Add OWNER option to CREATE DATABASE, so superusers can create databases

on behalf of unprivileged users.  Also, make '=' optional in CREATE
DATABASE syntax.  From Gavin Sherry, with kibitzing and docs by Tom Lane.

diff --git a/doc/src/sgml/ref/create_database.sgml b/doc/src/sgml/ref/create_database.sgml
index 0c557ed49eb66d0074d6966c379536ff16eec66d..09a61d43649629834516872e9bfc610b2b08fe25 100644 (file)
--- a/doc/src/sgml/ref/create_database.sgml
+++ b/doc/src/sgml/ref/create_database.sgml
@@ -24,9 +24,10 @@ PostgreSQL documentation
   </refsynopsisdivinfo>
   <synopsis>
 CREATE DATABASE <replaceable class="PARAMETER">name</replaceable>
-    [ WITH [ LOCATION = '<replaceable class="parameter">dbpath</replaceable>' ]
-           [ TEMPLATE = <replaceable class="parameter">template</replaceable> ]
-           [ ENCODING = <replaceable class="parameter">encoding</replaceable> ] ]
+    [ WITH [ OWNER [ = ] <replaceable class="parameter">dbowner</replaceable> ]
+           [ LOCATION [ = ] '<replaceable class="parameter">dbpath</replaceable>' ]
+           [ TEMPLATE [ = ] <replaceable class="parameter">template</replaceable> ]
+           [ ENCODING [ = ] <replaceable class="parameter">encoding</replaceable> ] ]
   </synopsis>
 
   <refsect2 id="R2-SQL-CREATEDATABASE-1">
@@ -47,6 +48,16 @@ CREATE DATABASE <replaceable class="PARAMETER">name</replaceable>
        </para>
       </listitem>
      </varlistentry>
+     <varlistentry>
+      <term><replaceable class="parameter">dbowner</replaceable></term>
+      <listitem>
+       <para>
+        Name of the database user who will own the new database,
+       or <literal>DEFAULT</literal> to use the default (namely, the
+       user executing the command).
+       </para>
+      </listitem>
+     </varlistentry>
      <varlistentry>
       <term><replaceable class="parameter">dbpath</replaceable></term>
       <listitem>
@@ -171,7 +182,15 @@ CREATE DATABASE <replaceable class="PARAMETER">name</replaceable>
   <para>
    <command>CREATE DATABASE</command> creates a new
    <productname>PostgreSQL</productname> database.
-   The creator becomes the owner of the new database.
+  </para>
+
+  <para>
+   Normally, the creator becomes the owner of the new database.
+   A different owner may be specified by using the <option>OWNER</>
+   clause (but only superusers may create databases on behalf of other users).
+   To create a database owned by oneself, either superuser privilege
+   or CREATEDB privilege is required.  A superuser may create a database
+   for another user, even if that user has no special privileges himself.
   </para>
 
   <para>
@@ -327,7 +346,8 @@ Type:  \copyright for distribution terms
    </title>
    <para>
     There is no <command>CREATE DATABASE</command> statement in SQL92.
-    Databases are equivalent to catalogs whose creation is implementation-defined.
+    Databases are equivalent to catalogs, whose creation is
+    implementation-defined.
    </para>
   </refsect2>
  </refsect1>

diff --git a/doc/src/sgml/release.sgml b/doc/src/sgml/release.sgml
index 33e31600b7d49c9a81ed7da6dc06e0543732a842..6fcd3e7afdc3452b83461f5a21f6c8a3d417ec42 100644 (file)
--- a/doc/src/sgml/release.sgml
+++ b/doc/src/sgml/release.sgml
@@ -26,6 +26,7 @@ worries about funny characters.
 <literallayout><![CDATA[
 Access privileges on functions
 Access privileges on procedural languages
+CREATE DATABASE has OWNER option so superuser can create DB for someone else
 Kerberos 5 support now works with Heimdal
 ]]></literallayout>
 

diff --git a/src/backend/commands/dbcommands.c b/src/backend/commands/dbcommands.c
index ada0936676fc5928ceedeb221d46033647eb0262..282745e8e2e31faca97d497444db8c0de3874c84 100644 (file)
--- a/src/backend/commands/dbcommands.c
+++ b/src/backend/commands/dbcommands.c
@@ -34,6 +34,7 @@
 #include "storage/sinval.h"
 #include "utils/builtins.h"
 #include "utils/fmgroids.h"
+#include "utils/lsyscache.h"
 #include "utils/syscache.h"
 
 #ifdef MULTIBYTE
@@ -55,8 +56,9 @@ static bool remove_dbdirs(const char *real_loc, const char *altloc);
  */
 
 void
-createdb(const char *dbname, const char *dbpath,
-                const char *dbtemplate, int encoding)
+createdb(const char *dbname, const char *dbowner,
+                const char *dbpath, const char *dbtemplate,
+                int encoding)
 {
        char       *nominal_loc;
        char       *alt_loc;
@@ -79,12 +81,31 @@ createdb(const char *dbname, const char *dbpath,
        Datum           new_record[Natts_pg_database];
        char            new_record_nulls[Natts_pg_database];
        Oid                     dboid;
+       int32           datdba;
 
