pax_global_header00006660000000000000000000000064147554273240014527gustar00rootroot0000000000000052 comment=538f89a93d8fd0d8913f3d740cacaea7b7eb66d9 pgaudit-17.1/000077500000000000000000000000001475542732400131145ustar00rootroot00000000000000pgaudit-17.1/.editorconfig000066400000000000000000000003021475542732400155640ustar00rootroot00000000000000root = true [*] indent_style = space indent_size = 4 end_of_line = lf charset = utf-8 trim_trailing_whitespace = true insert_final_newline = true [Makefile] indent_style = tab indent_size = 4 pgaudit-17.1/.github/000077500000000000000000000000001475542732400144545ustar00rootroot00000000000000pgaudit-17.1/.github/workflows/000077500000000000000000000000001475542732400165115ustar00rootroot00000000000000pgaudit-17.1/.github/workflows/test.yml000066400000000000000000000015251475542732400202160ustar00rootroot00000000000000name: test on: push: branches: - integration - '**_INTEGRATION' - '**-ci' pull_request: jobs: test: runs-on: ubuntu-22.04 strategy: # Let all the jobs run to completion even if one fails fail-fast: false # Test matrix matrix: include: # Debian - image: debian # RHEL - image: rhel steps: - name: Checkout Code uses: actions/checkout@v4 with: path: pgaudit - name: Build Test Container run: docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g) -f ${GITHUB_WORKSPACE?}/pgaudit/test/Dockerfile.${{matrix.image}} -t pgaudit-test ${GITHUB_WORKSPACE?}/pgaudit - name: Run Test run: docker run -v ${GITHUB_WORKSPACE?}/pgaudit:/pgaudit pgaudit-test /pgaudit/test/test.sh pgaudit-17.1/.gitignore000066400000000000000000000004021475542732400151000ustar00rootroot00000000000000# Regression tests log/ results/ tmp_check/ regression.diffs regression.out # Coverage files *.gcno *.gcda # Libraries *.lib *.a # LLVM bitcode *.bc # Object files *.o # Shared objects (inc. Windows DLLs) *.dll *.so *.so.* *.dylib # Dependencies .deps pgaudit-17.1/LICENSE000066400000000000000000000002531475542732400141210ustar00rootroot00000000000000This code is released under the PostgreSQL licence, as given at http://www.postgresql.org/about/licence/ Copyright is novated to the PostgreSQL Global Development Group. pgaudit-17.1/Makefile000066400000000000000000000011201475542732400145460ustar00rootroot00000000000000# contrib/pg_audit/Makefile MODULE_big = pgaudit OBJS = pgaudit.o $(WIN32RES) EXTENSION = pgaudit DATA = pgaudit--17.1.sql pgaudit--17.0--17.1.sql PGFILEDESC = "pgAudit - An audit logging extension for PostgreSQL" REGRESS = pgaudit REGRESS_OPTS = --temp-config=$(top_srcdir)/contrib/pgaudit/pgaudit.conf ifdef USE_PGXS PG_CONFIG = pg_config PGXS := $(shell $(PG_CONFIG) --pgxs) include $(PGXS) else subdir = contrib/pgaudit top_builddir = ../.. include $(top_builddir)/src/Makefile.global include $(top_srcdir)/contrib/contrib-global.mk endif EXTRA_INSTALL += contrib/pg_stat_statements pgaudit-17.1/README.md000066400000000000000000000446561475542732400144120ustar00rootroot00000000000000# pgAudit
Open Source PostgreSQL Audit Logging ## Introduction The PostgreSQL Audit Extension (pgAudit) provides detailed session and/or object audit logging via the standard PostgreSQL logging facility. The goal of the pgAudit is to provide PostgreSQL users with capability to produce audit logs often required to comply with government, financial, or ISO certifications. An audit is an official inspection of an individual's or organization's accounts, typically by an independent body. The information gathered by pgAudit is properly called an audit trail or audit log. The term audit log is used in this documentation. ## Why pgAudit? Basic statement logging can be provided by the standard logging facility with `log_statement = all`. This is acceptable for monitoring and other usages but does not provide the level of detail generally required for an audit. It is not enough to have a list of all the operations performed against the database. It must also be possible to find particular statements that are of interest to an auditor. The standard logging facility shows what the user requested, while pgAudit focuses on the details of what happened while the database was satisfying the request. For example, an auditor may want to verify that a particular table was created inside a documented maintenance window. This might seem like a simple job for grep, but what if you are presented with something like this (intentionally obfuscated) example: ``` DO $$ BEGIN EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)'; END $$; ``` Standard logging will give you this: ``` LOG: statement: DO $$ BEGIN EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)'; END $$; ``` It appears that finding the table of interest may require some knowledge of the code in cases where tables are created dynamically. This is not ideal since it would be preferable to just search on the table name. This is where pgAudit comes in. For the same input, it will produce this output in the log: ``` AUDIT: SESSION,33,1,FUNCTION,DO,,,"DO $$ BEGIN EXECUTE 'CREATE TABLE import' || 'ant_table (id INT)'; END $$;" AUDIT: SESSION,33,2,DDL,CREATE TABLE,TABLE,public.important_table,CREATE TABLE important_table (id INT) ``` Not only is the `DO` block logged, but substatement 2 contains the full text of the `CREATE TABLE` with the statement type, object type, and full-qualified name to make searches easy. When logging `SELECT` and `DML` statements, pgAudit can be configured to log a separate entry for each relation referenced in a statement. No parsing is required to find all statements that touch a particular table. In fact, the goal is that the statement text is provided primarily for deep forensics and should not be required for an audit. ## Usage Considerations Depending on settings, it is possible for pgAudit to generate an enormous volume of logging. Be careful to determine exactly what needs to be audit logged in your environment to avoid logging too much. For example, when working in an OLAP environment it would probably not be wise to audit log inserts into a large fact table. The size of the log file will likely be many times the actual data size of the inserts because the log file is expressed as text. Since logs are generally stored with the OS this may lead to disk space being exhausted very quickly. In cases where it is not possible to limit audit logging to certain tables, be sure to assess the performance impact while testing and allocate plenty of space on the log volume. This may also be true for OLTP environments. Even if the insert volume is not as high, the performance impact of audit logging may still noticeably affect latency. To limit the number of relations audit logged for `SELECT` and `DML` statements, consider using object audit logging (see [Object Auditing](#object-audit-logging)). Object audit logging allows selection of the relations to be logged allowing for reduction of the overall log volume. However, when new relations are added they must be explicitly added to object audit logging. A programmatic solution where specified tables are excluded from logging and all others are included may be a good option in this case. ## PostgreSQL Version Compatibility pgAudit supports PostgreSQL 12 or greater. In order to support new functionality introduced in each PostgreSQL release, pgAudit maintains a separate branch for each PostgreSQL major version (currently PostgreSQL 12 - 17) which will be maintained in a manner similar to the PostgreSQL project. Aside from bug fixes, no further development is allowed for stable branches. New development, if any, will be strictly for the next unreleased major version of PostgreSQL. pgAudit versions relate to PostgreSQL major versions as follows: - **pgAudit v17.X** is intended to support PostgreSQL 17. - **pgAudit v16.X** is intended to support PostgreSQL 16. - **pgAudit v1.7.X** is intended to support PostgreSQL 15. - **pgAudit v1.6.X** is intended to support PostgreSQL 14. - **pgAudit v1.5.X** is intended to support PostgreSQL 13. - **pgAudit v1.4.X** is intended to support PostgreSQL 12. ## Compile and Install pgAudit can be compiled against an installed copy of PostgreSQL with development packages using `PGXS`. The following instructions are for RHEL 7. Clone the pgAudit extension: ``` git clone https://github.com/pgaudit/pgaudit.git ``` Change to pgAudit directory: ``` cd pgaudit ``` Checkout `REL_17_STABLE` branch (note that the stable branch may not exist for unreleased versions of PostgreSQL): ``` git checkout REL_17_STABLE ``` Build and install pgAudit: ``` make install USE_PGXS=1 PG_CONFIG=/usr/pgsql-17/bin/pg_config ``` Instructions for testing and development may be found in `test`. ## Settings Settings may be modified only by a superuser. Allowing normal users to change their settings would defeat the point of an audit log. Settings can be specified globally (in `postgresql.conf` or using `ALTER SYSTEM ... SET`), at the database level (using `ALTER DATABASE ... SET`), or at the role level (using `ALTER ROLE ... SET`). Note that settings are not inherited through normal role inheritance and `SET ROLE` will not alter a user's pgAudit settings. This is a limitation of the roles system and not inherent to pgAudit. The pgAudit extension must be loaded in [shared_preload_libraries](http://www.postgresql.org/docs/17/runtime-config-client.html#GUC-SHARED-PRELOAD-LIBRARIES). Otherwise, an error will be raised at load time and no audit logging will occur. In addition, `CREATE EXTENSION pgaudit` must be called before `pgaudit.log` is set to ensure proper pgaudit functionality. The extension installs event triggers which add additional auditing for DDL. pgAudit will work without the extension installed but DDL statements will not have information about the object type and name. If the `pgaudit` extension is dropped and needs to be recreated then `pgaudit.log` must be unset first otherwise an error will be raised. ### pgaudit.log Specifies which classes of statements will be logged by session audit logging. Possible values are: - **READ**: `SELECT` and `COPY` when the source is a relation or a query. - **WRITE**: `INSERT`, `UPDATE`, `DELETE`, `TRUNCATE`, and `COPY` when the destination is a relation. - **FUNCTION**: Function calls and `DO` blocks. - **ROLE**: Statements related to roles and privileges: `GRANT`, `REVOKE`, `CREATE/ALTER/DROP ROLE`. - **DDL**: All `DDL` that is not included in the `ROLE` class. - **MISC**: Miscellaneous commands, e.g. `DISCARD`, `FETCH`, `CHECKPOINT`, `VACUUM`, `SET`. - **MISC_SET**: Miscellaneous `SET` commands, e.g. `SET ROLE`. - **ALL**: Include all of the above. Multiple classes can be provided using a comma-separated list and classes can be subtracted by prefacing the class with a `-` sign (see [Session Audit Logging](#session-audit-logging)). The default is `none`. ### pgaudit.log_catalog Specifies that session logging should be enabled in the case where all relations in a statement are in pg_catalog. Disabling this setting will reduce noise in the log from tools like psql and PgAdmin that query the catalog heavily. The default is `on`. ### pgaudit.log_client Specifies whether log messages will be visible to a client process such as psql. This setting should generally be left disabled but may be useful for debugging or other purposes. Note that `pgaudit.log_level` is only enabled when `pgaudit.log_client` is `on`. The default is `off`. ### pgaudit.log_level Specifies the log level that will be used for log entries (see [Message Severity Levels](http://www.postgresql.org/docs/17/runtime-config-logging.html#RUNTIME-CONFIG-SEVERITY-LEVELS) for valid levels) but note that `ERROR`, `FATAL`, and `PANIC` are not allowed). This setting is used for regression testing and may also be useful to end users for testing or other purposes. Note that `pgaudit.log_level` is only enabled when `pgaudit.log_client` is `on`; otherwise the default will be used. The default is `log`. ### pgaudit.log_parameter Specifies that audit logging should include the parameters that were passed with the statement. When parameters are present they will be included in `CSV` format after the statement text. The default is `off`. ### pgaudit.log_parameter_max_size Specifies that parameter values longer than this setting (in bytes) should not be logged, but replaced with ``. This is set in bytes, not characters, so does not account for multi-byte characters in a text parameters's encoding. This setting has no effect if `log_parameter` is `off`. If this setting is 0 (the default), all parameters are logged regardless of length The default is `0`. ### pgaudit.log_relation Specifies whether session audit logging should create a separate log entry for each relation (`TABLE`, `VIEW`, etc.) referenced in a `SELECT` or `DML` statement. This is a useful shortcut for exhaustive logging without using object audit logging. The default is `off`. ### pgaudit.log_rows Specifies that audit logging should include the number of rows retrieved or affected by a statement. When enabled the rows field will be included after the parameter field. The default is `off`. ### pgaudit.log_statement Specifies whether logging will include the statement text and parameters (if enabled). Depending on requirements, an audit log might not require this and it makes the logs less verbose. The default is `on`. ### pgaudit.log_statement_once Specifies whether logging will include the statement text and parameters with the first log entry for a statement/substatement combination or with every entry. Enabling this setting will result in less verbose logging but may make it more difficult to determine the statement that generated a log entry, though the statement/substatement pair along with the process id should suffice to identify the statement text logged with a previous entry. The default is `off`. ### pgaudit.role Specifies the master role to use for object audit logging. Multiple audit roles can be defined by granting them to the master role. This allows multiple groups to be in charge of different aspects of audit logging. There is no default. ## Session Audit Logging Session audit logging provides detailed logs of all statements executed by a user in the backend. ### Configuration Session logging is enabled with the [pgaudit.log](#pgauditlog) setting. Enable session logging for all `DML` and `DDL` and log all relations in `DML` statements: ``` set pgaudit.log = 'write, ddl'; set pgaudit.log_relation = on; ``` Enable session logging for all commands except `MISC` and raise audit log messages as `NOTICE`: ``` set pgaudit.log = 'all, -misc'; set pgaudit.log_level = notice; ``` ### Example In this example session audit logging is used for logging `DDL` and `SELECT` statements. Note that the insert statement is not logged since the `WRITE` class is not enabled _SQL_: ``` set pgaudit.log = 'read, ddl'; create table account ( id int, name text, password text, description text ); insert into account (id, name, password, description) values (1, 'user1', 'HASH1', 'blah, blah'); select * from account; ``` _Log Output_: ``` AUDIT: SESSION,1,1,DDL,CREATE TABLE,TABLE,public.account,create table account ( id int, name text, password text, description text );, AUDIT: SESSION,2,1,READ,SELECT,,,select * from account,, ``` ## Object Audit Logging Object audit logging logs statements that affect a particular relation. Only `SELECT`, `INSERT`, `UPDATE` and `DELETE` commands are supported. `TRUNCATE` is not included in object audit logging. Object audit logging is intended to be a finer-grained replacement for `pgaudit.log = 'read, write'`. As such, it may not make sense to use them in conjunction but one possible scenario would be to use session logging to capture each statement and then supplement that with object logging to get more detail about specific relations. ### Configuration Object-level audit logging is implemented via the roles system. The [pgaudit.role](#pgauditrole) setting defines the role that will be used for audit logging. A relation (`TABLE`, `VIEW`, etc.) will be audit logged when the audit role has permissions for the command executed or inherits the permissions from another role. This allows you to effectively have multiple audit roles even though there is a single master role in any context. Set [pgaudit.role](#pgauditrole) to `auditor` and grant `SELECT` and `DELETE` privileges on the `account` table. Any `SELECT` or `DELETE` statements on the `account` table will now be logged: ``` set pgaudit.role = 'auditor'; grant select, delete on public.account to auditor; ``` ### Example In this example object audit logging is used to illustrate how a granular approach may be taken towards logging of `SELECT` and `DML` statements. Note that logging on the `account` table is controlled by column-level permissions, while logging on the `account_role_map` table is table-level. _SQL_: ``` set pgaudit.role = 'auditor'; create table account ( id int, name text, password text, description text ); grant select (password) on public.account to auditor; select id, name from account; select password from account; grant update (name, password) on public.account to auditor; update account set description = 'yada, yada'; update account set password = 'HASH2'; create table account_role_map ( account_id int, role_id int ); grant select on public.account_role_map to auditor; select account.password, account_role_map.role_id from account inner join account_role_map on account.id = account_role_map.account_id ``` _Log Output_: ``` AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.account,select password from account, AUDIT: OBJECT,2,1,WRITE,UPDATE,TABLE,public.account,update account set password = 'HASH2', AUDIT: OBJECT,3,1,READ,SELECT,TABLE,public.account,select account.password, account_role_map.role_id from account inner join account_role_map on account.id = account_role_map.account_id, AUDIT: OBJECT,3,1,READ,SELECT,TABLE,public.account_role_map,select account.password, account_role_map.role_id from account inner join account_role_map on account.id = account_role_map.account_id, ``` ## Format Audit entries are written to the standard logging facility and contain the following columns in comma-separated format. Output is compliant CSV format only if the log line prefix portion of each log entry is removed. - **AUDIT_TYPE** - `SESSION` or `OBJECT`. - **STATEMENT_ID** - Unique statement ID for this session. Each statement ID represents a backend call. Statement IDs are sequential even if some statements are not logged. There may be multiple entries for a statement ID when more than one relation is logged. - **SUBSTATEMENT_ID** - Sequential ID for each sub-statement within the main statement. For example, calling a function from a query. Sub-statement IDs are continuous even if some sub-statements are not logged. There may be multiple entries for a sub-statement ID when more than one relation is logged. - **CLASS** - e.g. `READ`, `ROLE` (see [pgaudit.log](#pgauditlog)). - **COMMAND** - e.g. `ALTER TABLE`, `SELECT`. - **OBJECT_TYPE** - `TABLE`, `INDEX`, `VIEW`, etc. Available for `SELECT`, `DML` and most `DDL` statements. - **OBJECT_NAME** - The fully-qualified object name (e.g. public.account). Available for `SELECT`, `DML` and most `DDL` statements. - **STATEMENT** - Statement executed on the backend. - **PARAMETER** - If `pgaudit.log_parameter` is set then this field will contain the statement parameters as quoted CSV or `` if there are no parameters. Otherwise, the field is ``. Use [log_line_prefix](http://www.postgresql.org/docs/17/runtime-config-logging.html#GUC-LOG-LINE-PREFIX) to add any other fields that are needed to satisfy your audit log requirements. A typical log line prefix might be `'%m %u %d [%p]: '` which would provide the date/time, user name, database name, and process id for each audit log. ## Caveats Object renames are logged under the name they were renamed to. For example, renaming a table will produce the following result: ``` ALTER TABLE test RENAME TO test2; AUDIT: SESSION,36,1,DDL,ALTER TABLE,TABLE,public.test2,ALTER TABLE test RENAME TO test2, ``` It is possible to have a command logged more than once. For example, when a table is created with a primary key specified at creation time the index for the primary key will be logged independently and another audit log will be made for the index under the create entry. The multiple entries will however be contained within one statement ID. Autovacuum and Autoanalyze are not logged. Statements that are executed after a transaction enters an aborted state will not be audit logged. However, the statement that caused the error and any subsequent statements executed in the aborted transaction will be logged as ERRORs by the standard logging facility. It is not possible to reliably audit superusers with pgAudit. One solution is to restrict access to superuser accounts and use the [set_user](https://github.com/pgaudit/set_user) extension to escalate permissions when required. ## Authors The PostgreSQL Audit Extension is based on the [2ndQuadrant](http://www.2ndquadrant.com) [pgaudit project](https://github.com/2ndQuadrant/pgaudit) authored by Simon Riggs, Abhijit Menon-Sen, and Ian Barwick and submitted as an extension to PostgreSQL core. Additional development has been done by David Steele of [Crunchy Data](http://www.crunchydata.com). pgaudit-17.1/expected/000077500000000000000000000000001475542732400147155ustar00rootroot00000000000000pgaudit-17.1/expected/pgaudit.out000066400000000000000000002411341475542732400171100ustar00rootroot00000000000000\set VERBOSITY terse -- Create pgaudit extension CREATE EXTENSION IF NOT EXISTS pgaudit; -- Grant all on public schema to public GRANT ALL ON SCHEMA public TO public; -- Make sure events don't get logged twice when session logging SET pgaudit.log = 'all'; SET pgaudit.log_client = ON; SET pgaudit.log_level = 'notice'; NOTICE: AUDIT: SESSION,3,1,MISC,SET,,,SET pgaudit.log_level = 'notice', CREATE TABLE tmp (id int, data text); NOTICE: AUDIT: SESSION,4,1,DDL,CREATE TABLE,TABLE,public.tmp,"CREATE TABLE tmp (id int, data text)", CREATE TABLE tmp2 AS (SELECT * FROM tmp); NOTICE: AUDIT: SESSION,5,1,READ,SELECT,,,CREATE TABLE tmp2 AS (SELECT * FROM tmp), NOTICE: AUDIT: SESSION,5,2,DDL,CREATE TABLE AS,TABLE,public.tmp2,CREATE TABLE tmp2 AS (SELECT * FROM tmp), -- Reset log_client first to show that audits logs are not set to client RESET pgaudit.log_client; DROP TABLE tmp; DROP TABLE tmp2; RESET pgaudit.log; RESET pgaudit.log_level; -- -- Audit log fields are: -- AUDIT_TYPE - SESSION or OBJECT -- STATEMENT_ID - ID of the statement in the current backend -- SUBSTATEMENT_ID - ID of the substatement in the current backend -- CLASS - Class of statement being logged (e.g. ROLE, READ, WRITE) -- COMMAND - e.g. SELECT, CREATE ROLE, UPDATE -- OBJECT_TYPE - When available, type of object acted on (e.g. TABLE, VIEW) -- OBJECT_NAME - When available, fully-qualified table of object -- STATEMENT - The statement being logged -- PARAMETER - If parameter logging is requested, they will follow the -- statement -- ROWS - If rows logging is requested, they will follow the parameter SELECT current_user \gset -- -- Set pgaudit parameters for the current (super)user. ALTER ROLE :current_user SET pgaudit.log = 'Role'; ALTER ROLE :current_user SET pgaudit.log_level = 'notice'; ALTER ROLE :current_user SET pgaudit.log_client = ON; \connect - :current_user; -- -- Create auditor role CREATE ROLE regress_auditor; NOTICE: AUDIT: SESSION,1,1,ROLE,CREATE ROLE,,,CREATE ROLE regress_auditor, -- -- Create first test user CREATE USER regress_user1 password 'password'; NOTICE: AUDIT: SESSION,2,1,ROLE,CREATE ROLE,,,CREATE USER regress_user1 password , ALTER ROLE regress_user1 SET pgaudit.log = 'ddl, ROLE'; NOTICE: AUDIT: SESSION,3,1,ROLE,ALTER ROLE,,,"ALTER ROLE regress_user1 SET pgaudit.log = 'ddl, ROLE'", ALTER ROLE regress_user1 SET pgaudit.log_level = 'notice'; NOTICE: AUDIT: SESSION,4,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 SET pgaudit.log_level = 'notice', ALTER ROLE regress_user1 PassWord 'password2' NOLOGIN; NOTICE: AUDIT: SESSION,5,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 PassWord , ALTER USER regress_user1 encrypted /* random comment */PASSWORD /* random comment */ 'md565cb1da342495ea6bb0418a6e5718c38' LOGIN; NOTICE: