diff --git a/src/backend/distributed/commands/seclabel.c b/src/backend/distributed/commands/seclabel.c index b520f6fac..0808591eb 100644 --- a/src/backend/distributed/commands/seclabel.c +++ b/src/backend/distributed/commands/seclabel.c @@ -11,6 +11,7 @@ #include "postgres.h" +#include "commands/seclabel.h" #include "distributed/commands.h" #include "distributed/commands/utility_hook.h" #include "distributed/coordinator_protocol.h" @@ -19,6 +20,17 @@ #include "distributed/metadata_sync.h" #include "distributed/metadata/distobject.h" + +PG_FUNCTION_INFO_V1(citus_test_register_label_provider); + +Datum +citus_test_register_label_provider(PG_FUNCTION_ARGS) +{ + register_label_provider("citus_tests_label_provider", citus_test_object_relabel); + PG_RETURN_VOID(); +} + + /* * PreprocessSecLabelStmt is executed before the statement is applied to the local * postgres instance. diff --git a/src/backend/distributed/shared_library_init.c b/src/backend/distributed/shared_library_init.c index 6052c7870..9b5768ee7 100644 --- a/src/backend/distributed/shared_library_init.c +++ b/src/backend/distributed/shared_library_init.c @@ -29,7 +29,6 @@ #include "citus_version.h" #include "commands/explain.h" #include "commands/extension.h" -#include "commands/seclabel.h" #include "common/string.h" #include "executor/executor.h" #include "distributed/backend_data.h" @@ -575,8 +574,6 @@ _PG_init(void) INIT_COLUMNAR_SYMBOL(PGFunction, columnar_storage_info); INIT_COLUMNAR_SYMBOL(PGFunction, columnar_store_memory_stats); INIT_COLUMNAR_SYMBOL(PGFunction, test_columnar_storage_write_new_page); - - register_label_provider("citus_tests_label_provider", citus_test_object_relabel); } diff --git a/src/test/regress/expected/seclabel.out b/src/test/regress/expected/seclabel.out new file mode 100644 index 000000000..cb8bd26a0 --- /dev/null +++ b/src/test/regress/expected/seclabel.out @@ -0,0 +1,87 @@ +SELECT citus_remove_node('localhost', :worker_2_port); + citus_remove_node +--------------------------------------------------------------------- + +(1 row) + +CREATE FUNCTION citus_test_register_label_provider() + RETURNS void + LANGUAGE C + AS 'citus', $$citus_test_register_label_provider$$; +SELECT citus_test_register_label_provider(); + citus_test_register_label_provider +--------------------------------------------------------------------- + +(1 row) + +CREATE ROLE user1; +SET citus.enable_metadata_sync TO off; +CREATE OR REPLACE FUNCTION start_session_level_connection_to_node(text, integer) + RETURNS void + LANGUAGE C STRICT VOLATILE + AS 'citus', $$start_session_level_connection_to_node$$; +CREATE OR REPLACE FUNCTION override_backend_data_gpid(bigint) + RETURNS void + LANGUAGE C STRICT IMMUTABLE + AS 'citus', $$override_backend_data_gpid$$; +SELECT run_command_on_workers($$SET citus.enable_metadata_sync TO off;CREATE OR REPLACE FUNCTION override_backend_data_gpid(bigint) + RETURNS void + LANGUAGE C STRICT IMMUTABLE + AS 'citus'$$); + run_command_on_workers +--------------------------------------------------------------------- + (localhost,57637,t,SET) +(1 row) + +CREATE OR REPLACE FUNCTION run_commands_on_session_level_connection_to_node(text) + RETURNS void + LANGUAGE C STRICT VOLATILE + AS 'citus', $$run_commands_on_session_level_connection_to_node$$; +CREATE OR REPLACE FUNCTION stop_session_level_connection_to_node() + RETURNS void + LANGUAGE C STRICT VOLATILE + AS 'citus', $$stop_session_level_connection_to_node$$; +RESET citus.enable_metadata_sync; +ALTER SYSTEM SET citus.max_cached_conns_per_worker TO 2; +SELECT start_session_level_connection_to_node('localhost', :worker_1_port); + start_session_level_connection_to_node +--------------------------------------------------------------------- + +(1 row) + +SELECT run_commands_on_session_level_connection_to_node('SELECT citus_test_register_label_provider()'); + run_commands_on_session_level_connection_to_node +--------------------------------------------------------------------- + +(1 row) + +SET citus.log_remote_commands TO on; +SECURITY LABEL for citus_tests_label_provider ON ROLE user1 IS 'citus_classified'; +NOTICE: issuing BEGIN TRANSACTION ISOLATION LEVEL READ COMMITTED;SELECT assign_distributed_transaction_id(xx, xx, 'xxxxxxx'); +DETAIL: on server postgres@localhost:xxxxx connectionId: xxxxxxx +NOTICE: issuing SET citus.enable_ddl_propagation TO 'off' +DETAIL: on server postgres@localhost:xxxxx connectionId: xxxxxxx +NOTICE: issuing SECURITY LABEL FOR citus_tests_label_provider ON ROLE user1 IS 'citus_classified' +DETAIL: on server postgres@localhost:xxxxx connectionId: xxxxxxx +NOTICE: issuing SET citus.enable_ddl_propagation TO 'on' +DETAIL: on server postgres@localhost:xxxxx connectionId: xxxxxxx +NOTICE: issuing COMMIT +DETAIL: on server postgres@localhost:xxxxx connectionId: xxxxxxx +RESET citus.log_remote_commands; +SELECT stop_session_level_connection_to_node(); + stop_session_level_connection_to_node +--------------------------------------------------------------------- + +(1 row) + +ALTER SYSTEM RESET citus.max_cached_conns_per_worker; +DROP FUNCTION stop_session_level_connection_to_node, run_commands_on_session_level_connection_to_node, + override_backend_data_gpid, start_session_level_connection_to_node; +DROP FUNCTION citus_test_register_label_provider; +DROP ROLE user1; +SELECT 1 FROM citus_add_node('localhost', :worker_2_port); + ?column? +--------------------------------------------------------------------- + 1 +(1 row) + diff --git a/src/test/regress/multi_1_schedule b/src/test/regress/multi_1_schedule index 287f4557a..aed751aa0 100644 --- a/src/test/regress/multi_1_schedule +++ b/src/test/regress/multi_1_schedule @@ -32,6 +32,7 @@ test: propagate_extension_commands test: escape_extension_name test: ref_citus_local_fkeys test: alter_database_owner +test: seclabel test: distributed_triggers test: create_single_shard_table # don't parallelize single_shard_table_udfs to make sure colocation ids are sequential diff --git a/src/test/regress/sql/seclabel.sql b/src/test/regress/sql/seclabel.sql new file mode 100644 index 000000000..f59d72471 --- /dev/null +++ b/src/test/regress/sql/seclabel.sql @@ -0,0 +1,63 @@ +SELECT citus_remove_node('localhost', :worker_2_port); + +CREATE FUNCTION citus_test_register_label_provider() + RETURNS void + LANGUAGE C + AS 'citus', $$citus_test_register_label_provider$$; + +SELECT citus_test_register_label_provider(); +CREATE ROLE user1; + +SET citus.enable_metadata_sync TO off; + +CREATE OR REPLACE FUNCTION start_session_level_connection_to_node(text, integer) + RETURNS void + LANGUAGE C STRICT VOLATILE + AS 'citus', $$start_session_level_connection_to_node$$; + +CREATE OR REPLACE FUNCTION override_backend_data_gpid(bigint) + RETURNS void + LANGUAGE C STRICT IMMUTABLE + AS 'citus', $$override_backend_data_gpid$$; + +SELECT run_command_on_workers($$SET citus.enable_metadata_sync TO off;CREATE OR REPLACE FUNCTION override_backend_data_gpid(bigint) + RETURNS void + LANGUAGE C STRICT IMMUTABLE + AS 'citus'$$); + +CREATE OR REPLACE FUNCTION run_commands_on_session_level_connection_to_node(text) + RETURNS void + LANGUAGE C STRICT VOLATILE + AS 'citus', $$run_commands_on_session_level_connection_to_node$$; + +CREATE OR REPLACE FUNCTION stop_session_level_connection_to_node() + RETURNS void + LANGUAGE C STRICT VOLATILE + AS 'citus', $$stop_session_level_connection_to_node$$; + +RESET citus.enable_metadata_sync; + +ALTER SYSTEM SET citus.max_cached_conns_per_worker TO 2; + +SELECT start_session_level_connection_to_node('localhost', :worker_1_port); + +SELECT run_commands_on_session_level_connection_to_node('SELECT citus_test_register_label_provider()'); + +SET citus.log_remote_commands TO on; + +SECURITY LABEL for citus_tests_label_provider ON ROLE user1 IS 'citus_classified'; + +RESET citus.log_remote_commands; + +SELECT stop_session_level_connection_to_node(); + +ALTER SYSTEM RESET citus.max_cached_conns_per_worker; + +DROP FUNCTION stop_session_level_connection_to_node, run_commands_on_session_level_connection_to_node, + override_backend_data_gpid, start_session_level_connection_to_node; + +DROP FUNCTION citus_test_register_label_provider; + +DROP ROLE user1; + +SELECT 1 FROM citus_add_node('localhost', :worker_2_port);