+       /* obtain sysid of proposed owner */
+       if (dbowner)
+               datdba = get_usesysid(dbowner); /* will elog if no such user */
+       else
+               datdba = GetUserId();
+
+       /* check permission to create database */
        if (!get_user_info(GetUserId(), &use_super, &use_createdb))
                elog(ERROR, "current user name is invalid");
 
-       if (!use_createdb && !use_super)
-               elog(ERROR, "CREATE DATABASE: permission denied");
+       if (datdba == (int32) GetUserId())
+       {
+               /* creating database for self: can be superuser or createdb */
+               if (!use_createdb && !use_super)
+                       elog(ERROR, "CREATE DATABASE: permission denied");
+       }
+       else
+       {
+               /* creating database for someone else: must be superuser */
+               /* note that the someone else need not have any permissions */
+               if (!use_super)
+                       elog(ERROR, "CREATE DATABASE: permission denied");
+       }
 
        /* don't call this in a transaction block */
        if (IsTransactionBlock())
@@ -254,7 +275,7 @@ createdb(const char *dbname, const char *dbpath,
        /* Form tuple */
        new_record[Anum_pg_database_datname - 1] =
                DirectFunctionCall1(namein, CStringGetDatum(dbname));
-       new_record[Anum_pg_database_datdba - 1] = Int32GetDatum(GetUserId());
+       new_record[Anum_pg_database_datdba - 1] = Int32GetDatum(datdba);
        new_record[Anum_pg_database_encoding - 1] = Int32GetDatum(encoding);
        new_record[Anum_pg_database_datistemplate - 1] = BoolGetDatum(false);
        new_record[Anum_pg_database_datallowconn - 1] = BoolGetDatum(true);

diff --git a/src/backend/nodes/copyfuncs.c b/src/backend/nodes/copyfuncs.c
index fb827e536d365542e2fdabcf0112ba66baaec951..ca501f9f5fd64fce1a19e44e32c271fea55dcc8a 100644 (file)
--- a/src/backend/nodes/copyfuncs.c
+++ b/src/backend/nodes/copyfuncs.c
@@ -2231,6 +2231,8 @@ _copyCreatedbStmt(CreatedbStmt *from)
 
        if (from->dbname)
                newnode->dbname = pstrdup(from->dbname);
+       if (from->dbowner)
+               newnode->dbowner = pstrdup(from->dbowner);
        if (from->dbpath)
                newnode->dbpath = pstrdup(from->dbpath);
        if (from->dbtemplate)

diff --git a/src/backend/nodes/equalfuncs.c b/src/backend/nodes/equalfuncs.c
index 9018324f5d3a35645a71e4ec807b5393e76eb7c7..d32ed0551c4c5bfb67a2195df3aea5bc974ddd5e 100644 (file)
--- a/src/backend/nodes/equalfuncs.c
+++ b/src/backend/nodes/equalfuncs.c
@@ -1099,6 +1099,8 @@ _equalCreatedbStmt(CreatedbStmt *a, CreatedbStmt *b)
 {
        if (!equalstr(a->dbname, b->dbname))
                return false;
+       if (!equalstr(a->dbowner, b->dbowner))
+               return false;
        if (!equalstr(a->dbpath, b->dbpath))
                return false;
        if (!equalstr(a->dbtemplate, b->dbtemplate))

diff --git a/src/backend/parser/gram.y b/src/backend/parser/gram.y
index 41e2627c1f860b8eabeb0383989a9efb1497e874..e15d12061686618e7f98c10da86265a9ffdec771 100644 (file)
--- a/src/backend/parser/gram.y
+++ b/src/backend/parser/gram.y
@@ -153,6 +153,7 @@ static void doNegateFloat(Value *v);
 %type <ival>    drop_behavior
 
 %type <list>   createdb_opt_list, createdb_opt_item
+%type <boolean>        opt_equal
 
 %type <ival>   opt_lock, lock_type
 %type <boolean>        opt_force, opt_or_replace
@@ -733,6 +734,7 @@ CreateSchemaStmt:  CREATE SCHEMA UserId
                                        /* for now, just make this the same as CREATE DATABASE */
                                        CreatedbStmt *n = makeNode(CreatedbStmt);
                                        n->dbname = $3;
+                                       n->dbowner = NULL;
                                        n->dbpath = NULL;
                                        n->dbtemplate = NULL;
                                        n->encoding = -1;
@@ -3049,6 +3051,7 @@ CreatedbStmt:  CREATE DATABASE database_name WITH createdb_opt_list
 
