file)
--- a/src/backend/tcop/postgres.c
+++ b/src/backend/tcop/postgres.c
@@ -77,6 +77,7 @@
 #include "utils/snapmgr.h"
 #include "utils/timeout.h"
 #include "utils/timestamp.h"
+#include "utils/varlena.h"
 
 /* ----------------
  *     global variables
@@ -101,6 +102,9 @@ int         PostAuthDelay = 0;
 /* Time between checks that the client is still connected. */
 int            client_connection_check_interval = 0;
 
+/* flags for non-system relation kinds to restrict use */
+int            restrict_nonsystem_relation_kind;
+
 /* ----------------
  *     private typedefs etc
  * ----------------
@@ -3628,6 +3632,66 @@ check_log_stats(bool *newval, void **extra, GucSource source)
    return true;
 }
 
+/*
+ * GUC check_hook for restrict_nonsystem_relation_kind
+ */
+bool
+check_restrict_nonsystem_relation_kind(char **newval, void **extra, GucSource source)
+{
+   char       *rawstring;
+   List       *elemlist;
+   ListCell   *l;
+   int         flags = 0;
+
+   /* Need a modifiable copy of string */
+   rawstring = pstrdup(*newval);
+
+   if (!SplitIdentifierString(rawstring, ',', &elemlist))
+   {
+       /* syntax error in list */
+       GUC_check_errdetail("List syntax is invalid.");
+       pfree(rawstring);
+       list_free(elemlist);
+       return false;
+   }
+
+   foreach(l, elemlist)
+   {
+       char       *tok = (char *) lfirst(l);
+
+       if (pg_strcasecmp(tok, "view") == 0)
+           flags |= RESTRICT_RELKIND_VIEW;
+       else if (pg_strcasecmp(tok, "foreign-table") == 0)
+           flags |= RESTRICT_RELKIND_FOREIGN_TABLE;
+       else
+       {
+           GUC_check_errdetail("Unrecognized key word: \"%s\".", tok);
+           pfree(rawstring);
+           list_free(elemlist);
+           return false;
+       }
+   }
+
+   pfree(rawstring);
+   list_free(elemlist);
+
+   /* Save the flags in *extra, for use by the assign function */
+   *extra = guc_malloc(ERROR, sizeof(int));
+   *((int *) *extra) = flags;
+
+   return true;
+}
+
+/*
+ * GUC assign_hook for restrict_nonsystem_relation_kind
+ */
+void
+assign_restrict_nonsystem_relation_kind(const char *newval, void *extra)
+{
+   int        *flags = (int *) extra;
+
+   restrict_nonsystem_relation_kind = *flags;
+}
 
 /*
  * set_debug_options --- apply "-d N" command line option

diff --git a/src/backend/utils/misc/guc_tables.c b/src/backend/utils/misc/guc_tables.c
index b078b934a792c703a940b53573e8cfbe797ce571..a515ecde977a26fbf7e8031c7c2b13e3a1fa12ee 100644 (file)
--- a/src/backend/utils/misc/guc_tables.c
+++ b/src/backend/utils/misc/guc_tables.c
@@ -564,6 +564,7 @@ static char *server_encoding_string;
 static char *server_version_string;
 static int server_version_num;
 static char *debug_io_direct_string;
+static char *restrict_nonsystem_relation_kind_string;
 
 #ifdef HAVE_SYSLOG
 #define    DEFAULT_SYSLOG_FACILITY LOG_LOCAL0
@@ -4549,6 +4550,17 @@ struct config_string ConfigureNamesString[] =
        check_debug_io_direct, assign_debug_io_direct, NULL
    },
 
+   {
+       {"restrict_nonsystem_relation_kind", PGC_USERSET, CLIENT_CONN_STATEMENT,
+           gettext_noop("Sets relation kinds of non-system relation to restrict use"),
+           NULL,
+           GUC_LIST_INPUT | GUC_NOT_IN_SAMPLE
+       },
+       &restrict_nonsystem_relation_kind_string,
+       "",
+       check_restrict_nonsystem_relation_kind, assign_restrict_nonsystem_relation_kind, NULL
+   },
+
    /* End-of-list marker */
    {
        {NULL, 0, 0, NULL, NULL}, NULL, NULL, NULL, NULL, NULL

diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c
index 300fe071fc81b2f65d35e551cb30dc3a4ee740fa..1694ff55f89b552ce6de71c43e1718a15eb8a15b 100644 (file)
--- a/src/bin/pg_dump/pg_dump.c
+++ b/src/bin/pg_dump/pg_dump.c
@@ -324,6 +324,7 @@ static bool nonemptyReloptions(const char *reloptions);
 static void appendReloptionsArrayAH(PQExpBuffer buffer, const char *reloptions,
                                    const char *prefix, Archive *fout);
 static char *get_synchronized_snapshot(Archive *fout);
+static void set_restrict_relation_kind(Archive *AH, const char *value);
 static void setupDumpWorker(Archive *AH);
 static TableInfo *getRootTableInfo(const TableInfo *tbinfo);
 static bool forcePartitionRootLoad(const TableInfo *tbinfo);
@@ -1252,6 +1253,13 @@ setup_connection(Archive *AH, const char *dumpencoding,
            ExecuteSqlStatement(AH, "SET row_security = off");
    }
 
+   /*
+    * For security reasons, we restrict the expansion of non-system views and
+    * access to foreign tables during the pg_dump process. This restriction
+    * is adjusted when dumping foreign table data.
+    */
+   set_restrict_relation_kind(AH, "view, foreign-table");
+
    /*
     * Initialize prepared-query state to "nothing prepared".  We do this here
     * so that a parallel dump worker will have its own state.
@@ -2114,6 +2122,10 @@ dumpTableData_copy(Archive *fout, const void *dcontext)
     */
    if (tdinfo->filtercond || tbinfo->relkind == RELKIND_FOREIGN_TABLE)
    {
+       /* Temporary allows to access to foreign tables to dump data */
+       if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+           set_restrict_relation_kind(fout, "view");
+
        appendPQExpBufferStr(q, "COPY (SELECT ");
        /* klugery to get rid of parens in column list */
        if (strlen(column_list) > 2)
@@ -2225,6 +2237,11 @@ dumpTableData_copy(Archive *fout, const void *dcontext)
                       classname);
 
    destroyPQExpBuffer(q);
+
+   /* Revert back the setting */
+   if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+       set_restrict_relation_kind(fout, "view, foreign-table");
+
    return 1;
 }
 
@@ -2251,6 +2268,10 @@ dumpTableData_insert(Archive *fout, const void *dcontext)
    int         rows_per_statement = dopt->dump_inserts;
    int         rows_this_statement = 0;
 
+   /* Temporary allows to access to foreign tables to dump data */
+   if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+       set_restrict_relation_kind(fout, "view");
+
    /*
     * If we're going to emit INSERTs with column names, the most efficient
     * way to deal with generated columns is to exclude them entirely.  For
@@ -2490,6 +2511,10 @@ dumpTableData_insert(Archive *fout, const void *dcontext)
        destroyPQExpBuffer(insertStmt);
    free(attgenerated);
 
+   /* Revert back the setting */
+   if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+       set_restrict_relation_kind(fout, "view, foreign-table");
+
    return 1;
 }
 
@@ -4590,6 +4615,28 @@ is_superuser(Archive *fout)
    return false;
 }
 
+/*
+ * Set the given value to restrict_nonsystem_relation_kind value. Since
+ * restrict_nonsystem_relation_kind is introduced in minor version releases,
+ * the setting query is effective only where available.
+ */
+static void
+set_restrict_relation_kind(Archive *AH, const char *value)
+{
+   PQExpBuffer query = createPQExpBuffer();
+   PGresult   *res;
+
+   appendPQExpBuffer(query,
+                     "SELECT set_config(name, '%s', false) "
+                     "FROM pg_settings "
+                     "WHERE name = 'restrict_nonsystem_relation_kind'",
+                     value);
+   res = ExecuteSqlQuery(AH, query->data, PGRES_TUPLES_OK);
+
+   PQclear(res);
+   destroyPQExpBuffer(query);
+}
+
 /*
  * getSubscriptions
  *   get information about subscriptions

diff --git a/src/include/tcop/tcopprot.h b/src/include/tcop/tcopprot.h
index abd7b4fff33dd157b0d1fc4460154c3d8d97a48b..e529e9f06c2523d3ea3a930a92dc27f49fe12821 100644 (file)
--- a/src/include/tcop/tcopprot.h
+++ b/src/include/tcop/tcopprot.h
@@ -43,6 +43,12 @@ typedef enum
 
 extern PGDLLIMPORT int log_statement;
 
