sepgsql: Enforce db_procedure:{execute} permission.

To do this, we add an additional object access hook type,
OAT_FUNCTION_EXECUTE.

KaiGai Kohei

1 files changed, 7 insertions, 0 deletions

diff --git a/contrib/sepgsql/hooks.c b/contrib/sepgsql/hooks.c
index 5faa1ea797..04c5120890 100644
--- a/contrib/sepgsql/hooks.c
+++ b/contrib/sepgsql/hooks.c
@@ -255,6 +255,13 @@ sepgsql_object_access(ObjectAccessType access,
 			}
 			break;
 
+		case OAT_FUNCTION_EXECUTE:
+			{
+				Assert(classId == ProcedureRelationId);
+				sepgsql_proc_execute(objectId);
+			}
+			break;
+
 		default:
 			elog(ERROR, "unexpected object access type: %d", (int) access);
 			break;