                                        n->dbname = $3;
                                        /* set default options */
+                                       n->dbowner = NULL;
                                        n->dbpath = NULL;
                                        n->dbtemplate = NULL;
                                        n->encoding = -1;
@@ -3068,6 +3071,9 @@ CreatedbStmt:  CREATE DATABASE database_name WITH createdb_opt_list
                                                        case 3:
                                                                n->encoding = lfirsti(lnext(optitem));
                                                                break;
+                                                       case 4:
+                                                               n->dbowner = (char *) lsecond(optitem);
+                                                               break;
                                                }
                                        }
                                        $$ = (Node *)n;
@@ -3076,6 +3082,7 @@ CreatedbStmt:  CREATE DATABASE database_name WITH createdb_opt_list
                                {
                                        CreatedbStmt *n = makeNode(CreatedbStmt);
                                        n->dbname = $3;
+                                       n->dbowner = NULL;
                                        n->dbpath = NULL;
                                        n->dbtemplate = NULL;
                                        n->encoding = -1;
@@ -3093,23 +3100,23 @@ createdb_opt_list:  createdb_opt_item
  * createdb_opt_item returns 2-element lists, with the first element
  * being an integer code to indicate which item was specified.
  */
-createdb_opt_item:  LOCATION '=' Sconst
+createdb_opt_item:  LOCATION opt_equal Sconst
                                {
                                        $$ = lconsi(1, makeList1($3));
                                }
-               | LOCATION '=' DEFAULT
+               | LOCATION opt_equal DEFAULT
                                {
                                        $$ = lconsi(1, makeList1(NULL));
                                }
-               | TEMPLATE '=' name
+               | TEMPLATE opt_equal name
                                {
                                        $$ = lconsi(2, makeList1($3));
                                }
-               | TEMPLATE '=' DEFAULT
+               | TEMPLATE opt_equal DEFAULT
                                {
                                        $$ = lconsi(2, makeList1(NULL));
                                }
-               | ENCODING '=' Sconst
+               | ENCODING opt_equal Sconst
                                {
                                        int             encoding;
 #ifdef MULTIBYTE
@@ -3123,7 +3130,7 @@ createdb_opt_item:  LOCATION '=' Sconst
 #endif
                                        $$ = lconsi(3, makeListi1(encoding));
                                }
-               | ENCODING '=' Iconst
+               | ENCODING opt_equal Iconst
                                {
 #ifdef MULTIBYTE
                                        if (!pg_get_enconv_by_encoding($3))
@@ -3134,12 +3141,23 @@ createdb_opt_item:  LOCATION '=' Sconst
 #endif
                                        $$ = lconsi(3, makeListi1($3));
                                }
-               | ENCODING '=' DEFAULT
+               | ENCODING opt_equal DEFAULT
                                {
                                        $$ = lconsi(3, makeListi1(-1));
                                }
+               | OWNER opt_equal name 
+                               {
+                                       $$ = lconsi(4, makeList1($3));
+                               }
+               | OWNER opt_equal DEFAULT
+                               {
+                                       $$ = lconsi(4, makeList1(NULL));
+                               }
                ;
 
+opt_equal: '='                                                         { $$ = TRUE; }
+               | /*EMPTY*/                                                     { $$ = FALSE; }
+               ;
 
 /*****************************************************************************
  *

diff --git a/src/backend/tcop/utility.c b/src/backend/tcop/utility.c
index 19a011a437b43c6e0fc4d99d6d17619bacc959ea..8aeeed2f36d223875916b48e1067435d95b0ebe2 100644 (file)
--- a/src/backend/tcop/utility.c
+++ b/src/backend/tcop/utility.c
@@ -624,8 +624,9 @@ ProcessUtility(Node *parsetree,
 
                                set_ps_display(commandTag = "CREATE DATABASE");
 
-                               createdb(stmt->dbname, stmt->dbpath,
-                                                stmt->dbtemplate, stmt->encoding);
+                               createdb(stmt->dbname, stmt->dbowner,
+                                                stmt->dbpath, stmt->dbtemplate,
+                                                stmt->encoding);
                        }
                        break;
 

diff --git a/src/include/commands/dbcommands.h b/src/include/commands/dbcommands.h
index c0819813e249977123a2ffb214459fad7f75801d..2a767fe653e29c6cb6c27ef6f6c4374cde77f341 100644 (file)
--- a/src/include/commands/dbcommands.h
+++ b/src/include/commands/dbcommands.h
@@ -14,8 +14,9 @@
 #ifndef DBCOMMANDS_H
 #define DBCOMMANDS_H
 
-extern void createdb(const char *dbname, const char *dbpath,
-                const char *dbtemplate, int encoding);
+extern void createdb(const char *dbname, const char *dbowner,
+                                        const char *dbpath, const char *dbtemplate,
+                                        int encoding);
 extern void dropdb(const char *dbname);
 
 #endif   /* DBCOMMANDS_H */

diff --git a/src/include/nodes/parsenodes.h b/src/include/nodes/parsenodes.h
index ac5fec13e9518a5b4a7df485d6f902f8a63e3cd2..9f91cbf3a66fd34e22d181d93483c2d6cc222998 100644 (file)
--- a/src/include/nodes/parsenodes.h
+++ b/src/include/nodes/parsenodes.h
@@ -679,6 +679,7 @@ typedef struct CreatedbStmt
 {
        NodeTag         type;
        char       *dbname;                     /* name of database to create */
+       char       *dbowner;            /* name of owner (NULL = default) */
        char       *dbpath;                     /* location of database (NULL = default) */
        char       *dbtemplate;         /* template to use (NULL = default) */
        int                     encoding;               /* MULTIBYTE encoding (-1 = use default) */