+/* Flags for restrict_nonsystem_relation_kind value */
+#define RESTRICT_RELKIND_VIEW          0x01
+#define RESTRICT_RELKIND_FOREIGN_TABLE 0x02
+
+extern PGDLLIMPORT int restrict_nonsystem_relation_kind;
+
 extern List *pg_parse_query(const char *query_string);
 extern List *pg_rewrite_query(Query *query);
 extern List *pg_analyze_and_rewrite_fixedparams(RawStmt *parsetree,

diff --git a/src/include/utils/guc_hooks.h b/src/include/utils/guc_hooks.h
index 952293a1c3059932a0ffdf03fec15e1fbf3de078..0ea33fede9cd0c311bdb746a76564a63eb85afd5 100644 (file)
--- a/src/include/utils/guc_hooks.h
+++ b/src/include/utils/guc_hooks.h
@@ -118,6 +118,9 @@ extern void assign_recovery_target_xid(const char *newval, void *extra);
 extern bool check_role(char **newval, void **extra, GucSource source);
 extern void assign_role(const char *newval, void *extra);
 extern const char *show_role(void);
+extern bool check_restrict_nonsystem_relation_kind(char **newval, void **extra,
+                                                  GucSource source);
+extern void assign_restrict_nonsystem_relation_kind(const char *newval, void *extra);
 extern bool check_search_path(char **newval, void **extra, GucSource source);
 extern void assign_search_path(const char *newval, void *extra);
 extern bool check_session_authorization(char **newval, void **extra, GucSource source);

diff --git a/src/test/regress/expected/create_view.out b/src/test/regress/expected/create_view.out
index 61825ef7d4ee198fe378abfd7216b42f8a0adaf0..f3f8c7b5a2fa0f52ccefd4d0d276461e6769b356 100644 (file)
--- a/src/test/regress/expected/create_view.out
+++ b/src/test/regress/expected/create_view.out
@@ -2202,6 +2202,21 @@ select pg_get_viewdef('tt26v', true);
     FROM ( VALUES (1,2,3)) v(x, y, z);
 (1 row)
 
+-- test restriction on non-system view expansion.
+create table tt27v_tbl (a int);
+create view tt27v as select a from tt27v_tbl;
+set restrict_nonsystem_relation_kind to 'view';
+select a from tt27v where a > 0; -- Error
+ERROR:  access to non-system view "tt27v" is restricted
+insert into tt27v values (1); -- Error
+ERROR:  access to non-system view "tt27v" is restricted
+select viewname from pg_views where viewname = 'tt27v'; -- Ok to access a system view.
+ viewname 
+----------
+ tt27v
+(1 row)
+
+reset restrict_nonsystem_relation_kind;
 -- clean up all the random objects we made above
 DROP SCHEMA temp_view_test CASCADE;
 NOTICE:  drop cascades to 27 other objects
@@ -2233,7 +2248,7 @@ drop cascades to view aliased_view_2
 drop cascades to view aliased_view_3
 drop cascades to view aliased_view_4
 DROP SCHEMA testviewschm2 CASCADE;
-NOTICE:  drop cascades to 77 other objects
+NOTICE:  drop cascades to 79 other objects
 DETAIL:  drop cascades to table t1
 drop cascades to view temporal1
 drop cascades to view temporal2
@@ -2311,3 +2326,5 @@ drop cascades to view tt23v
 drop cascades to view tt24v
 drop cascades to view tt25v
 drop cascades to view tt26v
+drop cascades to table tt27v_tbl
+drop cascades to view tt27v

diff --git a/src/test/regress/sql/create_view.sql b/src/test/regress/sql/create_view.sql
index 8838a40f7abbe6c9ed0d8be02ad48cd2cc800882..3a78be1b0c7c486b60fe82432a87cd539adafbd2 100644 (file)
--- a/src/test/regress/sql/create_view.sql
+++ b/src/test/regress/sql/create_view.sql
@@ -813,6 +813,15 @@ select x + y + z as c1,
 from (values(1,2,3)) v(x,y,z);
 select pg_get_viewdef('tt26v', true);
 
+-- test restriction on non-system view expansion.
+create table tt27v_tbl (a int);
+create view tt27v as select a from tt27v_tbl;
+set restrict_nonsystem_relation_kind to 'view';
+select a from tt27v where a > 0; -- Error
+insert into tt27v values (1); -- Error
+select viewname from pg_views where viewname = 'tt27v'; -- Ok to access a system view.
+reset restrict_nonsystem_relation_kind;
+
 -- clean up all the random objects we made above
 DROP SCHEMA temp_view_test CASCADE;
 DROP SCHEMA testviewschm2 CASCADE;