Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow db_owner to run start and stop dynamic_masking #3

Open
wants to merge 2 commits into
base: stable
Choose a base branch
from
Open

Allow db_owner to run start and stop dynamic_masking #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0d82b03
Allow db_owner to run start and stop dynamic_masking
lubennikovaav Jan 5, 2024
bb7c964
Add anon.set_salt() and anon.set_algorithm()
lubennikovaav Jan 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions anon.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,6 +34,9 @@ Datum register_label(PG_FUNCTION_ARGS);
PG_FUNCTION_INFO_V1(get_function_schema);
PG_FUNCTION_INFO_V1(register_label);

PG_FUNCTION_INFO_V1(set_anon_salt);
PG_FUNCTION_INFO_V1(set_anon_algorithm);

static bool guc_anon_restrict_to_trusted_schemas;
// Some GUC vars below are not used in the C code
// but they are used in the plpgsql code
Expand Down Expand Up @@ -327,3 +330,24 @@ register_label(PG_FUNCTION_ARGS)
register_label_provider(policy,anon_object_relabel);
return true;
}


Datum
set_anon_salt(PG_FUNCTION_ARGS)
{
char *salt = text_to_cstring(PG_GETARG_TEXT_PP(0));

SetConfigOption("anon.salt", salt, PGC_SUSET, PGC_S_OVERRIDE);

PG_RETURN_VOID();
}

Datum
set_anon_algorithm(PG_FUNCTION_ARGS)
{
char *algorithm = text_to_cstring(PG_GETARG_TEXT_PP(0));

SetConfigOption("anon.algorithm", algorithm, PGC_SUSET, PGC_S_OVERRIDE);

PG_RETURN_VOID();
}
47 changes: 45 additions & 2 deletions anon.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1563,6 +1563,29 @@ AS 'MODULE_PATHNAME', 'register_label'
PARALLEL UNSAFE
;

-- Set anon.salt to provided value
CREATE OR REPLACE FUNCTION anon.set_salt(TEXT)
RETURNS VOID
AS 'MODULE_PATHNAME', 'set_anon_salt'
LANGUAGE C
VOLATILE
STRICT
PARALLEL UNSAFE
SECURITY INVOKER
;

-- Set anon.salt to provided value
CREATE OR REPLACE FUNCTION anon.set_algorithm(TEXT)
RETURNS VOID
AS 'MODULE_PATHNAME', 'set_anon_algorithm'
LANGUAGE C
VOLATILE
STRICT
PARALLEL UNSAFE
SECURITY INVOKER
;


--
-- Create an additional masking policy
--
Expand Down Expand Up @@ -2036,7 +2059,17 @@ DECLARE
r RECORD;
BEGIN

SELECT current_setting('is_superuser') = 'on' AS su INTO r;
-- allow db_owner to start the masking engine
WITH db_owner AS (
SELECT u.usename, d.datname
FROM pg_database d, pg_user u
WHERE d.datdba=u.usesysid
AND d.datname=current_database()
) SELECT
current_user = db_owner.usename OR current_setting('is_superuser') = 'on' AS su INTO r
FROM db_owner;

-- SELECT current_setting('is_superuser') = 'on' AS su INTO r;
IF NOT r.su THEN
RAISE EXCEPTION 'Only supersusers can start the dynamic masking engine.';
END IF;
Expand Down Expand Up @@ -2082,7 +2115,17 @@ DECLARE
r RECORD;
BEGIN

SELECT current_setting('is_superuser') = 'on' AS su INTO r;
-- allow db_owner to stop the masking engine
WITH db_owner AS (
SELECT u.usename, d.datname
FROM pg_database d, pg_user u
WHERE d.datdba=u.usesysid
AND d.datname=current_database()
) SELECT
current_user = db_owner.usename OR current_setting('is_superuser') = 'on' AS su INTO r
FROM db_owner;

-- SELECT current_setting('is_superuser') = 'on' AS su INTO r;
IF NOT r.su THEN
RAISE EXCEPTION 'Only supersusers can stop the dynamic masking engine.';
END IF;
Expand Down