Invalidate acl.c caches when pg_authid changes.

This makes existing sessions reflect "ALTER ROLE ... [NO]INHERIT" as
quickly as they have been reflecting "GRANT role_name".  Back-patch to
9.5 (all supported versions).

Reviewed by Nathan Bossart.

Discussion: https://postgr.es/m/20201221095028[email protected]

diff --git a/src/backend/utils/adt/acl.c b/src/backend/utils/adt/acl.c
index 87fc29e49e466bbaf214e4152a5b4b5fb6db9cbb..c27ceaad3e527a4633012c574d1ad61e5445f2f8 100644 (file)
--- a/src/backend/utils/adt/acl.c
+++ b/src/backend/utils/adt/acl.c
@@ -48,7 +48,6 @@ typedef struct
  * role.  In most of these tests the "given role" is the same, namely the
  * active current user.  So we can optimize it by keeping a cached list of
  * all the roles the "given role" is a member of, directly or indirectly.
- * The cache is flushed whenever we detect a change in pg_auth_members.
  *
  * There are actually two caches, one computed under "has_privs" rules
  * (do not recurse where rolinherit isn't true) and one computed under
@@ -4692,12 +4691,16 @@ initialize_acl(void)
    if (!IsBootstrapProcessingMode())
    {
        /*
-        * In normal mode, set a callback on any syscache invalidation of
-        * pg_auth_members rows
+        * In normal mode, set a callback on any syscache invalidation of rows
+        * of pg_auth_members (for each AUTHMEM search in this file) or
+        * pg_authid (for has_rolinherit())
         */
        CacheRegisterSyscacheCallback(AUTHMEMROLEMEM,
                                      RoleMembershipCacheCallback,
                                      (Datum) 0);
+       CacheRegisterSyscacheCallback(AUTHOID,
+                                     RoleMembershipCacheCallback,
+                                     (Datum) 0);
    }
 }
 

diff --git a/src/test/regress/expected/privileges.out b/src/test/regress/expected/privileges.out
index ee5f26766d3253657f8a024e049450c1b802383b..f68210bcd21de2e27565cf17136bcc4d465be2a0 100644 (file)
--- a/src/test/regress/expected/privileges.out
+++ b/src/test/regress/expected/privileges.out
@@ -346,6 +346,13 @@ SET SESSION AUTHORIZATION regressuser1;
 SELECT * FROM atest3; -- fail
 ERROR:  permission denied for relation atest3
 DELETE FROM atest3; -- ok
+BEGIN;
+RESET SESSION AUTHORIZATION;
+ALTER ROLE regress_priv_user1 NOINHERIT;
+SET SESSION AUTHORIZATION regress_priv_user1;
+DELETE FROM atest3;
+ERROR:  permission denied for table atest3
+ROLLBACK;
 -- views
 SET SESSION AUTHORIZATION regressuser3;
 CREATE VIEW atestv1 AS SELECT * FROM atest1; -- ok

diff --git a/src/test/regress/sql/privileges.sql b/src/test/regress/sql/privileges.sql
index 3ea7ab36b2fa21cc0d1ac331af016632931f38dc..b31eb28cce3768957e5c79f9b1fcb976ed31aba0 100644 (file)
--- a/src/test/regress/sql/privileges.sql
+++ b/src/test/regress/sql/privileges.sql
@@ -216,6 +216,12 @@ SET SESSION AUTHORIZATION regressuser1;
 SELECT * FROM atest3; -- fail
 DELETE FROM atest3; -- ok
 
+BEGIN;
+RESET SESSION AUTHORIZATION;
+ALTER ROLE regress_priv_user1 NOINHERIT;
+SET SESSION AUTHORIZATION regress_priv_user1;
+DELETE FROM atest3;
+ROLLBACK;
 
 -- views