AUDIT: SESSION,6,1,ROLE,ALTER ROLE,,,ALTER USER regress_user1 encrypted /* random comment */PASSWORD , ALTER ROLE regress_user1 SET pgaudit.log_client = ON; NOTICE: AUDIT: SESSION,7,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 SET pgaudit.log_client = ON, -- -- Create, select, drop (select will not be audited) \connect - regress_user1 CREATE TABLE public.test ( id INT ); NOTICE: AUDIT: SESSION,1,1,DDL,CREATE TABLE,TABLE,public.test,"CREATE TABLE public.test ( id INT )", SELECT * FROM test; id ---- (0 rows) DROP TABLE test; NOTICE: AUDIT: SESSION,2,1,DDL,DROP TABLE,TABLE,public.test,DROP TABLE test, -- -- Create second test user \connect - :current_user CREATE ROLE regress_user2 LOGIN password 'password'; NOTICE: AUDIT: SESSION,1,1,ROLE,CREATE ROLE,,,CREATE ROLE regress_user2 LOGIN password , ALTER ROLE regress_user2 SET pgaudit.log = 'Read, writE'; NOTICE: AUDIT: SESSION,2,1,ROLE,ALTER ROLE,,,"ALTER ROLE regress_user2 SET pgaudit.log = 'Read, writE'", ALTER ROLE regress_user2 SET pgaudit.log_catalog = OFF; NOTICE: AUDIT: SESSION,3,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 SET pgaudit.log_catalog = OFF, ALTER ROLE regress_user2 SET pgaudit.log_client = ON; NOTICE: AUDIT: SESSION,4,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 SET pgaudit.log_client = ON, ALTER ROLE regress_user2 SET pgaudit.log_level = 'warning'; NOTICE: AUDIT: SESSION,5,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 SET pgaudit.log_level = 'warning', ALTER ROLE regress_user2 SET pgaudit.role = regress_auditor; NOTICE: AUDIT: SESSION,6,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 SET pgaudit.role = regress_auditor, ALTER ROLE regress_user2 SET pgaudit.log_statement_once = ON; NOTICE: AUDIT: SESSION,7,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 SET pgaudit.log_statement_once = ON, -- -- Setup role-based tests CREATE TABLE test2 ( id INT ); GRANT SELECT, INSERT, UPDATE, DELETE ON test2 TO regress_user2, regress_user1; NOTICE: AUDIT: SESSION,8,1,ROLE,GRANT,TABLE,,"GRANT SELECT, INSERT, UPDATE, DELETE ON test2 TO regress_user2, regress_user1", GRANT SELECT, UPDATE ON TABLE public.test2 TO regress_auditor; NOTICE: AUDIT: SESSION,9,1,ROLE,GRANT,TABLE,,"GRANT SELECT, UPDATE ON TABLE public.test2 TO regress_auditor", CREATE TABLE test3 ( id INT ); GRANT SELECT, INSERT, UPDATE, DELETE ON test3 TO regress_user2; NOTICE: AUDIT: SESSION,10,1,ROLE,GRANT,TABLE,,"GRANT SELECT, INSERT, UPDATE, DELETE ON test3 TO regress_user2", GRANT INSERT ON TABLE public.test3 TO regress_auditor; NOTICE: AUDIT: SESSION,11,1,ROLE,GRANT,TABLE,,"GRANT INSERT ON TABLE public.test3 TO regress_auditor", CREATE FUNCTION test2_insert() RETURNS TRIGGER AS $$ BEGIN UPDATE test2 SET id = id + 90 WHERE id = new.id; RETURN new; END $$ LANGUAGE plpgsql security definer; ALTER FUNCTION test2_insert() OWNER TO regress_user1; CREATE TRIGGER test2_insert_trg AFTER INSERT ON test2 FOR EACH ROW EXECUTE PROCEDURE test2_insert(); CREATE FUNCTION test2_change(change_id int) RETURNS void AS $$ BEGIN UPDATE test2 SET id = id + 1 WHERE id = change_id; END $$ LANGUAGE plpgsql security definer; ALTER FUNCTION test2_change(int) OWNER TO regress_user2; CREATE VIEW vw_test3 AS SELECT * FROM test3; GRANT SELECT ON vw_test3 TO regress_user2; NOTICE: AUDIT: SESSION,12,1,ROLE,GRANT,TABLE,,"GRANT SELECT ON vw_test3 TO regress_user2", GRANT SELECT ON vw_test3 TO regress_auditor; NOTICE: AUDIT: SESSION,13,1,ROLE,GRANT,TABLE,,"GRANT SELECT ON vw_test3 TO regress_auditor", \connect - regress_user2 -- -- Role-based tests SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) SUBQUERY; count ------- 1 (1 row) SELECT * FROM test3, test2; WARNING: AUDIT: SESSION,1,1,READ,SELECT,,,"SELECT * FROM test3, test2", WARNING: AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.test2,, id | id ----+---- (0 rows) -- -- Object logged because of: -- select on vw_test3 -- select on test2 SELECT * FROM vw_test3, test2; WARNING: AUDIT: SESSION,2,1,READ,SELECT,,,"SELECT * FROM vw_test3, test2", WARNING: AUDIT: OBJECT,2,1,READ,SELECT,VIEW,public.vw_test3,, WARNING: AUDIT: OBJECT,2,1,READ,SELECT,TABLE,public.test2,, id | id ----+---- (0 rows) -- -- Object logged because of: -- insert on test3 -- select on test2 WITH CTE AS ( SELECT id FROM test2 ) INSERT INTO test3 SELECT id FROM cte; WARNING: AUDIT: SESSION,3,1,WRITE,INSERT,,,"WITH CTE AS ( SELECT id FROM test2 ) INSERT INTO test3 SELECT id FROM cte", WARNING: AUDIT: OBJECT,3,1,WRITE,INSERT,TABLE,public.test3,, WARNING: AUDIT: OBJECT,3,1,READ,SELECT,TABLE,public.test2,, -- -- Object logged because of: -- insert on test3 WITH CTE AS ( INSERT INTO test3 VALUES (1) RETURNING id ) INSERT INTO test2 SELECT id FROM cte; WARNING: AUDIT: SESSION,4,1,WRITE,INSERT,,,"WITH CTE AS ( INSERT INTO test3 VALUES (1) RETURNING id ) INSERT INTO test2 SELECT id FROM cte", WARNING: AUDIT: OBJECT,4,1,WRITE,INSERT,TABLE,public.test3,, DO $$ BEGIN PERFORM test2_change(91); END $$; WARNING: AUDIT: SESSION,5,1,READ,SELECT,,,SELECT test2_change(91), WARNING: AUDIT: SESSION,5,2,WRITE,UPDATE,,,"UPDATE test2 SET id = id + 1 WHERE id = change_id", WARNING: AUDIT: OBJECT,5,2,WRITE,UPDATE,TABLE,public.test2,, -- -- Object logged because of: -- insert on test3 -- update on test2 WITH CTE AS ( UPDATE test2 SET id = 45 WHERE id = 92 RETURNING id ) INSERT INTO test3 SELECT id FROM cte; WARNING: AUDIT: SESSION,6,1,WRITE,INSERT,,,"WITH CTE AS ( UPDATE test2 SET id = 45 WHERE id = 92 RETURNING id ) INSERT INTO test3 SELECT id FROM cte", WARNING: AUDIT: OBJECT,6,1,WRITE,INSERT,TABLE,public.test3,, WARNING: AUDIT: OBJECT,6,1,WRITE,UPDATE,TABLE,public.test2,, -- -- Object logged because of: -- insert on test2 WITH CTE AS ( INSERT INTO test2 VALUES (37) RETURNING id ) UPDATE test3 SET id = cte.id FROM cte WHERE test3.id <> cte.id; WARNING: AUDIT: SESSION,7,1,WRITE,UPDATE,,,"WITH CTE AS ( INSERT INTO test2 VALUES (37) RETURNING id ) UPDATE test3 SET id = cte.id FROM cte WHERE test3.id <> cte.id", WARNING: AUDIT: OBJECT,7,1,WRITE,INSERT,TABLE,public.test2,, -- -- Be sure that test has correct contents SELECT * FROM test2 ORDER BY ID; WARNING: AUDIT: SESSION,8,1,READ,SELECT,,,"SELECT * FROM test2 ORDER BY ID", WARNING: AUDIT: OBJECT,8,1,READ,SELECT,TABLE,public.test2,, id ----- 45 127 (2 rows) -- -- Change permissions of user 2 so that only object logging will be done \connect - :current_user ALTER ROLE regress_user2 SET pgaudit.log = 'NONE'; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 SET pgaudit.log = 'NONE', \connect - regress_user2 -- -- Create test4 and add permissions CREATE TABLE test4 ( id int, name text ); GRANT SELECT (name) ON TABLE public.test4 TO regress_auditor; GRANT UPDATE (id) ON TABLE public.test4 TO regress_auditor; GRANT insert (name) ON TABLE public.test4 TO regress_auditor; -- -- Not object logged SELECT id FROM public.test4; id ---- (0 rows) -- -- Object logged because of: -- select (name) on test4 SELECT name FROM public.test4; WARNING: AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.test4,"SELECT name FROM public.test4", name ------ (0 rows) -- -- Not object logged INSERT INTO public.test4 (id) VALUES (1); -- -- Object logged because of: -- insert (name) on test4 INSERT INTO public.test4 (name) VALUES ('test'); WARNING: AUDIT: OBJECT,2,1,WRITE,INSERT,TABLE,public.test4,"INSERT INTO public.test4 (name) VALUES ('test')", -- -- Not object logged UPDATE public.test4 SET name = 'foo'; -- -- Object logged because of: -- update (id) on test4 UPDATE public.test4 SET id = 1; WARNING: AUDIT: OBJECT,3,1,WRITE,UPDATE,TABLE,public.test4,"UPDATE public.test4 SET id = 1", -- -- Object logged because of: -- update (name) on test4 -- update (name) takes precedence over select (name) due to ordering update public.test4 set name = 'foo' where name = 'bar'; WARNING: AUDIT: OBJECT,4,1,WRITE,UPDATE,TABLE,public.test4,update public.test4 set name = 'foo' where name = 'bar', -- -- Confirm that "long" parameter values will not be logged if pgaudit.log_parameter_max_size -- is set. \connect - :current_user ALTER ROLE regress_user2 SET pgaudit.log_parameter_max_size = 50; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 SET pgaudit.log_parameter_max_size = 50, ALTER ROLE regress_user2 SET pgaudit.log_parameter = 'on'; NOTICE: AUDIT: SESSION,2,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 SET pgaudit.log_parameter = 'on', \connect - regress_user2 PREPARE testinsert(int, text) AS INSERT INTO test4 VALUES($1, $2); EXECUTE testinsert(1, '*******************************************************'); WARNING: AUDIT: OBJECT,1,1,WRITE,INSERT,TABLE,public.test4,"PREPARE testinsert(int, text) AS INSERT INTO test4 VALUES($1, $2)","1," DEALLOCATE testinsert; \connect - :current_user ALTER ROLE regress_user2 RESET pgaudit.log_parameter_max_size; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 RESET pgaudit.log_parameter_max_size, \connect - regress_user2 PREPARE testinsert(int, text) AS INSERT INTO test4 VALUES($1, $2); EXECUTE testinsert(2, '*******************************************************'); WARNING: AUDIT: OBJECT,1,1,WRITE,INSERT,TABLE,public.test4,"PREPARE testinsert(int, text) AS INSERT INTO test4 VALUES($1, $2)","2,*******************************************************" DEALLOCATE testinsert; \connect - :current_user ALTER ROLE regress_user2 RESET pgaudit.log_parameter; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user2 RESET pgaudit.log_parameter, -- -- Change permissions of user 1 so that session logging will be done \connect - :current_user -- -- Drop test tables DROP TABLE test2; DROP VIEW vw_test3; DROP TABLE test3; DROP TABLE test4; DROP FUNCTION test2_insert(); DROP FUNCTION test2_change(int); ALTER ROLE regress_user1 SET pgaudit.log = 'DDL, READ'; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,"ALTER ROLE regress_user1 SET pgaudit.log = 'DDL, READ'", \connect - regress_user1 -- -- Create table is session logged CREATE TABLE public.account ( id INT, name TEXT, password TEXT, description TEXT ); NOTICE: AUDIT: SESSION,1,1,DDL,CREATE TABLE,TABLE,public.account,"CREATE TABLE public.account ( id INT, name TEXT, password TEXT, description TEXT )", -- -- Select is session logged SELECT * FROM account; NOTICE: AUDIT: SESSION,2,1,READ,SELECT,,,"SELECT * FROM account", id | name | password | description ----+------+----------+------------- (0 rows) -- -- Insert is not logged INSERT INTO account (id, name, password, description) VALUES (1, 'regress_user1', 'HASH1', 'blah, blah'); -- -- Change permissions of user 1 so that only object logging will be done \connect - :current_user ALTER ROLE regress_user1 SET pgaudit.log = 'none'; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 SET pgaudit.log = 'none', ALTER ROLE regress_user1 SET pgaudit.role = 'regress_auditor'; NOTICE: AUDIT: SESSION,2,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 SET pgaudit.role = 'regress_auditor', \connect - regress_user1 -- -- ROLE class not set, so regress_auditor grants not logged GRANT SELECT (password), UPDATE (name, password) ON TABLE public.account TO regress_auditor; -- -- Not object logged SELECT id, name FROM account; id | name ----+--------------- 1 | regress_user1 (1 row) -- -- Object logged because of: -- select (password) on account SELECT password FROM account; NOTICE: AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.account,"SELECT password FROM account", password ---------- HASH1 (1 row) -- -- Not object logged UPDATE account SET description = 'yada, yada'; -- -- Object logged because of: -- update (password) on account UPDATE account SET password = 'HASH2'; NOTICE: AUDIT: OBJECT,2,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET password = 'HASH2'", -- -- Change permissions of user 1 so that session relation logging will be done \connect - :current_user ALTER ROLE regress_user1 SET pgaudit.log_relation = on; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 SET pgaudit.log_relation = on, ALTER ROLE regress_user1 SET pgaudit.log = 'read, WRITE'; NOTICE: AUDIT: SESSION,2,1,ROLE,ALTER ROLE,,,"ALTER ROLE regress_user1 SET pgaudit.log = 'read, WRITE'", \connect - regress_user1 -- -- Not logged CREATE TABLE ACCOUNT_ROLE_MAP ( account_id INT, role_id