Add check for mdb_service_auth role

Author: reshke

src/backend/catalog/aclchk.c

@@ -3392,7 +3392,7 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask,
 	 */
 	if (mask & ACL_SELECT && !(result & ACL_SELECT) &&
 		has_privs_of_role(roleid, mdb_read_all_data_oid) && 
-		!has_privs_of_unwanted_system_role(ownerId))
+		!has_privs_of_unwanted_system_role(ownerId, true))
 		result |= ACL_SELECT;
 
 	/*
@@ -3417,7 +3417,7 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask,
 	if (mask & (ACL_INSERT | ACL_UPDATE | ACL_DELETE) &&
 		!(result & (ACL_INSERT | ACL_UPDATE | ACL_DELETE)) &&
 		has_privs_of_role(roleid, mdb_write_all_data_oid) &&
-		!has_privs_of_unwanted_system_role(ownerId))
+		!has_privs_of_unwanted_system_role(ownerId, true))
 		result |= (mask & (ACL_INSERT | ACL_UPDATE | ACL_DELETE));
 
 	/*

src/backend/utils/adt/acl.c

@@ -5337,7 +5337,9 @@ has_privs_of_role_strict_no_cache(Oid member, Oid role)
 */
 
 bool
-has_privs_of_unwanted_system_role(Oid role) {
+has_privs_of_unwanted_system_role(Oid role, bool check_mdb_service_auth) {
+	Oid mdb_service_authoid;
+
 	if (has_privs_of_role_strict(role, ROLE_PG_READ_SERVER_FILES)) {
 		return true;
 	}
@@ -5354,6 +5356,14 @@ has_privs_of_unwanted_system_role(Oid role) {
 		return true;
 	}
 
+	if (check_mdb_service_auth) {
+		mdb_service_authoid = get_role_oid("mdb_service_auth", true);
+
+		if (has_privs_of_role_strict(role, mdb_service_authoid)) {
+			return true;
+		}
+	}
+
 	return false;
 }
 
@@ -5400,7 +5410,7 @@ has_privs_of_role(Oid member, Oid role)
 			* if target role is neither superuser nor
 			* some dangerous system role
 			*/
-			if (!has_privs_of_unwanted_system_role(role)) {
+			if (!has_privs_of_unwanted_system_role(role, true)) {
 				return true;
 			}
 		}
@@ -5455,7 +5465,7 @@ mdb_admin_allow_bypass_owner_checks(Oid userId,  Oid ownerId)
 	*/
 
 	/* All checks passed, hope will not be hacked here (again) */
-	return !has_privs_of_unwanted_system_role(ownerId);
+	return !has_privs_of_unwanted_system_role(ownerId, true);
 }
 
 // -- non-upstream patch end
@@ -5534,7 +5544,7 @@ check_mdb_admin_is_member_of_role(Oid member, Oid role)
 							GetUserNameFromId(role, false))));
 		}
 
-		if (has_privs_of_unwanted_system_role(role)) {			
+		if (has_privs_of_unwanted_system_role(role, true)) {			
 			ereport(ERROR,
 					(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
 					errmsg("forbidden to transfer ownership to this system role in Cloud")));
@@ -5568,7 +5578,7 @@ bool mdb_admin_is_member_of_role(Oid member, Oid role) {
 		return false;
 	}
 
-	return !has_privs_of_unwanted_system_role(role);
+	return !has_privs_of_unwanted_system_role(role, true);
 }
 
 // -- mdb admin patch 

src/include/utils/acl.h

@@ -231,7 +231,7 @@ extern bool mdb_admin_is_member_of_role(Oid member, Oid role);
 extern Oid	select_best_admin(Oid member, Oid role);
 extern Oid	get_role_oid(const char *rolname, bool missing_ok);
 extern Oid	get_role_oid_or_public(const char *rolname);
-extern bool has_privs_of_unwanted_system_role(Oid role);
+extern bool has_privs_of_unwanted_system_role(Oid role, bool check_mdb_service_auth);
 extern Oid	get_rolespec_oid(const RoleSpec *role, bool missing_ok);
 extern void check_rolespec_name(const RoleSpec *role, const char *detail_msg);
 extern HeapTuple get_rolespec_tuple(const RoleSpec *role);