From 442f8700656bb5ce525d352241a17bbab14193c7 Mon Sep 17 00:00:00 2001 From: Peter Eisentraut Date: Thu, 16 Mar 2023 15:43:33 +0100 Subject: [PATCH] Integrate superuser check into has_rolreplication() This makes it consistent with similar functions like has_createrole_privilege() and allows removing some explicit superuser checks. Author: Nathan Bossart Discussion: https://www.postgresql.org/message-id/20230310000313.GA3992372%40nathanxps13 --- src/backend/replication/slot.c | 2 +- src/backend/utils/init/miscinit.c | 4 ++++ src/backend/utils/init/postinit.c | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/src/backend/replication/slot.c b/src/backend/replication/slot.c index f286918f69..3506b77cc7 100644 --- a/src/backend/replication/slot.c +++ b/src/backend/replication/slot.c @@ -1140,7 +1140,7 @@ CheckSlotRequirements(void) void CheckSlotPermissions(void) { - if (!superuser() && !has_rolreplication(GetUserId())) + if (!has_rolreplication(GetUserId())) ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("must be superuser or replication role to use replication slots"))); diff --git a/src/backend/utils/init/miscinit.c b/src/backend/utils/init/miscinit.c index 7eb7fe87f6..a604432126 100644 --- a/src/backend/utils/init/miscinit.c +++ b/src/backend/utils/init/miscinit.c @@ -709,6 +709,10 @@ has_rolreplication(Oid roleid) bool result = false; HeapTuple utup; + /* Superusers bypass all permission checking. */ + if (superuser_arg(roleid)) + return true; + utup = SearchSysCache1(AUTHOID, ObjectIdGetDatum(roleid)); if (HeapTupleIsValid(utup)) { diff --git a/src/backend/utils/init/postinit.c b/src/backend/utils/init/postinit.c index b0e20cc635..3026317bfc 100644 --- a/src/backend/utils/init/postinit.c +++ b/src/backend/utils/init/postinit.c @@ -962,7 +962,7 @@ InitPostgres(const char *in_dbname, Oid dboid, { Assert(!bootstrap); - if (!superuser() && !has_rolreplication(GetUserId())) + if (!has_rolreplication(GetUserId())) ereport(FATAL, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("must be superuser or replication role to start walsender")));