Ah, very interesting. Thanks.
---------------------------------------------------------------------------
KaiGai Kohei wrote:
> > 1034 and 25 are the oids for 'acllist' and 'text' and they are being
> > added to system tables. Are you saying system tables don't use
> > pg_security but other tables do?
>
> It means users can refer the "security_acl" and "security_label",
> as if they have proper types. However, in actually, they are stroed
> as security identifiers.
>
> When user refers "security_acl", the patched heap_getsysattr() invokes
> rowaclHeapGetSecurityAclSysattr() to translate the security identifier
> of Row-level ACLs into an array of ACLs. User will see the translated
> representation, as if there is a variable length array, not an oid.
>
> The rowaclHeapGetSecurityAclSysattr() fetch a tuple for the given
> security identifier from pg_security. It contains a text representation
> of ACLs, so the function exchange it into Acl *.
>
> rowaclHeapGetSecurityAclSysattr()
> -> rowaclSidToSecurityAcl()
> -> pgaceLookupSecurityLabel() ... It fetch a tuple from pg_security
> -> rawAclTextToAclArray() ... It translate from TEXT -> AclItem[]
>
> > I do see pg_security being defined:
> >
> > + CATALOG(pg_security,3400) BKI_SHARED_RELATION
> > + {
> > + text seclabel; /* text representation of security label */
> > + } FormData_pg_security;
> >
> > and I assume both security columns reference that.
>
> Yes, AclItem[] is internally translated into text representation to store
> it on pg_security.
>
> Thanks,
> --
> KaiGai Kohei <kaigai@kaigai.gr.jp>
-- Bruce Momjian <bruce@momjian.us> http://momjian.us EnterpriseDB
http://enterprisedb.com
+ If your life is a hard drive, Christ can be your backup. +