From patchwork Mon Sep 13 16:31:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ian Jackson X-Patchwork-Id: 12490029 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-18.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69090C4167B for ; Mon, 13 Sep 2021 16:31:43 +0000 (UTC) Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 366ED60E9C for ; Mon, 13 Sep 2021 16:31:43 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 366ED60E9C Authentication-Results: mail.kernel.org; dmarc=pass (p=none dis=none) header.from=xenproject.org Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=lists.xenproject.org Received: from list by lists.xenproject.org with outflank-mailman.185810.334568 (Exim 4.92) (envelope-from ) id 1mPork-0001uo-Rl; Mon, 13 Sep 2021 16:31:32 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version Received: by outflank-mailman (output) from mailman id 185810.334568; Mon, 13 Sep 2021 16:31:32 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1mPork-0001r3-JH; Mon, 13 Sep 2021 16:31:32 +0000 Received: by outflank-mailman (input) for mailman id 185810; Mon, 13 Sep 2021 16:31:30 +0000 Received: from mail.xenproject.org ([104.130.215.37]) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1mPori-0001OB-Hi for xen-devel@lists.xenproject.org; Mon, 13 Sep 2021 16:31:30 +0000 Received: from xenbits.xenproject.org ([104.239.192.120]) by mail.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1mPori-00013e-Gr for xen-devel@lists.xenproject.org; Mon, 13 Sep 2021 16:31:30 +0000 Received: from iwj (helo=mariner.uk.xensource.com) by xenbits.xenproject.org with local-bsmtp (Exim 4.92) (envelope-from ) id 1mPori-0006ud-Fq for xen-devel@lists.xenproject.org; Mon, 13 Sep 2021 16:31:30 +0000 Received: from [172.18.45.5] (helo=zealot.relativity.greenend.org.uk) by mariner.uk.xensource.com with esmtp (Exim 4.89) (envelope-from ) id 1mPorg-00038U-Oa; Mon, 13 Sep 2021 17:31:28 +0100 X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=xenproject.org; s=20200302mail; h=Content-Transfer-Encoding:MIME-Version: References:In-Reply-To:Message-Id:Date:Subject:Cc:To:From; bh=/+x+VTxPOx8gBN+12QXDZqpJKD9whSaNezCRFKCFhP4=; b=ESEKoHcEFy+r0di5R3FhO92RKh wUacJiG+3jnXvWu0YSD2OOXBXe1ueom9Br/NbhFcE+AubAgzqIDs3oe0pOQRl0hpFU3O2+EhNUubN gGMiqlID+yNH3Q9GmMyOM2IteZhNPccuhhJ8FLwkBGzE6eJTJLUMFoW1U39kJgTD/A8Y=; From: Ian Jackson To: xen-devel@lists.xenproject.org Cc: Ian Jackson Subject: [OSSTEST PATCH 5/5] db: Replace ExecutiveDbOwningRoleRegexp with ExecutiveDbOwningRoleMap Date: Mon, 13 Sep 2021 17:31:15 +0100 Message-Id: <20210913163115.12749-5-iwj@xenproject.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20210913163115.12749-1-iwj@xenproject.org> References: <20210913163115.12749-1-iwj@xenproject.org> MIME-Version: 1.0 And use SET ROLE. Signed-off-by: Ian Jackson --- Osstest/Executive.pm | 2 +- README | 17 ++++++++--- mg-schema-test-database | 2 +- mg-schema-update | 68 ++++++++++++++++++++++++++++++++--------- 4 files changed, 68 insertions(+), 21 deletions(-) diff --git a/Osstest/Executive.pm b/Osstest/Executive.pm index d95d848d..ec592ed5 100644 --- a/Osstest/Executive.pm +++ b/Osstest/Executive.pm @@ -115,7 +115,7 @@ augmentconfigdefaults( QueuePlanUpdateInterval => 300, # seconds Repos => "$ENV{'HOME'}/repos", BisectionRevisonGraphSize => '600x300', - ExecutiveDbOwningRoleRegexp => 'osstest', + ExecutiveDbOwningRoleMap => '=', MaxUmask => '007', ); diff --git a/README b/README index 20d9802a..aa611f23 100644 --- a/README +++ b/README @@ -770,10 +770,19 @@ ExecutiveDbname_ PostgreSQL dbname string for the database . Default is to use ExecutiveDbnamePat. -ExecutiveDbOwningRoleRegexp - Regexp which is supposed to match the database user used for