INT ); -- -- ROLE class not set, so regress_auditor grants not logged GRANT SELECT ON TABLE public.account_role_map TO regress_auditor; -- -- Object logged because of: -- select (password) on account -- select on account_role_map -- Session logged on all tables because log = read and log_relation = on SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id; NOTICE: AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.account,"SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id", NOTICE: AUDIT: SESSION,1,1,READ,SELECT,TABLE,public.account,"SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id", NOTICE: AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.account_role_map,"SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id", NOTICE: AUDIT: SESSION,1,1,READ,SELECT,TABLE,public.account_role_map,"SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id", password | role_id ----------+--------- (0 rows) -- -- Object logged because of: -- select (password) on account -- Session logged on all tables because log = read and log_relation = on SELECT password FROM account; NOTICE: AUDIT: OBJECT,2,1,READ,SELECT,TABLE,public.account,"SELECT password FROM account", NOTICE: AUDIT: SESSION,2,1,READ,SELECT,TABLE,public.account,"SELECT password FROM account", password ---------- HASH2 (1 row) -- -- Not object logged -- Session logged on all tables because log = read and log_relation = on UPDATE account SET description = 'yada, yada'; NOTICE: AUDIT: SESSION,3,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET description = 'yada, yada'", -- -- Object logged because of: -- select (password) on account (in the where clause) -- Session logged on all tables because log = read and log_relation = on SELECT * FROM account WHERE password = 'HASH2' FOR UPDATE; NOTICE: AUDIT: OBJECT,4,1,READ,SELECT,TABLE,public.account,"SELECT * FROM account WHERE password = 'HASH2' FOR UPDATE", NOTICE: AUDIT: SESSION,4,1,READ,SELECT,TABLE,public.account,"SELECT * FROM account WHERE password = 'HASH2' FOR UPDATE", id | name | password | description ----+---------------+----------+------------- 1 | regress_user1 | HASH2 | yada, yada (1 row) -- -- Object logged because of: -- select (password) on account (in the where clause) -- Session logged on all tables because log = read and log_relation = on UPDATE account SET description = 'yada, yada' where password = 'HASH2'; NOTICE: AUDIT: OBJECT,5,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET description = 'yada, yada' where password = 'HASH2'", NOTICE: AUDIT: SESSION,5,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET description = 'yada, yada' where password = 'HASH2'", -- -- Object logged because of: -- update (password) on account -- Session logged on all tables because log = read and log_relation = on UPDATE account SET password = 'HASH2'; NOTICE: AUDIT: OBJECT,6,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET password = 'HASH2'", NOTICE: AUDIT: SESSION,6,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET password = 'HASH2'", -- -- Change configuration of user 1 so that full statements are not logged \connect - :current_user ALTER ROLE regress_user1 RESET pgaudit.log_relation; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 RESET pgaudit.log_relation, ALTER ROLE regress_user1 RESET pgaudit.log; NOTICE: AUDIT: SESSION,2,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 RESET pgaudit.log, ALTER ROLE regress_user1 SET pgaudit.log_statement = OFF; NOTICE: AUDIT: SESSION,3,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 SET pgaudit.log_statement = OFF, \connect - regress_user1 -- -- Logged but without full statement SELECT * FROM account; NOTICE: AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.account,, id | name | password | description ----+---------------+----------+------------- 1 | regress_user1 | HASH2 | yada, yada (1 row) -- -- Change back to superuser to do exhaustive tests \connect - :current_user SET pgaudit.log = 'ALL'; NOTICE: AUDIT: SESSION,1,1,MISC,SET,,,SET pgaudit.log = 'ALL', SET pgaudit.log_level = 'notice'; NOTICE: AUDIT: SESSION,2,1,MISC,SET,,,SET pgaudit.log_level = 'notice', SET pgaudit.log_client = ON; NOTICE: AUDIT: SESSION,3,1,MISC,SET,,,SET pgaudit.log_client = ON, SET pgaudit.log_relation = ON; NOTICE: AUDIT: SESSION,4,1,MISC,SET,,,SET pgaudit.log_relation = ON, SET pgaudit.log_parameter = ON; NOTICE: AUDIT: SESSION,5,1,MISC,SET,,,SET pgaudit.log_parameter = ON, -- -- Simple DO block DO $$ BEGIN raise notice 'test'; END $$; NOTICE: AUDIT: SESSION,6,1,FUNCTION,DO,,,"DO $$ BEGIN raise notice 'test'; END $$", NOTICE: test -- -- Create test schema CREATE SCHEMA test; NOTICE: AUDIT: SESSION,7,1,DDL,CREATE SCHEMA,SCHEMA,test,CREATE SCHEMA test, -- -- Copy account to stdout COPY account TO stdout; NOTICE: AUDIT: SESSION,8,1,READ,SELECT,TABLE,public.account,COPY account TO stdout, 1 regress_user1 HASH2 yada, yada -- -- Create a table from a query CREATE TABLE test.account_copy AS SELECT * FROM account; NOTICE: AUDIT: SESSION,9,1,READ,SELECT,TABLE,public.account,"CREATE TABLE test.account_copy AS SELECT * FROM account", NOTICE: AUDIT: SESSION,9,2,DDL,CREATE TABLE AS,TABLE,test.account_copy,"CREATE TABLE test.account_copy AS SELECT * FROM account", -- -- Copy from stdin to account copy COPY test.account_copy from stdin; NOTICE: AUDIT: SESSION,10,1,WRITE,INSERT,TABLE,test.account_copy,COPY test.account_copy from stdin, -- -- Test prepared statement PREPARE pgclassstmt (oid) AS SELECT * FROM account WHERE id = $1; NOTICE: AUDIT: SESSION,11,1,READ,PREPARE,,,"PREPARE pgclassstmt (oid) AS SELECT * FROM account WHERE id = $1", EXECUTE pgclassstmt (1); NOTICE: AUDIT: SESSION,12,1,READ,SELECT,TABLE,public.account,"PREPARE pgclassstmt (oid) AS SELECT * FROM account WHERE id = $1",1 NOTICE: AUDIT: SESSION,12,2,MISC,EXECUTE,,,EXECUTE pgclassstmt (1), id | name | password | description ----+---------------+----------+------------- 1 | regress_user1 | HASH2 | yada, yada (1 row) DEALLOCATE pgclassstmt; NOTICE: AUDIT: SESSION,13,1,MISC,DEALLOCATE,,,DEALLOCATE pgclassstmt, -- -- Test cursor BEGIN; NOTICE: AUDIT: SESSION,14,1,MISC,BEGIN,,,BEGIN, DECLARE ctest SCROLL CURSOR FOR SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) subquery; NOTICE: AUDIT: SESSION,15,1,READ,SELECT,TABLE,pg_catalog.pg_class,"DECLARE ctest SCROLL CURSOR FOR SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) subquery", NOTICE: AUDIT: SESSION,15,2,READ,DECLARE CURSOR,,,"DECLARE ctest SCROLL CURSOR FOR SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) subquery", FETCH NEXT FROM ctest; NOTICE: AUDIT: SESSION,16,1,MISC,FETCH,,,FETCH NEXT FROM ctest, count ------- 1 (1 row) CLOSE ctest; NOTICE: AUDIT: SESSION,17,1,MISC,CLOSE CURSOR,,,CLOSE ctest, COMMIT; NOTICE: AUDIT: SESSION,18,1,MISC,COMMIT,,,COMMIT, -- -- Turn off log_catalog and pg_class will not be logged SET pgaudit.log_catalog = OFF; NOTICE: AUDIT: SESSION,19,1,MISC,SET,,,SET pgaudit.log_catalog = OFF, SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) subquery; count ------- 1 (1 row) -- -- Test prepared insert CREATE TABLE test.test_insert ( id INT ); NOTICE: AUDIT: SESSION,20,1,DDL,CREATE TABLE,TABLE,test.test_insert,"CREATE TABLE test.test_insert ( id INT )", PREPARE pgclassstmt (oid) AS INSERT INTO test.test_insert (id) VALUES ($1); NOTICE: AUDIT: SESSION,21,1,WRITE,PREPARE,,,"PREPARE pgclassstmt (oid) AS INSERT INTO test.test_insert (id) VALUES ($1)", EXECUTE pgclassstmt (1); NOTICE: AUDIT: SESSION,22,1,WRITE,INSERT,TABLE,test.test_insert,"PREPARE pgclassstmt (oid) AS INSERT INTO test.test_insert (id) VALUES ($1)",1 NOTICE: AUDIT: SESSION,22,2,MISC,EXECUTE,,,EXECUTE pgclassstmt (1), -- -- Check that primary key creation is logged CREATE TABLE public.test ( id INT, name TEXT, description TEXT, CONSTRAINT test_pkey PRIMARY KEY (id) ); NOTICE: AUDIT: SESSION,23,1,DDL,CREATE TABLE,TABLE,public.test,"CREATE TABLE public.test ( id INT, name TEXT, description TEXT, CONSTRAINT test_pkey PRIMARY KEY (id) )", NOTICE: AUDIT: SESSION,23,1,DDL,CREATE INDEX,INDEX,public.test_pkey,"CREATE TABLE public.test ( id INT, name TEXT, description TEXT, CONSTRAINT test_pkey PRIMARY KEY (id) )", -- -- Check that analyze is logged ANALYZE test; NOTICE: AUDIT: SESSION,24,1,MISC,ANALYZE,,,ANALYZE test, -- -- Grants to public should not cause object logging (session logging will -- still happen) GRANT SELECT ON TABLE public.test TO PUBLIC; NOTICE: AUDIT: SESSION,25,1,ROLE,GRANT,TABLE,,"GRANT SELECT ON TABLE public.test TO PUBLIC", SELECT * FROM test; NOTICE: AUDIT: SESSION,26,1,READ,SELECT,TABLE,public.test,"SELECT * FROM test", id | name | description ----+------+------------- (0 rows) -- Check that statements without columns log SELECT FROM test; NOTICE: AUDIT: SESSION,27,1,READ,SELECT,TABLE,public.test,"SELECT FROM test", -- (0 rows) SELECT 1, substring('Thomas' from 2 for 3); NOTICE: AUDIT: SESSION,28,1,READ,SELECT,,,"SELECT 1, substring('Thomas' from 2 for 3)", ?column? | substring ----------+----------- 1 | hom (1 row) DO $$ DECLARE test INT; BEGIN SELECT 1 INTO test; END $$; NOTICE: AUDIT: SESSION,29,1,FUNCTION,DO,,,"DO $$ DECLARE test INT; BEGIN SELECT 1 INTO test; END $$", NOTICE: AUDIT: SESSION,29,2,READ,SELECT,,,SELECT 1, explain select 1; NOTICE: AUDIT: SESSION,30,1,READ,SELECT,,,explain select 1, NOTICE: AUDIT: SESSION,30,2,MISC,EXPLAIN,,,explain select 1, QUERY PLAN ------------------------------------------ Result (cost=0.00..0.01 rows=1 width=4) (1 row) -- -- Test that looks inside of do blocks log INSERT INTO TEST (id) VALUES (1); NOTICE: AUDIT: SESSION,31,1,WRITE,INSERT,TABLE,public.test,"INSERT INTO TEST (id) VALUES (1)", INSERT INTO TEST (id) VALUES (2); NOTICE: AUDIT: SESSION,32,1,WRITE,INSERT,TABLE,public.test,"INSERT INTO TEST (id) VALUES (2)", INSERT INTO TEST (id) VALUES (3); NOTICE: AUDIT: SESSION,33,1,WRITE,INSERT,TABLE,public.test,"INSERT INTO TEST (id) VALUES (3)", DO $$ DECLARE result RECORD; BEGIN FOR result IN SELECT id FROM test LOOP INSERT INTO test (id) VALUES (result.id + 100); END LOOP; END $$; NOTICE: AUDIT: SESSION,34,1,FUNCTION,DO,,,"DO $$ DECLARE result RECORD; BEGIN FOR result IN SELECT id FROM test LOOP INSERT INTO test (id) VALUES (result.id + 100); END LOOP; END $$", NOTICE: AUDIT: SESSION,34,2,READ,SELECT,TABLE,public.test,"SELECT id FROM test", NOTICE: AUDIT: SESSION,34,3,WRITE,INSERT,TABLE,public.test,"INSERT INTO test (id) VALUES (result.id + 100)",",,1" NOTICE: AUDIT: SESSION,34,4,WRITE,INSERT,TABLE,public.test,"INSERT INTO test (id) VALUES (result.id + 100)",",,2" NOTICE: AUDIT: SESSION,34,5,WRITE,INSERT,TABLE,public.test,"INSERT INTO test (id) VALUES (result.id + 100)",",,3" -- -- Test obfuscated dynamic sql for clean logging DO $$ DECLARE table_name TEXT = 'do_table'; BEGIN EXECUTE E'\t\n\r CREATE TABLE ' || table_name || E' ("weird name" INT)\t\n\r ; DROP table ' || table_name; END $$; NOTICE: AUDIT: SESSION,35,1,FUNCTION,DO,,,"DO $$ DECLARE table_name TEXT = 'do_table'; BEGIN EXECUTE E'\t\n\r CREATE TABLE ' || table_name || E' (""weird name"" INT)\t\n\r ; DROP table ' || table_name; END $$", NOTICE: AUDIT: SESSION,35,2,DDL,CREATE TABLE,TABLE,public.do_table,"CREATE TABLE do_table (""weird name"" INT)", NOTICE: AUDIT: SESSION,35,3,DDL,DROP TABLE,TABLE,public.do_table,DROP table do_table, -- -- Generate an error and make sure the stack gets cleared DO $$ BEGIN CREATE TABLE bogus.test_block ( id INT ); END $$; NOTICE: AUDIT: SESSION,36,1,FUNCTION,DO,,,"DO $$ BEGIN CREATE TABLE bogus.test_block ( id INT ); END $$", ERROR: schema "bogus" does not exist at character 14 -- -- Test alter table statements ALTER TABLE public.test DROP COLUMN description ; NOTICE: AUDIT: SESSION,37,1,DDL,ALTER TABLE,TABLE COLUMN,public.test.description,"ALTER TABLE public.test DROP COLUMN description", NOTICE: AUDIT: SESSION,37,1,DDL,ALTER TABLE,TABLE,public.test,"ALTER TABLE public.test DROP COLUMN description", ALTER TABLE public.test RENAME TO test2; NOTICE: AUDIT: SESSION,38,1,DDL,ALTER TABLE,TABLE,public.test2,"ALTER TABLE public.test RENAME TO test2", ALTER TABLE public.test2 SET SCHEMA test; NOTICE: AUDIT: SESSION,39,1,DDL,ALTER TABLE,TABLE,test.test2,"ALTER TABLE public.test2 SET SCHEMA test", ALTER TABLE