使用非超级用户帐户获取大对象的实际数据

Question

Environment : PostgreSQL 9.1

Prior to pg 9.0 , getting the actual data of a large object TEXT field can be done by selecting the corresponding record from the pg_largeobject table . But since pg 9.0 , non-superuser does not allow to access this table anymore.

However, by using hibernate ,the same non-superuser account can access the actual data of this TEXT field .So I believe using non-superuser account can also "SELECT" the actual content of this TEXT field. How can I do it?

As suggested by Craig , I turn on log collection by setting log_statement = 'all' and the related log are :

SELECT p.proname,p.oid  
FROM pg_catalog.pg_proc p, pg_catalog.pg_namespace n  
WHERE p.pronamespace=n.oid AND n.nspname='pg_catalog' 
AND ( proname = 'lo_open' or proname = 'lo_close' or proname = 'lo_creat' or proname = 'lo_unlink' 
or proname = 'lo_lseek' or proname = 'lo_tell' or proname = 'loread' or proname = 'lowrite'
 or proname = 'lo_truncate')

2012-08-31 09:27:05 HKT LOG:  fastpath function call: "lo_open" (OID 952)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "lo_open" (OID 952)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "lo_lseek" (OID 956)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "lo_tell" (OID 958)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "lo_lseek" (OID 956)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "lo_tell" (OID 958)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "lo_lseek" (OID 956)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "loread" (OID 954)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "loread" (OID 954)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "loread" (OID 954)
2012-08-31 09:27:05 HKT LOG:  fastpath function call: "lo_close" (OID 953)

It calls several lo_XXX() functions but I have no idea how to make it as a PL/pgSQL function such that I can simply call it in the select statement .

Thanks.

Answer 1

Why not have a look at what Hibernate is doing?

In postgresql.conf set log_statement = 'all' and reload or restart PostgreSQL. Re-run your test in Hibernate and see what's going on.

At a guess I'd say Hibernate is using the large object client interfaces, specifically PgJDBC's large object support . Alternately it might be using the JDBC-standard clob/blob interfaces to access the data.

Answer 2

Reading the documentation about large objects I encountered the answer to your question: lo_compat_privileges, which is a variable in postgresql.conf. This variable can have the values on or off. Default is off, on is what you were expecting. With the default value performs Postgresql security checks, which were not existing prior to version 9.0. If this variable has the value 'on' are the majority of the new security checks not performed: http://www.postgresql.org/docs/9.2/static/runtime-config-compatible.html#GUC-LO-COMPAT-PRIVILEGES .

The security checks are there to stay in postgresql, hence will the best solution to let the new security checks be enabled and work with GRANT options.

With kind regards,

Loek