Thread: BUG #6422: User without any priviledges on a table can lock the table from other users in some cases

The following bug has been logged on the website:

Bug reference:      6422
Logged by:          Maxim Boguk
Email address:      maxim.boguk@gmail.com
PostgreSQL version: 9.1.2
Operating system:   Linux
Description:=20=20=20=20=20=20=20=20

Hi.

Unfortunately I was hit by that problem in the real project.

During active pg_dump (or any long transaction keeping lock on table), any
users with access to database can lock table from access, even if that user
have absolutely no rights on that table.

Test scenario:

1)CREATE ROLE dummy with login password 'something';

2)start pg_dump on database or any long transactions involving table news


3)now:
psql -U dummy -d testdb

=3D> SELECT * from news;
ERROR:  permission denied for relation news

That perfectly ok...

sports=3D> begin;
BEGIN
sports=3D> lock table news;
oops... table locked from everyone access untill canceled or pg_dump
finished=20

(and in realily - large web site down for 3 minute until my intervention).


The same can be done with any
alter table news ... ; statement.

Again I not sure is it an actual bug or feature. Seems Postgres trying to
put a lock on the table before check grants.

May be it's possible to check grants before set any heavy lock on the
table?

That behavior could be very troublesome in multi-user database environment.