test.test2 ADD COLUMN description TEXT; NOTICE: AUDIT: SESSION,40,1,DDL,ALTER TABLE,TABLE,test.test2,"ALTER TABLE test.test2 ADD COLUMN description TEXT", ALTER TABLE test.test2 DROP COLUMN description; NOTICE: AUDIT: SESSION,41,1,DDL,ALTER TABLE,TABLE COLUMN,test.test2.description,"ALTER TABLE test.test2 DROP COLUMN description", NOTICE: AUDIT: SESSION,41,1,DDL,ALTER TABLE,TABLE,test.test2,"ALTER TABLE test.test2 DROP COLUMN description", DROP TABLE test.test2; NOTICE: AUDIT: SESSION,42,1,DDL,DROP TABLE,TABLE,test.test2,DROP TABLE test.test2, NOTICE: AUDIT: SESSION,42,1,DDL,DROP TABLE,TABLE CONSTRAINT,test_pkey on test.test2,DROP TABLE test.test2, NOTICE: AUDIT: SESSION,42,1,DDL,DROP TABLE,INDEX,test.test_pkey,DROP TABLE test.test2, -- -- Test multiple statements with one semi-colon CREATE SCHEMA foo CREATE TABLE foo.bar (id int) CREATE TABLE foo.baz (id int); NOTICE: AUDIT: SESSION,43,1,DDL,CREATE SCHEMA,SCHEMA,foo,"CREATE SCHEMA foo CREATE TABLE foo.bar (id int) CREATE TABLE foo.baz (id int)", NOTICE: AUDIT: SESSION,43,1,DDL,CREATE TABLE,TABLE,foo.bar,"CREATE SCHEMA foo CREATE TABLE foo.bar (id int) CREATE TABLE foo.baz (id int)", NOTICE: AUDIT: SESSION,43,1,DDL,CREATE TABLE,TABLE,foo.baz,"CREATE SCHEMA foo CREATE TABLE foo.bar (id int) CREATE TABLE foo.baz (id int)", -- -- Test aggregate CREATE FUNCTION public.int_add ( a INT, b INT ) RETURNS INT LANGUAGE plpgsql AS $$ BEGIN return a + b; END $$; NOTICE: AUDIT: SESSION,44,1,DDL,CREATE FUNCTION,FUNCTION,"public.int_add(integer,integer)","CREATE FUNCTION public.int_add ( a INT, b INT ) RETURNS INT LANGUAGE plpgsql AS $$ BEGIN return a + b; END $$", SELECT int_add(1, 1); NOTICE: AUDIT: SESSION,45,1,READ,SELECT,,,"SELECT int_add(1, 1)", NOTICE: AUDIT: SESSION,45,2,FUNCTION,EXECUTE,FUNCTION,public.int_add,"SELECT int_add(1, 1)", int_add --------- 2 (1 row) CREATE AGGREGATE public.sum_test(INT) (SFUNC=public.int_add, STYPE=INT, INITCOND='0'); NOTICE: AUDIT: SESSION,46,1,DDL,CREATE AGGREGATE,AGGREGATE,public.sum_test(integer),"CREATE AGGREGATE public.sum_test(INT) (SFUNC=public.int_add, STYPE=INT, INITCOND='0')", ALTER AGGREGATE public.sum_test(integer) RENAME TO sum_test2; NOTICE: AUDIT: SESSION,47,1,DDL,ALTER AGGREGATE,AGGREGATE,public.sum_test2(integer),ALTER AGGREGATE public.sum_test(integer) RENAME TO sum_test2, -- -- Test conversion CREATE CONVERSION public.conversion_test FOR 'latin1' TO 'utf8' FROM pg_catalog.iso8859_1_to_utf8; NOTICE: AUDIT: SESSION,48,1,DDL,CREATE CONVERSION,CONVERSION,public.conversion_test,CREATE CONVERSION public.conversion_test FOR 'latin1' TO 'utf8' FROM pg_catalog.iso8859_1_to_utf8, ALTER CONVERSION public.conversion_test RENAME TO conversion_test2; NOTICE: AUDIT: SESSION,49,1,DDL,ALTER CONVERSION,CONVERSION,public.conversion_test2,ALTER CONVERSION public.conversion_test RENAME TO conversion_test2, -- -- Test create/alter/drop database CREATE DATABASE contrib_regression_pgaudit; NOTICE: AUDIT: SESSION,50,1,DDL,CREATE DATABASE,,,CREATE DATABASE contrib_regression_pgaudit, ALTER DATABASE contrib_regression_pgaudit RENAME TO contrib_regression_pgaudit2; NOTICE: AUDIT: SESSION,51,1,DDL,ALTER DATABASE,,,ALTER DATABASE contrib_regression_pgaudit RENAME TO contrib_regression_pgaudit2, DROP DATABASE contrib_regression_pgaudit2; NOTICE: AUDIT: SESSION,52,1,DDL,DROP DATABASE,,,DROP DATABASE contrib_regression_pgaudit2, -- Test role as a substmt SET pgaudit.log = 'ROLE'; CREATE TABLE t (); CREATE ROLE regress_alice; NOTICE: AUDIT: SESSION,53,1,ROLE,CREATE ROLE,,,CREATE ROLE regress_alice, CREATE SCHEMA foo2 GRANT SELECT ON public.t TO regress_alice; NOTICE: AUDIT: SESSION,54,1,ROLE,GRANT,TABLE,,"CREATE SCHEMA foo2 GRANT SELECT ON public.t TO regress_alice", drop table public.t; drop role regress_alice; NOTICE: AUDIT: SESSION,55,1,ROLE,DROP ROLE,,,drop role regress_alice, -- -- Test for non-empty stack error CREATE OR REPLACE FUNCTION get_test_id(_ret REFCURSOR) RETURNS REFCURSOR LANGUAGE plpgsql IMMUTABLE AS $$ BEGIN OPEN _ret FOR SELECT 200; RETURN _ret; END $$; BEGIN; SELECT get_test_id('_ret'); get_test_id ------------- _ret (1 row) SELECT get_test_id('_ret2'); get_test_id ------------- _ret2 (1 row) FETCH ALL FROM _ret; ?column? ---------- 200 (1 row) FETCH ALL FROM _ret2; ?column? ---------- 200 (1 row) CLOSE _ret; CLOSE _ret2; END; -- -- Test that frees a memory context earlier than expected SET pgaudit.log = 'ALL'; NOTICE: AUDIT: SESSION,56,1,MISC,SET,,,SET pgaudit.log = 'ALL', CREATE TABLE hoge ( id int ); NOTICE: AUDIT: SESSION,57,1,DDL,CREATE TABLE,TABLE,public.hoge,"CREATE TABLE hoge ( id int )", CREATE FUNCTION test() RETURNS INT AS $$ DECLARE cur1 cursor for select * from hoge; tmp int; BEGIN OPEN cur1; FETCH cur1 into tmp; RETURN tmp; END $$ LANGUAGE plpgsql ; NOTICE: AUDIT: SESSION,58,1,DDL,CREATE FUNCTION,FUNCTION,public.test(),"CREATE FUNCTION test() RETURNS INT AS $$ DECLARE cur1 cursor for select * from hoge; tmp int; BEGIN OPEN cur1; FETCH cur1 into tmp; RETURN tmp; END $$ LANGUAGE plpgsql", SELECT test(); NOTICE: AUDIT: SESSION,59,1,READ,SELECT,,,SELECT test(), NOTICE: AUDIT: SESSION,59,2,FUNCTION,EXECUTE,FUNCTION,public.test,SELECT test(), NOTICE: AUDIT: SESSION,59,3,READ,SELECT,TABLE,public.hoge,select * from hoge, test ------ (1 row) -- -- Delete all rows then delete 1 row SET pgaudit.log = 'write'; SET pgaudit.role = 'regress_auditor'; create table bar ( col int ); grant delete on bar to regress_auditor; insert into bar (col) values (1); NOTICE: AUDIT: SESSION,60,1,WRITE,INSERT,TABLE,public.bar,"insert into bar (col) values (1)", delete from bar; NOTICE: AUDIT: OBJECT,61,1,WRITE,DELETE,TABLE,public.bar,delete from bar, NOTICE: AUDIT: SESSION,61,1,WRITE,DELETE,TABLE,public.bar,delete from bar, insert into bar (col) values (1); NOTICE: AUDIT: SESSION,62,1,WRITE,INSERT,TABLE,public.bar,"insert into bar (col) values (1)", delete from bar where col = 1; NOTICE: AUDIT: OBJECT,63,1,WRITE,DELETE,TABLE,public.bar,"delete from bar where col = 1", NOTICE: AUDIT: SESSION,63,1,WRITE,DELETE,TABLE,public.bar,"delete from bar where col = 1", drop table bar; -- -- Grant roles to each other SET pgaudit.log = 'role'; GRANT regress_user1 TO regress_user2; NOTICE: AUDIT: SESSION,64,1,ROLE,GRANT ROLE,,,GRANT regress_user1 TO regress_user2, REVOKE regress_user1 FROM regress_user2; NOTICE: AUDIT: SESSION,65,1,ROLE,REVOKE ROLE,,,REVOKE regress_user1 FROM regress_user2, -- -- Test that FK references do not log but triggers still do SET pgaudit.log = 'READ,WRITE'; SET pgaudit.role TO 'regress_auditor'; CREATE TABLE aaa ( ID int primary key ); CREATE TABLE bbb ( id int references aaa(id) ); CREATE FUNCTION bbb_insert() RETURNS TRIGGER AS $$ BEGIN UPDATE bbb set id = new.id + 1; RETURN new; END $$ LANGUAGE plpgsql; CREATE TRIGGER bbb_insert_trg AFTER INSERT ON bbb FOR EACH ROW EXECUTE PROCEDURE bbb_insert(); GRANT SELECT, UPDATE ON aaa TO regress_auditor; GRANT UPDATE ON bbb TO regress_auditor; INSERT INTO aaa VALUES (generate_series(1,100)); NOTICE: AUDIT: SESSION,66,1,WRITE,INSERT,TABLE,public.aaa,"INSERT INTO aaa VALUES (generate_series(1,100))", SET pgaudit.log_parameter TO OFF; INSERT INTO bbb VALUES (1); NOTICE: AUDIT: SESSION,67,1,WRITE,INSERT,TABLE,public.bbb,INSERT INTO bbb VALUES (1), NOTICE: AUDIT: OBJECT,67,2,READ,SELECT,TABLE,public.aaa,"SELECT 1 FROM ONLY ""public"".""aaa"" x WHERE ""id"" OPERATOR(pg_catalog.=) $1 FOR KEY SHARE OF x", NOTICE: AUDIT: SESSION,67,2,READ,SELECT,TABLE,public.aaa,"SELECT 1 FROM ONLY ""public"".""aaa"" x WHERE ""id"" OPERATOR(pg_catalog.=) $1 FOR KEY SHARE OF x", NOTICE: AUDIT: OBJECT,67,3,WRITE,UPDATE,TABLE,public.bbb,UPDATE bbb set id = new.id + 1, NOTICE: AUDIT: SESSION,67,3,WRITE,UPDATE,TABLE,public.bbb,UPDATE bbb set id = new.id + 1, NOTICE: AUDIT: OBJECT,67,4,READ,SELECT,TABLE,public.aaa,"SELECT 1 FROM ONLY ""public"".""aaa"" x WHERE ""id"" OPERATOR(pg_catalog.=) $1 FOR KEY SHARE OF x", NOTICE: AUDIT: SESSION,67,4,READ,SELECT,TABLE,public.aaa,"SELECT 1 FROM ONLY ""public"".""aaa"" x WHERE ""id"" OPERATOR(pg_catalog.=) $1 FOR KEY SHARE OF x", SET pgaudit.log_parameter TO ON; DROP TABLE bbb; DROP TABLE aaa; -- Test create table as after extension as been dropped DROP EXTENSION pgaudit; CREATE TABLE tmp (id int, data text); CREATE TABLE tmp2 AS (SELECT * FROM tmp); NOTICE: AUDIT: SESSION,68,1,READ,SELECT,TABLE,public.tmp,CREATE TABLE tmp2 AS (SELECT * FROM tmp), DROP TABLE tmp; DROP TABLE tmp2; -- -- Test MISC SET pgaudit.log = 'MISC'; NOTICE: AUDIT: SESSION,69,1,MISC,SET,,,SET pgaudit.log = 'MISC', SET pgaudit.log_level = 'notice'; NOTICE: AUDIT: SESSION,70,1,MISC,SET,,,SET pgaudit.log_level = 'notice', SET pgaudit.log_client = ON; NOTICE: AUDIT: SESSION,71,1,MISC,SET,,,SET pgaudit.log_client = ON, SET pgaudit.log_relation = ON; NOTICE: AUDIT: SESSION,72,1,MISC,SET,,,SET pgaudit.log_relation = ON, SET pgaudit.log_parameter = ON; NOTICE: AUDIT: SESSION,73,1,MISC,SET,,,SET pgaudit.log_parameter = ON, CREATE ROLE regress_alice; SET ROLE regress_alice; NOTICE: AUDIT: SESSION,74,1,MISC,SET,,,SET ROLE regress_alice, CREATE TABLE t (a int, b text); SET search_path TO test, public; NOTICE: AUDIT: SESSION,75,1,MISC,SET,,,"SET search_path TO test, public", INSERT INTO t VALUES (1, 'misc'); VACUUM t; NOTICE: AUDIT: SESSION,76,1,MISC,VACUUM,,,VACUUM t, RESET ROLE; NOTICE: AUDIT: SESSION,77,1,MISC,RESET,,,RESET ROLE, -- -- Test MISC_SET SET pgaudit.log = 'MISC_SET'; NOTICE: AUDIT: SESSION,78,1,MISC,SET,,,SET pgaudit.log = 'MISC_SET', SET ROLE regress_alice; NOTICE: AUDIT: SESSION,79,1,MISC,SET,,,SET ROLE regress_alice, SET search_path TO public; NOTICE: AUDIT: SESSION,80,1,MISC,SET,,,SET search_path TO public, INSERT INTO t VALUES (2, 'misc_set'); VACUUM t; RESET ROLE; NOTICE: AUDIT: SESSION,81,1,MISC,RESET,,,RESET ROLE, -- -- Test ALL, -MISC, MISC_SET SET pgaudit.log = 'ALL, -MISC, MISC_SET'; NOTICE: AUDIT: SESSION,82,1,MISC,SET,,,"SET pgaudit.log = 'ALL, -MISC, MISC_SET'", SET search_path TO public; NOTICE: AUDIT: SESSION,83,1,MISC,SET,,,SET search_path TO public, INSERT INTO t VALUES (3, 'all, -misc, misc_set'); NOTICE: AUDIT: SESSION,84,1,WRITE,INSERT,TABLE,public.t,"INSERT INTO t VALUES (3, 'all, -misc, misc_set')", VACUUM t; RESET ROLE; NOTICE: AUDIT: SESSION,85,1,MISC,RESET,,,RESET ROLE, DROP TABLE public.t; NOTICE: AUDIT: SESSION,86,1,DDL,DROP TABLE,,,DROP TABLE public.t, DROP ROLE regress_alice; NOTICE: AUDIT: SESSION,87,1,ROLE,DROP ROLE,,,DROP ROLE regress_alice, -- -- Test PARTITIONED table CREATE TABLE h(x int ,y int) PARTITION BY HASH(x); NOTICE: AUDIT: SESSION,88,1,DDL,CREATE TABLE,,,"CREATE TABLE h(x int ,y int) PARTITION BY HASH(x)", CREATE TABLE h_0 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 0); NOTICE: AUDIT: SESSION,89,1,DDL,CREATE TABLE,,,"CREATE TABLE h_0 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 0)", CREATE TABLE h_1 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 1); NOTICE: AUDIT: SESSION,90,1,DDL,CREATE TABLE,,,"CREATE TABLE h_1 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 1)", INSERT INTO h VALUES(1,1); NOTICE: AUDIT: SESSION,91,1,WRITE,INSERT,TABLE,public.h,"INSERT INTO h VALUES(1,1)", SELECT * FROM h; NOTICE: AUDIT: SESSION,92,1,READ,SELECT,TABLE,public.h,SELECT * FROM h, x | y ---+--- 1 | 1 (1 row) SELECT * FROM h_0; NOTICE: AUDIT: SESSION,93,1,READ,SELECT,TABLE,public.h_0,SELECT * FROM h_0, x | y ---+--- 1 | 1 (1 row) CREATE INDEX h_idx ON h (x); NOTICE: AUDIT: SESSION,94,1,DDL,CREATE INDEX,,,CREATE INDEX h_idx ON h (x), DROP INDEX h_idx; NOTICE: AUDIT: SESSION,95,1,DDL,DROP INDEX,,,DROP INDEX h_idx, DROP TABLE h; NOTICE: AUDIT: SESSION,96,1,DDL,DROP TABLE,,,DROP TABLE h, -- -- Test rows retrived or affected by statements \connect - :current_user SET pgaudit.log = 'all'; NOTICE: AUDIT: SESSION,1,1,MISC,SET,,,SET pgaudit.log = 'all', SET pgaudit.log_client = on; NOTICE: AUDIT: SESSION,2,1,MISC,SET,,,SET pgaudit.log_client = on, SET pgaudit.log_relation = on; NOTICE: AUDIT: SESSION,3,1,MISC,SET,,,SET pgaudit.log_relation = on, SET pgaudit.log_statement_once = off; NOTICE: AUDIT: SESSION,4,1,MISC,SET,,,SET pgaudit.log_statement_once = off, SET pgaudit.log_parameter = on; NOTICE: AUDIT: SESSION,5,1,MISC,SET,,,SET pgaudit.log_parameter = on, SET pgaudit.log_rows = on; NOTICE: