@@ -1528,6 +1528,7 @@ def test_backup_with_least_privileges_role(self):
15281528 'postgres' ,
15291529 'CREATE DATABASE backupdb' )
15301530
1531+ # PG 9.5
15311532 if self .get_version (node ) < 90600 :
15321533 node .safe_psql (
15331534 'backupdb' ,
@@ -1559,6 +1560,43 @@ def test_backup_with_least_privileges_role(self):
15591560 "GRANT EXECUTE ON FUNCTION pg_catalog.txid_current_snapshot() TO backup; "
15601561 "GRANT EXECUTE ON FUNCTION pg_catalog.txid_snapshot_xmax(txid_snapshot) TO backup;"
15611562 )
1563+ # PG 9.6
1564+ elif self .get_version (node ) > 90600 and self .get_version (node ) < 100000 :
1565+ node .safe_psql (
1566+ 'backupdb' ,
1567+ "REVOKE ALL ON DATABASE backupdb from PUBLIC; "
1568+ "REVOKE ALL ON SCHEMA public from PUBLIC; "
1569+ "REVOKE ALL ON ALL TABLES IN SCHEMA public FROM PUBLIC; "
1570+ "REVOKE ALL ON ALL FUNCTIONS IN SCHEMA public FROM PUBLIC; "
1571+ "REVOKE ALL ON ALL SEQUENCES IN SCHEMA public FROM PUBLIC; "
1572+ "REVOKE ALL ON SCHEMA pg_catalog from PUBLIC; "
1573+ "REVOKE ALL ON ALL TABLES IN SCHEMA pg_catalog FROM PUBLIC; "
1574+ "REVOKE ALL ON ALL FUNCTIONS IN SCHEMA pg_catalog FROM PUBLIC; "
1575+ "REVOKE ALL ON ALL SEQUENCES IN SCHEMA pg_catalog FROM PUBLIC; "
1576+ "REVOKE ALL ON SCHEMA information_schema from PUBLIC; "
1577+ "REVOKE ALL ON ALL TABLES IN SCHEMA information_schema FROM PUBLIC; "
1578+ "REVOKE ALL ON ALL FUNCTIONS IN SCHEMA information_schema FROM PUBLIC; "
1579+ "REVOKE ALL ON ALL SEQUENCES IN SCHEMA information_schema FROM PUBLIC; "
1580+ "CREATE ROLE backup WITH LOGIN REPLICATION; "
1581+ "GRANT CONNECT ON DATABASE backupdb to backup; "
1582+ "GRANT USAGE ON SCHEMA pg_catalog TO backup; "
1583+ "GRANT SELECT ON TABLE pg_catalog.pg_proc TO backup; "
1584+ "GRANT SELECT ON TABLE pg_catalog.pg_database TO backup; " # for partial restore, checkdb and ptrack
1585+ "GRANT EXECUTE ON FUNCTION pg_catalog.nameeq(name, name) TO backup; "
1586+ "GRANT EXECUTE ON FUNCTION pg_catalog.textout(text) TO backup; "
1587+ "GRANT EXECUTE ON FUNCTION pg_catalog.timestamptz(timestamp with time zone, integer) TO backup; "
1588+ "GRANT EXECUTE ON FUNCTION pg_catalog.current_setting(text) TO backup; "
1589+ "GRANT EXECUTE ON FUNCTION pg_catalog.pg_is_in_recovery() TO backup; "
1590+ "GRANT EXECUTE ON FUNCTION pg_catalog.pg_control_system() TO backup; "
1591+ "GRANT EXECUTE ON FUNCTION pg_catalog.pg_start_backup(text, boolean, boolean) TO backup; "
1592+ "GRANT EXECUTE ON FUNCTION pg_catalog.pg_stop_backup(boolean) TO backup; "
1593+ "GRANT EXECUTE ON FUNCTION pg_catalog.pg_create_restore_point(text) TO backup; "
1594+ "GRANT EXECUTE ON FUNCTION pg_catalog.pg_switch_xlog() TO backup; "
1595+ "GRANT EXECUTE ON FUNCTION pg_catalog.pg_last_xlog_replay_location() TO backup; "
1596+ "GRANT EXECUTE ON FUNCTION pg_catalog.txid_current_snapshot() TO backup; "
1597+ "GRANT EXECUTE ON FUNCTION pg_catalog.txid_snapshot_xmax(txid_snapshot) TO backup;"
1598+ )
1599+ # >= 10
15621600 else :
15631601 node .safe_psql (
15641602 'backupdb' ,
@@ -1595,17 +1633,18 @@ def test_backup_with_least_privileges_role(self):
15951633
15961634 if self .ptrack :
15971635 for fname in [
1598- 'oideq(oid, oid)' ,
1599- 'ptrack_version()' ,
1600- 'pg_ptrack_clear()' ,
1601- 'pg_ptrack_control_lsn()' ,
1602- 'pg_ptrack_get_and_clear_db(oid, oid)' ,
1603- 'pg_ptrack_get_and_clear(oid, oid)' ,
1604- 'pg_ptrack_get_block_2(oid, oid, oid, bigint)' ]:
1636+ 'pg_catalog.oideq(oid, oid)' ,
1637+ 'pg_catalog.ptrack_version()' ,
1638+ 'pg_catalog.pg_ptrack_clear()' ,
1639+ 'pg_catalog.pg_ptrack_control_lsn()' ,
1640+ 'pg_catalog.pg_ptrack_get_and_clear_db(oid, oid)' ,
1641+ 'pg_catalog.pg_ptrack_get_and_clear(oid, oid)' ,
1642+ 'pg_catalog.pg_ptrack_get_block_2(oid, oid, oid, bigint)' ,
1643+ 'pg_catalog.pg_stop_backup()' ]:
16051644 # try:
16061645 node .safe_psql (
16071646 "backupdb" ,
1608- "GRANT EXECUTE ON FUNCTION pg_catalog. {0} "
1647+ "GRANT EXECUTE ON FUNCTION {0} "
16091648 "TO backup" .format (fname ))
16101649 # except:
16111650 # pass
0 commit comments