Skip to content

Commit

Permalink
sql: add test asserting CREATE/USAGE on public schema
Browse files Browse the repository at this point in the history
The public schema currently always has CREATE/USAGE privileges
for the public role. Add a test that confirms this.

Release note: None
  • Loading branch information
rafiss committed Dec 16, 2021
1 parent d1e0373 commit 99eeb09
Show file tree
Hide file tree
Showing 3 changed files with 16 additions and 0 deletions.
2 changes: 2 additions & 0 deletions pkg/ccl/backupccl/restore_job.go
Original file line number Diff line number Diff line change
Expand Up @@ -1567,6 +1567,8 @@ func remapPublicSchemas(
// In CockroachDB, root is our substitute for the postgres user.
publicSchemaPrivileges := descpb.NewBasePrivilegeDescriptor(security.AdminRoleName())
// By default, everyone has USAGE and CREATE on the public schema.
// Once https://github.com/cockroachdb/cockroach/issues/70266 is resolved,
// the public role will no longer have CREATE privilege.
publicSchemaPrivileges.Grant(security.PublicRoleName(), privilege.List{privilege.CREATE, privilege.USAGE}, false)
publicSchemaDesc := schemadesc.NewBuilder(&descpb.SchemaDescriptor{
ParentID: db.GetID(),
Expand Down
2 changes: 2 additions & 0 deletions pkg/sql/descriptor.go
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,8 @@ func (p *planner) maybeCreatePublicSchemaWithDescriptor(
// In CockroachDB, root is our substitute for the postgres user.
publicSchemaPrivileges := descpb.NewBasePrivilegeDescriptor(security.AdminRoleName())
// By default, everyone has USAGE and CREATE on the public schema.
// Once https://github.com/cockroachdb/cockroach/issues/70266 is resolved,
// the public role will no longer have CREATE privileges.
publicSchemaPrivileges.Grant(security.PublicRoleName(), privilege.List{privilege.CREATE, privilege.USAGE}, false)
publicSchemaDesc := schemadesc.NewBuilder(&descpb.SchemaDescriptor{
ParentID: dbID,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,18 @@ user testuser
statement ok
USE d;

# The public schema is special and has hard-coded privileges for the public role.
# When https://github.com/cockroachdb/cockroach/issues/70266 is resolved,
# the public role will no longer have CREATE privilege.
query TTTT colnames
SHOW GRANTS ON SCHEMA public
----
database_name schema_name grantee privilege_type
d public admin ALL
d public public CREATE
d public public USAGE
d public root ALL

statement ok
CREATE SCHEMA testuser_s;

Expand Down

0 comments on commit 99eeb09

Please sign in to comment.