AUDIT: SESSION,6,1,MISC,SET,,,SET pgaudit.log_rows = on,,0 -- -- Test DDL CREATE TABLE test2 ( id int, name text ); NOTICE: AUDIT: SESSION,7,1,DDL,CREATE TABLE,,,"CREATE TABLE test2 ( id int, name text )",,0 CREATE TABLE test3 ( id int, name text ); NOTICE: AUDIT: SESSION,8,1,DDL,CREATE TABLE,,,"CREATE TABLE test3 ( id int, name text )",,0 CREATE FUNCTION test2_insert() RETURNS TRIGGER AS $$ BEGIN UPDATE test2 SET id = id + 90 WHERE id = new.id; RETURN new; END $$ LANGUAGE plpgsql security definer; NOTICE: AUDIT: SESSION,9,1,DDL,CREATE FUNCTION,,,"CREATE FUNCTION test2_insert() RETURNS TRIGGER AS $$ BEGIN UPDATE test2 SET id = id + 90 WHERE id = new.id; RETURN new; END $$ LANGUAGE plpgsql security definer",,0 CREATE TRIGGER test2_insert_trg AFTER INSERT ON test2 FOR EACH ROW EXECUTE PROCEDURE test2_insert(); NOTICE: AUDIT: SESSION,10,1,DDL,CREATE TRIGGER,,,"CREATE TRIGGER test2_insert_trg AFTER INSERT ON test2 FOR EACH ROW EXECUTE PROCEDURE test2_insert()",,0 CREATE FUNCTION test2_change(change_id int) RETURNS void AS $$ BEGIN UPDATE test2 SET id = id + 1 WHERE id = change_id; END $$ LANGUAGE plpgsql security definer; NOTICE: AUDIT: SESSION,11,1,DDL,CREATE FUNCTION,,,"CREATE FUNCTION test2_change(change_id int) RETURNS void AS $$ BEGIN UPDATE test2 SET id = id + 1 WHERE id = change_id; END $$ LANGUAGE plpgsql security definer",,0 CREATE VIEW vw_test3 AS SELECT * FROM test3; NOTICE: AUDIT: SESSION,12,1,DDL,CREATE VIEW,,,"CREATE VIEW vw_test3 AS SELECT * FROM test3",,0 -- -- Test DML INSERT INTO test2 (id, name) VALUES (1, 'a'); NOTICE: AUDIT: SESSION,13,1,WRITE,UPDATE,TABLE,public.test2,"UPDATE test2 SET id = id + 90 WHERE id = new.id",",,,,,,,,,,,,,1",1 NOTICE: AUDIT: SESSION,13,2,WRITE,INSERT,TABLE,public.test2,"INSERT INTO test2 (id, name) VALUES (1, 'a')",,1 INSERT INTO test2 (id, name) VALUES (2, 'b'); NOTICE: AUDIT: SESSION,14,1,WRITE,UPDATE,TABLE,public.test2,"UPDATE test2 SET id = id + 90 WHERE id = new.id",",,,,,,,,,,,,,2",1 NOTICE: AUDIT: SESSION,14,2,WRITE,INSERT,TABLE,public.test2,"INSERT INTO test2 (id, name) VALUES (2, 'b')",,1 INSERT INTO test2 (id, name) VALUES (3, 'c'); NOTICE: AUDIT: SESSION,15,1,WRITE,UPDATE,TABLE,public.test2,"UPDATE test2 SET id = id + 90 WHERE id = new.id",",,,,,,,,,,,,,3",1 NOTICE: AUDIT: SESSION,15,2,WRITE,INSERT,TABLE,public.test2,"INSERT INTO test2 (id, name) VALUES (3, 'c')",,1 INSERT INTO test3 (id, name) VALUES (1, 'a'); NOTICE: AUDIT: SESSION,16,1,WRITE,INSERT,TABLE,public.test3,"INSERT INTO test3 (id, name) VALUES (1, 'a')",,1 INSERT INTO test3 (id, name) VALUES (2, 'b'); NOTICE: AUDIT: SESSION,17,1,WRITE,INSERT,TABLE,public.test3,"INSERT INTO test3 (id, name) VALUES (2, 'b')",,1 INSERT INTO test3 (id, name) VALUES (3, 'c'); NOTICE: AUDIT: SESSION,18,1,WRITE,INSERT,TABLE,public.test3,"INSERT INTO test3 (id, name) VALUES (3, 'c')",,1 SELECT * FROM test3, test2; NOTICE: AUDIT: SESSION,19,1,READ,SELECT,TABLE,public.test3,"SELECT * FROM test3, test2",,9 NOTICE: AUDIT: SESSION,19,1,READ,SELECT,TABLE,public.test2,"SELECT * FROM test3, test2",,9 id | name | id | name ----+------+----+------ 1 | a | 91 | a 1 | a | 92 | b 1 | a | 93 | c 2 | b | 91 | a 2 | b | 92 | b 2 | b | 93 | c 3 | c | 91 | a 3 | c | 92 | b 3 | c | 93 | c (9 rows) SELECT * FROM vw_test3, test2; NOTICE: AUDIT: SESSION,20,1,READ,SELECT,VIEW,public.vw_test3,"SELECT * FROM vw_test3, test2",,9 NOTICE: AUDIT: SESSION,20,1,READ,SELECT,TABLE,public.test2,"SELECT * FROM vw_test3, test2",,9 NOTICE: AUDIT: SESSION,20,1,READ,SELECT,TABLE,public.test3,"SELECT * FROM vw_test3, test2",,9 id | name | id | name ----+------+----+------ 1 | a | 91 | a 1 | a | 92 | b 1 | a | 93 | c 2 | b | 91 | a 2 | b | 92 | b 2 | b | 93 | c 3 | c | 91 | a 3 | c | 92 | b 3 | c | 93 | c (9 rows) SELECT * FROM test2 ORDER BY ID; NOTICE: AUDIT: SESSION,21,1,READ,SELECT,TABLE,public.test2,"SELECT * FROM test2 ORDER BY ID",,3 id | name ----+------ 91 | a 92 | b 93 | c (3 rows) UPDATE test2 SET name = 'd'; NOTICE: AUDIT: SESSION,22,1,WRITE,UPDATE,TABLE,public.test2,"UPDATE test2 SET name = 'd'",,3 UPDATE test3 SET name = 'd' WHERE id > 0; NOTICE: AUDIT: SESSION,23,1,WRITE,UPDATE,TABLE,public.test3,"UPDATE test3 SET name = 'd' WHERE id > 0",,3 SELECT 1 FROM ( SELECT relname FROM pg_class LIMIT 3 ) SUBQUERY; NOTICE: AUDIT: SESSION,24,1,READ,SELECT,TABLE,pg_catalog.pg_class,"SELECT 1 FROM ( SELECT relname FROM pg_class LIMIT 3 ) SUBQUERY",,3 ?column? ---------- 1 1 1 (3 rows) WITH CTE AS ( SELECT id FROM test2 ) INSERT INTO test3 SELECT id FROM cte; NOTICE: AUDIT: SESSION,25,1,WRITE,INSERT,TABLE,public.test3,"WITH CTE AS ( SELECT id FROM test2 ) INSERT INTO test3 SELECT id FROM cte",,3 NOTICE: AUDIT: SESSION,25,1,READ,SELECT,TABLE,public.test2,"WITH CTE AS ( SELECT id FROM test2 ) INSERT INTO test3 SELECT id FROM cte",,3 WITH CTE AS ( INSERT INTO test3 VALUES (1) RETURNING id ) INSERT INTO test2 SELECT id FROM cte; NOTICE: AUDIT: SESSION,26,1,WRITE,UPDATE,TABLE,public.test2,"UPDATE test2 SET id = id + 90 WHERE id = new.id",",,,,,,,,,,,,,1",1 NOTICE: AUDIT: SESSION,26,2,WRITE,INSERT,TABLE,public.test2,"WITH CTE AS ( INSERT INTO test3 VALUES (1) RETURNING id ) INSERT INTO test2 SELECT id FROM cte",,1 NOTICE: AUDIT: SESSION,26,2,WRITE,INSERT,TABLE,public.test3,"WITH CTE AS ( INSERT INTO test3 VALUES (1) RETURNING id ) INSERT INTO test2 SELECT id FROM cte",,1 DO $$ BEGIN PERFORM test2_change(91); END $$; NOTICE: AUDIT: SESSION,27,1,FUNCTION,DO,,,DO $$ BEGIN PERFORM test2_change(91); END $$,,0 NOTICE: AUDIT: SESSION,27,2,FUNCTION,EXECUTE,FUNCTION,public.test2_change,SELECT test2_change(91),,0 NOTICE: AUDIT: SESSION,27,3,WRITE,UPDATE,TABLE,public.test2,"UPDATE test2 SET id = id + 1 WHERE id = change_id","91,",2 NOTICE: AUDIT: SESSION,27,4,READ,SELECT,,,SELECT test2_change(91),,1 WITH CTE AS ( UPDATE test2 SET id = 45 WHERE id = 92 RETURNING id ) INSERT INTO test3 SELECT id FROM cte; NOTICE: AUDIT: SESSION,28,1,WRITE,INSERT,TABLE,public.test3,"WITH CTE AS ( UPDATE test2 SET id = 45 WHERE id = 92 RETURNING id ) INSERT INTO test3 SELECT id FROM cte",,3 NOTICE: AUDIT: SESSION,28,1,WRITE,UPDATE,TABLE,public.test2,"WITH CTE AS ( UPDATE test2 SET id = 45 WHERE id = 92 RETURNING id ) INSERT INTO test3 SELECT id FROM cte",,3 WITH CTE AS ( INSERT INTO test2 VALUES (37) RETURNING id ) UPDATE test3 SET id = cte.id FROM cte WHERE test3.id <> cte.id; NOTICE: AUDIT: SESSION,29,1,WRITE,UPDATE,TABLE,public.test2,"UPDATE test2 SET id = id + 90 WHERE id = new.id",",,,,,,,,,,,,,37",1 NOTICE: AUDIT: SESSION,29,2,WRITE,UPDATE,TABLE,public.test3,"WITH CTE AS ( INSERT INTO test2 VALUES (37) RETURNING id ) UPDATE test3 SET id = cte.id FROM cte WHERE test3.id <> cte.id",,10 NOTICE: AUDIT: SESSION,29,2,WRITE,INSERT,TABLE,public.test2,"WITH CTE AS ( INSERT INTO test2 VALUES (37) RETURNING id ) UPDATE test3 SET id = cte.id FROM cte WHERE test3.id <> cte.id",,10 DELETE FROM test2; NOTICE: AUDIT: SESSION,30,1,WRITE,DELETE,TABLE,public.test2,"DELETE FROM test2",,5 DELETE FROM test3 WHERE id > 0; NOTICE: AUDIT: SESSION,31,1,WRITE,DELETE,TABLE,public.test3,"DELETE FROM test3 WHERE id > 0",,10 -- -- Drop test tables DROP TABLE test2; NOTICE: AUDIT: SESSION,32,1,DDL,DROP TABLE,,,DROP TABLE test2,,0 DROP VIEW vw_test3; NOTICE: AUDIT: SESSION,33,1,DDL,DROP VIEW,,,DROP VIEW vw_test3,,0 DROP TABLE test3; NOTICE: AUDIT: SESSION,34,1,DDL,DROP TABLE,,,DROP TABLE test3,,0 DROP FUNCTION test2_insert(); NOTICE: AUDIT: SESSION,35,1,DDL,DROP FUNCTION,,,DROP FUNCTION test2_insert(),,0 DROP FUNCTION test2_change(int); NOTICE: AUDIT: SESSION,36,1,DDL,DROP FUNCTION,,,DROP FUNCTION test2_change(int),,0 -- -- Only object logging will be done SET pgaudit.log = 'none'; SET pgaudit.role = 'regress_auditor'; -- -- Select is session logged SELECT * FROM account; NOTICE: AUDIT: OBJECT,37,1,READ,SELECT,TABLE,public.account,"SELECT * FROM account",,1 id | name | password | description ----+---------------+----------+------------- 1 | regress_user1 | HASH2 | yada, yada (1 row) -- -- Insert is not logged INSERT INTO account (id, name, password, description) VALUES (1, 'regress_user2', 'HASH3', 'blah, blah2'); INSERT INTO account (id, name, password, description) VALUES (1, 'user3', 'HASH4', 'blah, blah3'); -- -- Not object logged SELECT id, name FROM account; id | name ----+--------------- 1 | regress_user1 1 | regress_user2 1 | user3 (3 rows) -- -- Object logged because of: -- select (password) on account SELECT password FROM account; NOTICE: AUDIT: OBJECT,38,1,READ,SELECT,TABLE,public.account,"SELECT password FROM account",,3 password ---------- HASH2 HASH3 HASH4 (3 rows) -- -- Not object logged UPDATE account SET description = 'yada, yada1'; -- -- Object logged because of: -- update (password) on account UPDATE account SET password = 'HASH4'; NOTICE: AUDIT: OBJECT,39,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET password = 'HASH4'",,3 -- -- Session relation logging will be done SET pgaudit.log_relation = on; SET pgaudit.log = 'read, write'; -- -- Object logged because of: -- select (password) on account -- select on account_role_map -- Session logged on all tables because log = read and log_relation = on SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id; NOTICE: AUDIT: OBJECT,40,1,READ,SELECT,TABLE,public.account,"SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id",,0 NOTICE: AUDIT: SESSION,40,1,READ,SELECT,TABLE,public.account,"SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id",,0 NOTICE: AUDIT: OBJECT,40,1,READ,SELECT,TABLE,public.account_role_map,"SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id",,0 NOTICE: AUDIT: SESSION,40,1,READ,SELECT,TABLE,public.account_role_map,"SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id",,0 password | role_id ----------+--------- (0 rows) -- -- Object logged because of: -- select (password) on account -- Session logged on all tables because log = read and log_relation = on SELECT password FROM account; NOTICE: AUDIT: OBJECT,41,1,READ,SELECT,TABLE,public.account,"SELECT password FROM account",,3 NOTICE: AUDIT: SESSION,41,1,READ,SELECT,TABLE,public.account,"SELECT password FROM account",,3 password ---------- HASH4 HASH4 HASH4 (3 rows) -- -- Not object logged -- Session logged on all tables because log = read and log_relation = on UPDATE account SET description = 'yada, yada2'; NOTICE: AUDIT: SESSION,42,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET description = 'yada, yada2'",,3 -- -- Object logged because of: -- select (password) on account (in the where clause) -- Session logged on all tables because log = read and log_relation = on UPDATE account SET description = 'yada, yada3' where password = 'HASH4'; NOTICE: AUDIT: OBJECT,43,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET description = 'yada, yada3' where password = 'HASH4'",,3 NOTICE: AUDIT: SESSION,43,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET description = 'yada, yada3' where password = 'HASH4'",,3 -- -- Object logged because of: -- update (password) on account -- Session logged on all tables because log = read and log_relation = on UPDATE account SET password = 'HASH4'; NOTICE: AUDIT: OBJECT,44,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET password = 'HASH4'",,3 NOTICE: AUDIT: SESSION,44,1,WRITE,UPDATE,TABLE,public.account,"UPDATE account SET password = 'HASH4'",,3 -- -- Exhaustive tests SET pgaudit.log = 'all'; NOTICE: AUDIT: SESSION,45,1,MISC,SET,,,SET pgaudit.log = 'all',,0 SET pgaudit.log_client = on; NOTICE: AUDIT: SESSION,46,1,MISC,SET,,,SET pgaudit.log_client = on,,0 SET pgaudit.log_relation = on; NOTICE: AUDIT: SESSION,47,1,MISC,SET,,,SET pgaudit.log_relation = on,,0 SET pgaudit.log_parameter = on; NOTICE: AUDIT: SESSION,48,1,MISC,SET,,,SET pgaudit.log_parameter = on,,0 SET pgaudit.log_rows = on; NOTICE: AUDIT: SESSION,49,1,MISC,SET,,,SET pgaudit.log_rows = on,,0 -- -- Simple DO block DO $$ BEGIN raise notice 'test'; END $$; NOTICE: AUDIT: SESSION,50,1,FUNCTION,DO,,,"DO $$ BEGIN raise notice 'test'; END $$",,0 NOTICE: test -- -- Copy account to stdout COPY account TO stdout; 1 regress_user1 HASH4 yada, yada3 1 regress_user2 HASH4 yada, yada3 1 user3 HASH4 yada, yada3 NOTICE: AUDIT: SESSION,51,1,READ,COPY,,,COPY account TO stdout,,0 -- -- Drop a table