schema - changes - because, that role will end up owning the database objects. - Defaults to `osstest'. +ExecutiveDbOwningRoleMap + Adjust roles used for schema changes. osstest uses the following + nominal roles + osstest Main db runner, owns most tables, etc. + webflights More privileged, can see webflights tokens + The syntaxes for ExecutiveDbOwningRoleMap are + = use the built-in nominal role, literally (default) + - always use the default role for the user + always use NEW-ROLE for everything + or a list like this + =,... + where can be `-' (default user role); unspecified + roles are not mapped. Flights for by-hand testing =========================== diff --git a/mg-schema-test-database b/mg-schema-test-database index b185e8b9..33b644f5 100755 --- a/mg-schema-test-database +++ b/mg-schema-test-database @@ -361,7 +361,7 @@ OwnerDaemonHost $ctrlhost QueueDaemonHost $ctrlhost OwnerDaemonPort ${ctrlports%,*} QueueDaemonPort ${ctrlports#*,} -ExecutiveDbOwningRoleRegexp .* +ExecutiveDbOwningRoleMap - QueueDaemonHoldoff 3 QueueDaemonRetry 5 Logs $PWD/logs diff --git a/mg-schema-update b/mg-schema-update index fb754bed..5ec7220e 100755 --- a/mg-schema-update +++ b/mg-schema-update @@ -22,7 +22,6 @@ # ./mg-schema-update [] apply [...] # ./mg-schema-update [] show # ./mg-schema-update [] apply-all -# ./mg-schema-update [] check-user # # Usual rune for applying updates: # @@ -53,6 +52,7 @@ use strict qw(vars); use DBI; +use Carp; BEGIN { unshift @INC, qw(.); } use Osstest; use Osstest::Executive; @@ -121,13 +121,6 @@ sub getstate () { @state = sort { $a->{Sortkey} <=> $b->{Sortkey} } values %state; } -sub check_user () { - my $user = $dbh_tests->{pg_user}; - my $re = $c{ExecutiveDbOwningRoleRegexp}; - return if $user =~ m/^$re$/o; - die "running as wrong user \`$user', expected to match \`$re'\n"; -} - sub cmd_list_applied () { die if @ARGV; getstate(); @@ -174,6 +167,56 @@ sub want_apply ($) { $v->{Todo} >= 2-$force; } +sub check_user () { + my $user = $dbh_tests->{pg_user}; + my ($map, $default) = roles_map(); + my $n = $map->{'osstest'} // $default; + my $wanted = + ($n eq '-' ? return : + $n eq '=' ? 'osstest' : + $n); + return if $user eq $wanted; + die "running as wrong user \`$user', expected \`$wanted'\n"; +} + +sub cmd_check_user () { + die "too many arguments\n" if @ARGV>0; + check_user(); +} + +sub roles_map () { + my $default; + my %map; + if ($c{ExecutiveDbOwningRoleMap} !~ m/,|.=/) { + $default = $c{ExecutiveDbOwningRoleMap}; + } else { + foreach my $kv (split m/,/, $c{ExecutiveDbOwningRoleMap}) { + my @kv = split m/=/, $kv; @kv == 2 or die; + my ($k, $v) = @kv; + grep { $_ eq $k } qw(osstest webflights) + or confess "bad NOM-ROLE $k"; + $map{$k} = $v; + } + $default = '='; + } + return (\%map, $default); +} + +sub map_roles ($) { + local ($_) = @_; + my ($map, $default) = roles_map(); + + s{^\@\s*SET ROLE\s+'?(\S+?)'?\s*\;\s*$}{ + my $n = $map->{$1} // $default; + ($n eq '-' ? "SET ROLE NONE;" : + $n eq '=' ? "SET ROLE '$1';" : + "SET ROLE '$n';") + }mge; + + #print STDERR ">$_<\n"; + return $_; +} + sub applyone ($) { my ($v) = @_; die "Will not apply $v->{Name}.sql: $v->{Msg}\n" @@ -195,7 +238,8 @@ sub applyone ($) { SET client_min_messages = warning; END - $dbh_tests->do($sql); + $dbh_tests->do(map_roles('@SET ROLE osstest;')); + $dbh_tests->do(map_roles($sql)); $dbh_tests->do(<{Name}, time); INSERT INTO schema_updates @@ -253,12 +297,6 @@ sub cmd_apply_all () { print "Appropriate updates applied.\n" unless $quiet; } -sub cmd_check_user () { - die "too many arguments\n" if @ARGV>1; - $c{ExecutiveDbOwningRoleRegexp} = shift @ARGV if @ARGV; - check_user(); -} - GetOptions('f|force+' => \$force, 'q+' => \$quiet, 'o|oldest=s' => \$there);