openGauss数据库源码解析系列文章——安全管理源码解析：对象权限管理

typedef struct AclItem {
    Oid ai_grantee;     /* 被授权者的OID */
    Oid ai_grantor;     /* 授权者的OID */
    AclMode ai_privs;  /* 权限位：32位的比特位 */
} AclItem;

typedef struct GrantStmt {
    NodeTag type;
    bool is_grant;            /* true = 授权, false = 回收 */
    GrantTargetType targtype;  /*  操作目标的类型  */
    GrantObjectType objtype;  /*  被操作对象的类型：表、数据库、模式、函数等  */
    List* objects;            /*  被操作对象的集合  */
    List* privileges;          /*  要操作权限列表  */
    List* grantees;           /*  被授权者的集合  */
    bool grant_option;       /*  true = 再授予权限  */
    DropBehavior behavior;   /*  回收权限的行为  */
} GrantStmt;

typedef struct InternalGrant {
    bool is_grant;            /*  true=授权, false=回收  */
    GrantObjectType objtype;  /*  被操作对象的类型：表、数据库、模式、函数等  */
    List* objects;            /*  被操作对象的集合  */
    bool all_privs;           /*  是否授予或回收所有的权限  */
AclMode privileges;      /*  AclMode形式表示的DML类操作对应的权限  */
AclMode ddl_privileges;  /*  AclMode形式表示的DDL类操作对应的权限  */
List* col_privs;          /*  对列执行的DML类操作对应的权限  */
List* col_ddl_privs;      /*  对列执行的DDL类操作对应的权限  */
    List* grantees;          /*  被授权者的集合  */
    bool grant_option;      /*  true=再授予权限  */
    DropBehavior behavior; /*  回收权限的行为  */
} InternalGrant;

static void ExecGrant_Relation(InternalGrant* istmt)
{
    . . .
/*  循环处理每一个表对象   */
    foreach (cell, istmt->objects) {
        . . .
/*  判断所要操作的表对象是否存在，若不存在则提示报错   */
        tuple = SearchSysCache1(RELOID, ObjectIdGetDatum(relOid));
        if (!HeapTupleIsValid(tuple))
            ereport(
                ERROR, (errcode(ERRCODE_CACHE_LOOKUP_FAILED), errmsg("cache lookup failed for relation %u", relOid)));
        pg_class_tuple = (Form_pg_class)GETSTRUCT(tuple);
. . .
        /*  系统表pg_class中获取旧ACL。若不存在旧的ACL，则新建一个ACL，若存在旧的ACL，则将旧的ACL存储为一个副本   */
        ownerId = pg_class_tuple->relowner;
        aclDatum = SysCacheGetAttr(RELOID, tuple, Anum_pg_class_relacl, &isNull);
        if (isNull) {
            switch (pg_class_tuple->relkind) {
                case RELKIND_SEQUENCE:
                    old_acl = acldefault(ACL_OBJECT_SEQUENCE, ownerId);
                    break;
                default:
                    old_acl = acldefault(ACL_OBJECT_RELATION, ownerId);
                    break;
            }
            noldmembers = 0;
            oldmembers = NULL;
        } else {
            old_acl = DatumGetAclPCopy(aclDatum);
            noldmembers = aclmembers(old_acl, &oldmembers);
        }
        old_rel_acl = aclcopy(old_acl);
 
        /*  处理表级别的权限   */
        if (this_privileges != ACL_NO_RIGHTS) {
            AclMode avail_goptions;
            Acl* new_acl = NULL;
            Oid grantorId;
            HeapTuple newtuple = NULL;
            Datum values[Natts_pg_class];
            bool nulls[Natts_pg_class] = {false};
            bool replaces[Natts_pg_class] = {false};
            int nnewmembers;
            Oid* newmembers = NULL;
            AclObjectKind aclkind;
 
            /*  获取授权者grantorId和授权者对该操作对象所拥有的授权权限avail_goptions   */
            select_best_grantor(GetUserId(), this_privileges, old_acl, ownerId, &grantorId, &avail_goptions);
 
            switch (pg_class_tuple->relkind) {
                case RELKIND_SEQUENCE:
                    aclkind = ACL_KIND_SEQUENCE;
                    break;
                default:
                    aclkind = ACL_KIND_CLASS;
                    break;
            }
 
            /*  结合参数avail_goptions和SQL命令中给出的操作权限，计算出实际需要授予或回收的权限   */
            this_privileges = restrict_and_check_grant(istmt->is_grant,
                avail_goptions,
                istmt->all_privs,
                this_privileges,
                relOid,
                grantorId,
                aclkind,
                NameStr(pg_class_tuple->relname),
                0,
                NULL);
 
            /*  生成新的ACL，并更新到系统表pg_class对应元组的ACL字段   */
            new_acl = merge_acl_with_grant(old_acl,
                istmt->is_grant,
                istmt->grant_option,
                istmt->behavior,
                istmt->grantees,
                this_privileges,
                grantorId,
                ownerId);
. . .
            replaces[Anum_pg_class_relacl - 1] = true;
            values[Anum_pg_class_relacl - 1] = PointerGetDatum(new_acl);
 
            newtuple = heap_modify_tuple(tuple, RelationGetDescr(relation), values, nulls, replaces);
 
            simple_heap_update(relation, &newtuple->t_self, newtuple);
. . .
        }
 
        /*  若存在列级授权或回收，则调用ExecGrant_Attribute 函数处理  */
. . .
        if (have_col_privileges) {
            AttrNumber i;
 
            for (i = 0; i < num_col_privileges; i++) {
                if (col_privileges[i] == ACL_NO_RIGHTS)
                    continue;
                ExecGrant_Attribute(istmt,
                    relOid,
                    NameStr(pg_class_tuple->relname),
                    i + FirstLowInvalidHeapAttributeNumber,
                    ownerId,
                    col_privileges[i],
                    attRelation,
                    old_rel_acl);
            }
        }
    . . .
    }
 
    heap_close(attRelation, RowExclusiveLock);
    heap_close(relation, RowExclusiveLock);
}

AclResult pg_class_aclcheck(Oid table_oid, Oid roleid, AclMode mode, bool check_nodegroup)
{
    if (pg_class_aclmask(table_oid, roleid, mode, ACLMASK_ANY, check_nodegroup) != 0)
        return ACLCHECK_OK;
    else
        return ACLCHECK_NO_PRIV;
}