from a query DROP TABLE test.account_copy; NOTICE: AUDIT: SESSION,52,1,DDL,DROP TABLE,,,DROP TABLE test.account_copy,,0 -- -- Create a table from a query CREATE TABLE test.account_copy AS SELECT * FROM account; NOTICE: AUDIT: OBJECT,53,1,READ,SELECT,TABLE,public.account,"CREATE TABLE test.account_copy AS SELECT * FROM account",,3 NOTICE: AUDIT: SESSION,53,1,READ,SELECT,TABLE,public.account,"CREATE TABLE test.account_copy AS SELECT * FROM account",,3 NOTICE: AUDIT: SESSION,53,2,DDL,CREATE TABLE AS,,,"CREATE TABLE test.account_copy AS SELECT * FROM account",,0 -- -- Copy from stdin to account copy COPY test.account_copy from stdin; NOTICE: AUDIT: SESSION,54,1,WRITE,COPY,,,COPY test.account_copy from stdin,,0 -- -- Test prepared statement PREPARE pgclassstmt1 (oid) AS SELECT 1 FROM account WHERE id = $1; NOTICE: AUDIT: SESSION,55,1,READ,PREPARE,,,"PREPARE pgclassstmt1 (oid) AS SELECT 1 FROM account WHERE id = $1",,0 PREPARE pgclassstmt2 (oid) AS SELECT 2 FROM account WHERE id = $1; NOTICE: AUDIT: SESSION,56,1,READ,PREPARE,,,"PREPARE pgclassstmt2 (oid) AS SELECT 2 FROM account WHERE id = $1",,0 EXECUTE pgclassstmt2 (1); NOTICE: AUDIT: SESSION,57,1,READ,SELECT,TABLE,public.account,"PREPARE pgclassstmt2 (oid) AS SELECT 2 FROM account WHERE id = $1",1,3 NOTICE: AUDIT: SESSION,57,2,MISC,EXECUTE,,,EXECUTE pgclassstmt2 (1),,0 ?column? ---------- 2 2 2 (3 rows) EXECUTE pgclassstmt1 (1); NOTICE: AUDIT: SESSION,58,1,READ,SELECT,TABLE,public.account,"PREPARE pgclassstmt1 (oid) AS SELECT 1 FROM account WHERE id = $1",1,3 NOTICE: AUDIT: SESSION,58,2,MISC,EXECUTE,,,EXECUTE pgclassstmt1 (1),,0 ?column? ---------- 1 1 1 (3 rows) DEALLOCATE pgclassstmt2; NOTICE: AUDIT: SESSION,59,1,MISC,DEALLOCATE,,,DEALLOCATE pgclassstmt2,,0 DEALLOCATE pgclassstmt1; NOTICE: AUDIT: SESSION,60,1,MISC,DEALLOCATE,,,DEALLOCATE pgclassstmt1,,0 -- -- Test cursor BEGIN; NOTICE: AUDIT: SESSION,61,1,MISC,BEGIN,,,BEGIN,,0 DECLARE ctest1 SCROLL CURSOR FOR SELECT 1 FROM ( SELECT relname FROM pg_class LIMIT 3 ) subquery; NOTICE: AUDIT: SESSION,62,1,READ,DECLARE CURSOR,,,"DECLARE ctest1 SCROLL CURSOR FOR SELECT 1 FROM ( SELECT relname FROM pg_class LIMIT 3 ) subquery",,0 DECLARE ctest2 SCROLL CURSOR FOR SELECT 2 FROM ( SELECT relname FROM pg_class LIMIT 3 ) subquery; NOTICE: AUDIT: SESSION,63,1,READ,DECLARE CURSOR,,,"DECLARE ctest2 SCROLL CURSOR FOR SELECT 2 FROM ( SELECT relname FROM pg_class LIMIT 3 ) subquery",,0 FETCH NEXT FROM ctest1; NOTICE: AUDIT: SESSION,64,1,MISC,FETCH,,,FETCH NEXT FROM ctest1,,0 ?column? ---------- 1 (1 row) FETCH NEXT FROM ctest2; NOTICE: AUDIT: SESSION,65,1,MISC,FETCH,,,FETCH NEXT FROM ctest2,,0 ?column? ---------- 2 (1 row) FETCH NEXT FROM ctest1; NOTICE: AUDIT: SESSION,66,1,MISC,FETCH,,,FETCH NEXT FROM ctest1,,0 ?column? ---------- 1 (1 row) FETCH NEXT FROM ctest2; NOTICE: AUDIT: SESSION,67,1,MISC,FETCH,,,FETCH NEXT FROM ctest2,,0 ?column? ---------- 2 (1 row) FETCH NEXT FROM ctest1; NOTICE: AUDIT: SESSION,68,1,MISC,FETCH,,,FETCH NEXT FROM ctest1,,0 ?column? ---------- 1 (1 row) FETCH NEXT FROM ctest2; NOTICE: AUDIT: SESSION,69,1,MISC,FETCH,,,FETCH NEXT FROM ctest2,,0 ?column? ---------- 2 (1 row) CLOSE ctest2; NOTICE: AUDIT: SESSION,70,1,MISC,CLOSE CURSOR,,,CLOSE ctest2,,0 CLOSE ctest1; NOTICE: AUDIT: SESSION,71,1,MISC,CLOSE CURSOR,,,CLOSE ctest1,,0 COMMIT; NOTICE: AUDIT: SESSION,72,1,MISC,COMMIT,,,COMMIT,,0 -- -- Turn off log_catalog and pg_class will not be logged SET pgaudit.log_catalog = off; NOTICE: AUDIT: SESSION,73,1,MISC,SET,,,SET pgaudit.log_catalog = off,,0 SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) subquery; count ------- 1 (1 row) -- -- Test prepared insert DROP TABLE test.test_insert; NOTICE: AUDIT: SESSION,74,1,DDL,DROP TABLE,,,DROP TABLE test.test_insert,,0 -- -- Test prepared insert CREATE TABLE test.test_insert ( id INT ); NOTICE: AUDIT: SESSION,75,1,DDL,CREATE TABLE,,,"CREATE TABLE test.test_insert ( id INT )",,0 PREPARE pgclassstmt (oid) AS INSERT INTO test.test_insert (id) VALUES ($1); NOTICE: AUDIT: SESSION,76,1,WRITE,PREPARE,,,"PREPARE pgclassstmt (oid) AS INSERT INTO test.test_insert (id) VALUES ($1)",,0 EXECUTE pgclassstmt (1); NOTICE: AUDIT: SESSION,77,1,WRITE,INSERT,TABLE,test.test_insert,"PREPARE pgclassstmt (oid) AS INSERT INTO test.test_insert (id) VALUES ($1)",1,1 NOTICE: AUDIT: SESSION,77,2,MISC,EXECUTE,,,EXECUTE pgclassstmt (1),,0 -- -- Check that primary key creation is logged CREATE TABLE public.test ( id INT, name TEXT, description TEXT, CONSTRAINT test_pkey PRIMARY KEY (id) ); NOTICE: AUDIT: SESSION,78,1,DDL,CREATE TABLE,,,"CREATE TABLE public.test ( id INT, name TEXT, description TEXT, CONSTRAINT test_pkey PRIMARY KEY (id) )",,0 -- -- Check that analyze is logged ANALYZE test; NOTICE: AUDIT: SESSION,79,1,MISC,ANALYZE,,,ANALYZE test,,0 -- -- Grants to public should not cause object logging (session logging will -- still happen) GRANT SELECT ON TABLE public.test TO PUBLIC; NOTICE: AUDIT: SESSION,80,1,ROLE,GRANT,,,"GRANT SELECT ON TABLE public.test TO PUBLIC",,0 SELECT * FROM test; NOTICE: AUDIT: SESSION,81,1,READ,SELECT,TABLE,public.test,"SELECT * FROM test",,0 id | name | description ----+------+------------- (0 rows) -- Check that statements without columns log SELECT FROM test; NOTICE: AUDIT: SESSION,82,1,READ,SELECT,TABLE,public.test,"SELECT FROM test",,0 -- (0 rows) SELECT 1, substring('Thomas' from 2 for 3); NOTICE: AUDIT: SESSION,83,1,READ,SELECT,,,"SELECT 1, substring('Thomas' from 2 for 3)",,1 ?column? | substring ----------+----------- 1 | hom (1 row) DO $$ DECLARE test INT; BEGIN SELECT 1 INTO test; END $$; NOTICE: AUDIT: SESSION,84,1,FUNCTION,DO,,,"DO $$ DECLARE test INT; BEGIN SELECT 1 INTO test; END $$",,0 NOTICE: AUDIT: SESSION,84,2,READ,SELECT,,,SELECT 1,,1 explain select 1; NOTICE: AUDIT: SESSION,85,1,READ,SELECT,,,explain select 1,,0 NOTICE: AUDIT: SESSION,85,2,MISC,EXPLAIN,,,explain select 1,,0 QUERY PLAN ------------------------------------------ Result (cost=0.00..0.01 rows=1 width=4) (1 row) -- -- Test that looks inside of do blocks log INSERT INTO TEST (id) VALUES (1); NOTICE: AUDIT: SESSION,86,1,WRITE,INSERT,TABLE,public.test,"INSERT INTO TEST (id) VALUES (1)",,1 INSERT INTO TEST (id) VALUES (2); NOTICE: AUDIT: SESSION,87,1,WRITE,INSERT,TABLE,public.test,"INSERT INTO TEST (id) VALUES (2)",,1 INSERT INTO TEST (id) VALUES (3); NOTICE: AUDIT: SESSION,88,1,WRITE,INSERT,TABLE,public.test,"INSERT INTO TEST (id) VALUES (3)",,1 DO $$ DECLARE result RECORD; BEGIN FOR result IN SELECT id FROM test LOOP INSERT INTO test (id) VALUES (result.id + 100); END LOOP; END $$; NOTICE: AUDIT: SESSION,89,1,FUNCTION,DO,,,"DO $$ DECLARE result RECORD; BEGIN FOR result IN SELECT id FROM test LOOP INSERT INTO test (id) VALUES (result.id + 100); END LOOP; END $$",,0 NOTICE: AUDIT: SESSION,89,2,WRITE,INSERT,TABLE,public.test,"INSERT INTO test (id) VALUES (result.id + 100)",",,1",1 NOTICE: AUDIT: SESSION,89,3,WRITE,INSERT,TABLE,public.test,"INSERT INTO test (id) VALUES (result.id + 100)",",,2",1 NOTICE: AUDIT: SESSION,89,4,WRITE,INSERT,TABLE,public.test,"INSERT INTO test (id) VALUES (result.id + 100)",",,3",1 NOTICE: AUDIT: SESSION,89,5,READ,SELECT,TABLE,public.test,"SELECT id FROM test",,3 -- -- Test obfuscated dynamic sql for clean logging DO $$ DECLARE table_name TEXT = 'do_table'; BEGIN EXECUTE 'CREATE TABLE ' || table_name || ' ("weird name" INT)'; EXECUTE 'DROP table ' || table_name; END $$; NOTICE: AUDIT: SESSION,90,1,FUNCTION,DO,,,"DO $$ DECLARE table_name TEXT = 'do_table'; BEGIN EXECUTE 'CREATE TABLE ' || table_name || ' (""weird name"" INT)'; EXECUTE 'DROP table ' || table_name; END $$",,0 NOTICE: AUDIT: SESSION,90,2,DDL,CREATE TABLE,,,"CREATE TABLE do_table (""weird name"" INT)",,0 NOTICE: AUDIT: SESSION,90,3,DDL,DROP TABLE,,,DROP table do_table,,0 -- -- Generate an error and make sure the stack gets cleared DO $$ BEGIN CREATE TABLE bogus.test_block ( id INT ); END $$; NOTICE: AUDIT: SESSION,91,1,FUNCTION,DO,,,"DO $$ BEGIN CREATE TABLE bogus.test_block ( id INT ); END $$",,0 ERROR: schema "bogus" does not exist at character 14 -- -- Test alter table statements ALTER TABLE public.test DROP COLUMN description ; NOTICE: AUDIT: SESSION,92,1,DDL,ALTER TABLE,,,"ALTER TABLE public.test DROP COLUMN description",,0 ALTER TABLE public.test RENAME TO test2; NOTICE: AUDIT: SESSION,93,1,DDL,ALTER TABLE,,,"ALTER TABLE public.test RENAME TO test2",,0 ALTER TABLE public.test2 SET SCHEMA test; NOTICE: AUDIT: SESSION,94,1,DDL,ALTER TABLE,,,"ALTER TABLE public.test2 SET SCHEMA test",,0 ALTER TABLE test.test2 ADD COLUMN description TEXT; NOTICE: AUDIT: SESSION,95,1,DDL,ALTER TABLE,,,"ALTER TABLE test.test2 ADD COLUMN description TEXT",,0 ALTER TABLE test.test2 DROP COLUMN description; NOTICE: AUDIT: SESSION,96,1,DDL,ALTER TABLE,,,"ALTER TABLE test.test2 DROP COLUMN description",,0 DROP TABLE test.test2; NOTICE: AUDIT: SESSION,97,1,DDL,DROP TABLE,,,DROP TABLE test.test2,,0 -- -- Test multiple statements with one semi-colon CREATE SCHEMA foo1 CREATE TABLE foo1.bar1 (id int) CREATE TABLE foo1.baz1 (id int); NOTICE: AUDIT: SESSION,98,1,DDL,CREATE SCHEMA,,,"CREATE SCHEMA foo1 CREATE TABLE foo1.bar1 (id int) CREATE TABLE foo1.baz1 (id int)",,0 DROP TABLE foo1.bar1; NOTICE: AUDIT: SESSION,99,1,DDL,DROP TABLE,,,DROP TABLE foo1.bar1,,0 DROP TABLE foo1.baz1; NOTICE: AUDIT: SESSION,100,1,DDL,DROP TABLE,,,DROP TABLE foo1.baz1,,0 DROP SCHEMA foo1; NOTICE: AUDIT: SESSION,101,1,DDL,DROP SCHEMA,,,DROP SCHEMA foo1,,0 -- -- Test aggregate CREATE FUNCTION public.int_add1 ( a INT, b INT ) RETURNS INT LANGUAGE plpgsql AS $$ BEGIN return a + b; END $$; NOTICE: AUDIT: SESSION,102,1,DDL,CREATE FUNCTION,,,"CREATE FUNCTION public.int_add1 ( a INT, b INT ) RETURNS INT LANGUAGE plpgsql AS $$ BEGIN return a + b; END $$",,0 SELECT int_add1(1, 1); NOTICE: AUDIT: SESSION,103,1,FUNCTION,EXECUTE,FUNCTION,public.int_add1,"SELECT int_add1(1, 1)",,0 NOTICE: AUDIT: SESSION,103,2,READ,SELECT,,,"SELECT int_add1(1, 1)",,1 int_add1 ---------- 2 (1 row) CREATE AGGREGATE public.sum_test(INT) (SFUNC=public.int_add1, STYPE=INT, INITCOND='0'); NOTICE: AUDIT: SESSION,104,1,DDL,CREATE AGGREGATE,,,"CREATE AGGREGATE public.sum_test(INT) (SFUNC=public.int_add1, STYPE=INT, INITCOND='0')",,0 ALTER AGGREGATE public.sum_test(integer) RENAME TO sum_test3; NOTICE: AUDIT: SESSION,105,1,DDL,ALTER AGGREGATE,,,ALTER AGGREGATE public.sum_test(integer) RENAME TO sum_test3,,0 -- -- Test conversion CREATE CONVERSION public.conversion_test FOR 'latin1' TO 'utf8' FROM pg_catalog.iso8859_1_to_utf8; NOTICE: AUDIT: SESSION,106,1,DDL,CREATE CONVERSION,,,CREATE CONVERSION public.conversion_test FOR 'latin1' TO 'utf8' FROM pg_catalog.iso8859_1_to_utf8,,0 ALTER CONVERSION public.conversion_test RENAME TO conversion_test3; NOTICE: AUDIT: SESSION,107,1,DDL,ALTER CONVERSION,,,ALTER CONVERSION public.conversion_test RENAME TO conversion_test3,,0 -- -- Test create/alter/drop database CREATE DATABASE contrib_regression_pgaudit; NOTICE: AUDIT: SESSION,108,1,DDL,CREATE DATABASE,,,CREATE DATABASE contrib_regression_pgaudit,,0 ALTER DATABASE contrib_regression_pgaudit RENAME TO contrib_regression_pgaudit2; NOTICE: AUDIT: SESSION,109,1,DDL,ALTER DATABASE,,,ALTER DATABASE contrib_regression_pgaudit RENAME TO contrib_regression_pgaudit2,,0 DROP DATABASE contrib_regression_pgaudit2; NOTICE: AUDIT: SESSION,110,1,DDL,DROP DATABASE,,,DROP DATABASE contrib_regression_pgaudit2,,0 -- Test role as a substmt SET pgaudit.log = 'role'; CREATE TABLE t (); CREATE ROLE regress_alice; NOTICE: AUDIT: SESSION,111,1,ROLE,CREATE ROLE,,,CREATE ROLE regress_alice,,0 CREATE SCHEMA foo3 GRANT SELECT ON public.t TO regress_alice; drop table public.t; drop role regress_alice; NOTICE: AUDIT: SESSION,112,1,ROLE,DROP ROLE,,,drop role regress_alice,,0 -- -- Test for non-empty stack error CREATE OR REPLACE FUNCTION get_test_id(_ret REFCURSOR) RETURNS REFCURSOR LANGUAGE plpgsql IMMUTABLE AS $$ BEGIN OPEN _ret FOR SELECT 200; RETURN _ret; END $$; BEGIN; SELECT get_test_id('_ret'); get_test_id ------------- _ret (1 row) SELECT get_test_id('_ret2'); get_test_id ------------- _ret2 (1 row) FETCH ALL FROM _ret; ?column? ---------- 200 (1 row) FETCH ALL FROM _ret2; ?column? ---------- 200 (1 row) CLOSE _ret; CLOSE _ret2; END; -- -- Test that