Re: Updates of SE-PostgreSQL 8.4devel patches (r1324)

Ah, very interesting.  Thanks.

---------------------------------------------------------------------------

KaiGai Kohei wrote:
> > 1034 and 25 are the oids for 'acllist' and 'text' and they are being
> > added to system tables.  Are you saying system tables don't use
> > pg_security but other tables do?
> 
> It means users can refer the "security_acl" and "security_label",
> as if they have proper types. However, in actually, they are stroed
> as security identifiers.
> 
> When user refers "security_acl", the patched heap_getsysattr() invokes
> rowaclHeapGetSecurityAclSysattr() to translate the security identifier
> of Row-level ACLs into an array of ACLs. User will see the translated
> representation, as if there is a variable length array, not an oid.
> 
> The rowaclHeapGetSecurityAclSysattr() fetch a tuple for the given
> security identifier from pg_security. It contains a text representation
> of ACLs, so the function exchange it into Acl *.
> 
> rowaclHeapGetSecurityAclSysattr()
>   -> rowaclSidToSecurityAcl()
>       -> pgaceLookupSecurityLabel() ... It fetch a tuple from pg_security
>       -> rawAclTextToAclArray() ... It translate from TEXT -> AclItem[]
> 
> > I do see pg_security being defined:
> > 
> >     + CATALOG(pg_security,3400) BKI_SHARED_RELATION
> >     + {
> >     +   text        seclabel;       /* text representation of security label */
> >     + } FormData_pg_security;
> > 
> > and I assume both security columns reference that.
> 
> Yes, AclItem[] is internally translated into text representation to store
> it on pg_security.
> 
> Thanks,
> --
> KaiGai Kohei <kaigai@kaigai.gr.jp>

--  Bruce Momjian  <bruce@momjian.us>        http://momjian.us EnterpriseDB
http://enterprisedb.com
 + If your life is a hard drive, Christ can be your backup. +