frees a memory context earlier than expected SET pgaudit.log = 'all'; NOTICE: AUDIT: SESSION,113,1,MISC,SET,,,SET pgaudit.log = 'all',,0 CREATE FUNCTION test1() RETURNS INT AS $$ DECLARE cur1 cursor for select * from hoge; tmp int; BEGIN OPEN cur1; FETCH cur1 into tmp; RETURN tmp; END $$ LANGUAGE plpgsql ; NOTICE: AUDIT: SESSION,114,1,DDL,CREATE FUNCTION,,,"CREATE FUNCTION test1() RETURNS INT AS $$ DECLARE cur1 cursor for select * from hoge; tmp int; BEGIN OPEN cur1; FETCH cur1 into tmp; RETURN tmp; END $$ LANGUAGE plpgsql",,0 SELECT test1(); NOTICE: AUDIT: SESSION,115,1,FUNCTION,EXECUTE,FUNCTION,public.test1,SELECT test1(),,0 NOTICE: AUDIT: SESSION,115,2,READ,SELECT,,,SELECT test1(),,1 test1 ------- (1 row) -- -- Delete all rows then delete 1 row SET pgaudit.log = 'write'; SET pgaudit.role = 'regress_auditor'; create table bar ( col int ); grant delete on bar to regress_auditor; insert into bar (col) values (1); NOTICE: AUDIT: SESSION,116,1,WRITE,INSERT,TABLE,public.bar,"insert into bar (col) values (1)",,1 delete from bar; NOTICE: AUDIT: OBJECT,117,1,WRITE,DELETE,TABLE,public.bar,delete from bar,,1 NOTICE: AUDIT: SESSION,117,1,WRITE,DELETE,TABLE,public.bar,delete from bar,,1 insert into bar (col) values (1); NOTICE: AUDIT: SESSION,118,1,WRITE,INSERT,TABLE,public.bar,"insert into bar (col) values (1)",,1 delete from bar where col = 1; NOTICE: AUDIT: OBJECT,119,1,WRITE,DELETE,TABLE,public.bar,"delete from bar where col = 1",,1 NOTICE: AUDIT: SESSION,119,1,WRITE,DELETE,TABLE,public.bar,"delete from bar where col = 1",,1 drop table bar; -- -- Test that FK references do not log but triggers still do SET pgaudit.log = 'read, write'; SET pgaudit.role TO 'regress_auditor'; CREATE TABLE aaa ( ID int primary key ); CREATE TABLE bbb ( id int references aaa(id) ); CREATE FUNCTION bbb_insert1() RETURNS TRIGGER AS $$ BEGIN UPDATE bbb set id = new.id + 1; RETURN new; END $$ LANGUAGE plpgsql; CREATE TRIGGER bbb_insert_trg1 AFTER INSERT ON bbb FOR EACH ROW EXECUTE PROCEDURE bbb_insert1(); GRANT SELECT, UPDATE ON aaa TO regress_auditor; GRANT UPDATE ON bbb TO regress_auditor; INSERT INTO aaa VALUES (generate_series(1,100)); NOTICE: AUDIT: SESSION,120,1,WRITE,INSERT,TABLE,public.aaa,"INSERT INTO aaa VALUES (generate_series(1,100))",,100 SET pgaudit.log_parameter TO OFF; INSERT INTO bbb VALUES (1); NOTICE: AUDIT: OBJECT,121,1,READ,SELECT,TABLE,public.aaa,"SELECT 1 FROM ONLY ""public"".""aaa"" x WHERE ""id"" OPERATOR(pg_catalog.=) $1 FOR KEY SHARE OF x",,1 NOTICE: AUDIT: SESSION,121,1,READ,SELECT,TABLE,public.aaa,"SELECT 1 FROM ONLY ""public"".""aaa"" x WHERE ""id"" OPERATOR(pg_catalog.=) $1 FOR KEY SHARE OF x",,1 NOTICE: AUDIT: OBJECT,121,2,READ,SELECT,TABLE,public.aaa,"SELECT 1 FROM ONLY ""public"".""aaa"" x WHERE ""id"" OPERATOR(pg_catalog.=) $1 FOR KEY SHARE OF x",,1 NOTICE: AUDIT: SESSION,121,2,READ,SELECT,TABLE,public.aaa,"SELECT 1 FROM ONLY ""public"".""aaa"" x WHERE ""id"" OPERATOR(pg_catalog.=) $1 FOR KEY SHARE OF x",,1 NOTICE: AUDIT: OBJECT,121,3,WRITE,UPDATE,TABLE,public.bbb,UPDATE bbb set id = new.id + 1,,1 NOTICE: AUDIT: SESSION,121,3,WRITE,UPDATE,TABLE,public.bbb,UPDATE bbb set id = new.id + 1,,1 NOTICE: AUDIT: SESSION,121,4,WRITE,INSERT,TABLE,public.bbb,INSERT INTO bbb VALUES (1),,1 SET pgaudit.log_parameter TO ON; DROP TABLE bbb; DROP TABLE aaa; -- -- Test MISC SET pgaudit.log = 'misc'; NOTICE: AUDIT: SESSION,122,1,MISC,SET,,,SET pgaudit.log = 'misc',,0 SET pgaudit.log_client = on; NOTICE: AUDIT: SESSION,123,1,MISC,SET,,,SET pgaudit.log_client = on,,0 SET pgaudit.log_relation = on; NOTICE: AUDIT: SESSION,124,1,MISC,SET,,,SET pgaudit.log_relation = on,,0 SET pgaudit.log_parameter = on; NOTICE: AUDIT: SESSION,125,1,MISC,SET,,,SET pgaudit.log_parameter = on,,0 CREATE ROLE regress_alice; SET ROLE regress_alice; NOTICE: AUDIT: SESSION,126,1,MISC,SET,,,SET ROLE regress_alice,,0 CREATE TABLE t (a int, b text); SET search_path TO test, public; NOTICE: AUDIT: SESSION,127,1,MISC,SET,,,"SET search_path TO test, public",,0 INSERT INTO t VALUES (1, 'misc'); VACUUM t; NOTICE: AUDIT: SESSION,128,1,MISC,VACUUM,,,VACUUM t,,0 RESET ROLE; NOTICE: AUDIT: SESSION,129,1,MISC,RESET,,,RESET ROLE,,0 -- -- Test MISC_SET SET pgaudit.log = 'MISC_SET'; NOTICE: AUDIT: SESSION,130,1,MISC,SET,,,SET pgaudit.log = 'MISC_SET',,0 SET ROLE regress_alice; NOTICE: AUDIT: SESSION,131,1,MISC,SET,,,SET ROLE regress_alice,,0 SET search_path TO public; NOTICE: AUDIT: SESSION,132,1,MISC,SET,,,SET search_path TO public,,0 INSERT INTO t VALUES (2, 'misc_set'); VACUUM t; RESET ROLE; NOTICE: AUDIT: SESSION,133,1,MISC,RESET,,,RESET ROLE,,0 -- -- Test ALL, -MISC, MISC_SET SET pgaudit.log = 'ALL, -MISC, MISC_SET'; NOTICE: AUDIT: SESSION,134,1,MISC,SET,,,"SET pgaudit.log = 'ALL, -MISC, MISC_SET'",,0 SET search_path TO public; NOTICE: AUDIT: SESSION,135,1,MISC,SET,,,SET search_path TO public,,0 INSERT INTO t VALUES (3, 'all, -misc, misc_set'); NOTICE: AUDIT: SESSION,136,1,WRITE,INSERT,TABLE,public.t,"INSERT INTO t VALUES (3, 'all, -misc, misc_set')",,1 VACUUM t; RESET ROLE; NOTICE: AUDIT: SESSION,137,1,MISC,RESET,,,RESET ROLE,,0 DROP TABLE public.t; NOTICE: AUDIT: SESSION,138,1,DDL,DROP TABLE,,,DROP TABLE public.t,,0 DROP ROLE regress_alice; NOTICE: AUDIT: SESSION,139,1,ROLE,DROP ROLE,,,DROP ROLE regress_alice,,0 -- -- Test PARTITIONED table CREATE TABLE h(x int ,y int) PARTITION BY HASH(x); NOTICE: AUDIT: SESSION,140,1,DDL,CREATE TABLE,,,"CREATE TABLE h(x int ,y int) PARTITION BY HASH(x)",,0 CREATE TABLE h_0 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 0); NOTICE: AUDIT: SESSION,141,1,DDL,CREATE TABLE,,,"CREATE TABLE h_0 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 0)",,0 CREATE TABLE h_1 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 1); NOTICE: AUDIT: SESSION,142,1,DDL,CREATE TABLE,,,"CREATE TABLE h_1 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 1)",,0 INSERT INTO h VALUES(1,1); NOTICE: AUDIT: SESSION,143,1,WRITE,INSERT,TABLE,public.h,"INSERT INTO h VALUES(1,1)",,1 SELECT * FROM h; NOTICE: AUDIT: SESSION,144,1,READ,SELECT,TABLE,public.h,SELECT * FROM h,,1 x | y ---+--- 1 | 1 (1 row) SELECT * FROM h_0; NOTICE: AUDIT: SESSION,145,1,READ,SELECT,TABLE,public.h_0,SELECT * FROM h_0,,1 x | y ---+--- 1 | 1 (1 row) CREATE INDEX h_idx ON h (x); NOTICE: AUDIT: SESSION,146,1,DDL,CREATE INDEX,,,CREATE INDEX h_idx ON h (x),,0 DROP INDEX h_idx; NOTICE: AUDIT: SESSION,147,1,DDL,DROP INDEX,,,DROP INDEX h_idx,,0 DROP TABLE h; NOTICE: AUDIT: SESSION,148,1,DDL,DROP TABLE,,,DROP TABLE h,,0 -- -- Change configuration of user 1 so that full statements are not logged \connect - :current_user ALTER ROLE regress_user1 RESET pgaudit.log_relation; NOTICE: AUDIT: SESSION,1,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 RESET pgaudit.log_relation, ALTER ROLE regress_user1 RESET pgaudit.log; NOTICE: AUDIT: SESSION,2,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 RESET pgaudit.log, ALTER ROLE regress_user1 SET pgaudit.log_statement = OFF; NOTICE: AUDIT: SESSION,3,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 SET pgaudit.log_statement = OFF, ALTER ROLE regress_user1 SET pgaudit.log_rows = on; NOTICE: AUDIT: SESSION,4,1,ROLE,ALTER ROLE,,,ALTER ROLE regress_user1 SET pgaudit.log_rows = on, \connect - regress_user1 -- -- Logged but without full statement SELECT * FROM account; NOTICE: AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.account,,,3 id | name | password | description ----+---------------+----------+------------- 1 | regress_user1 | HASH4 | yada, yada3 1 | regress_user2 | HASH4 | yada, yada3 1 | user3 | HASH4 | yada, yada3 (3 rows) -- -- Change back to superuser to do exhaustive tests \connect - :current_user -- -- Test that pgaudit event triggers are immune to search-path-based attacks -- Attempt to capture unqualified references to standard functions CREATE FUNCTION upper(text) RETURNS text LANGUAGE SQL AS 'SELECT (1/0)::text'; CREATE FUNCTION lower(text) RETURNS text LANGUAGE SQL AS 'SELECT (1/0)::text'; CREATE FUNCTION my_ne(text, text) RETURNS bool LANGUAGE SQL AS 'SELECT (1/0)::bool'; CREATE OPERATOR <> (FUNCTION = my_ne, LEFTARG = text, RIGHTARG = text); CREATE EXTENSION IF NOT EXISTS pgaudit; SET pgaudit.log = 'DDL'; -- Put public schema before pg_catalog to capture unqualified references SET search_path = public, pg_catalog; -- If there was a vulnerability, these would fail with division by zero error CREATE TABLE wombat (); NOTICE: AUDIT: SESSION,1,1,DDL,CREATE TABLE,TABLE,public.wombat,CREATE TABLE wombat (), DROP TABLE wombat; NOTICE: AUDIT: SESSION,2,1,DDL,DROP TABLE,TABLE,public.wombat,DROP TABLE wombat, SET pgaudit.log = 'NONE'; DROP EXTENSION pgaudit; DROP OPERATOR <> (text, text); DROP FUNCTION my_ne(text, text); DROP FUNCTION lower(text); DROP FUNCTION upper(text); -- Create/drop extension. Note that the log level here must be warning because the create extension code will reset any higher log -- levels like notice SET pgaudit.log = 'all,-misc_set'; SET pgaudit.log_level = 'warning'; CREATE EXTENSION pg_stat_statements; WARNING: AUDIT: SESSION,3,1,DDL,CREATE EXTENSION,,,CREATE EXTENSION pg_stat_statements, ALTER EXTENSION pg_stat_statements UPDATE TO '1.11'; WARNING: AUDIT: SESSION,4,1,DDL,ALTER EXTENSION,,,ALTER EXTENSION pg_stat_statements UPDATE TO '1.11', NOTICE: version "1.11" of extension "pg_stat_statements" is already installed DROP EXTENSION pg_stat_statements; WARNING: AUDIT: SESSION,5,1,DDL,DROP EXTENSION,,,DROP EXTENSION pg_stat_statements, SET pgaudit.log_level = 'notice'; -- Check that password redaction works with CREATE/ALTER USER MAPPING CREATE EXTENSION postgres_fdw; NOTICE: AUDIT: SESSION,6,1,DDL,CREATE EXTENSION,,,CREATE EXTENSION postgres_fdw, CREATE SERVER fdw_server FOREIGN DATA WRAPPER postgres_fdw OPTIONS (host 'foo', dbname 'foodb', port '5432'); NOTICE: AUDIT: SESSION,7,1,DDL,CREATE SERVER,,,"CREATE SERVER fdw_server FOREIGN DATA WRAPPER postgres_fdw OPTIONS (host 'foo', dbname 'foodb', port '5432')", CREATE USER MAPPING FOR regress_user1 SERVER fdw_server OPTIONS (user 'regress_user1', password 'secret'); NOTICE: AUDIT: SESSION,8,1,ROLE,CREATE USER MAPPING,,,"CREATE USER MAPPING FOR regress_user1 SERVER fdw_server OPTIONS (user 'regress_user1', password ", ALTER USER MAPPING FOR regress_user1 SERVER fdw_server OPTIONS (SET /* comment */ password 'secret2'); NOTICE: AUDIT: SESSION,9,1,ROLE,ALTER USER MAPPING,,,ALTER USER MAPPING FOR regress_user1 SERVER fdw_server OPTIONS (SET /* comment */ password , DROP USER MAPPING FOR regress_user1 SERVER fdw_server; NOTICE: AUDIT: SESSION,10,1,DDL,DROP USER MAPPING,,,DROP USER MAPPING FOR regress_user1 SERVER fdw_server, DROP SERVER fdw_server; NOTICE: AUDIT: SESSION,11,1,DDL,DROP SERVER,,,DROP SERVER fdw_server, DROP EXTENSION postgres_fdw; NOTICE: AUDIT: SESSION,12,1,DDL,DROP EXTENSION,,,DROP EXTENSION postgres_fdw, -- Cleanup -- Set client_min_messages up to warning to avoid noise SET client_min_messages = 'warning'; ALTER ROLE :current_user RESET pgaudit.log; ALTER ROLE :current_user RESET pgaudit.log_catalog; ALTER ROLE :current_user RESET pgaudit.log_client; ALTER ROLE :current_user RESET pgaudit.log_level; ALTER ROLE :current_user RESET pgaudit.log_parameter; ALTER ROLE :current_user RESET pgaudit.log_parameter_max_size; ALTER ROLE :current_user RESET pgaudit.log_relation; ALTER ROLE :current_user RESET pgaudit.log_statement; ALTER ROLE :current_user RESET pgaudit.log_statement_once; ALTER ROLE :current_user RESET pgaudit.role; RESET pgaudit.log; RESET pgaudit.log_catalog; RESET pgaudit.log_level; RESET pgaudit.log_parameter; RESET pgaudit.log_parameter_max_size; RESET pgaudit.log_relation; RESET pgaudit.log_statement; RESET pgaudit.log_statement_once; RESET pgaudit.role; DROP TABLE test.account_copy; DROP TABLE test.test_insert; DROP SCHEMA test; DROP TABLE foo.bar; DROP TABLE foo.baz; DROP SCHEMA foo; DROP TABLE hoge; DROP TABLE account; DROP TABLE account_role_map; DROP USER regress_user2; DROP USER regress_user1; DROP ROLE regress_auditor; RESET client_min_messages; pgaudit-17.1/pgaudit--17.0--17.1.sql000066400000000000000000000002101475542732400163640ustar00rootroot00000000000000-- complain if script is sourced in psql, rather than via CREATE EXTENSION \echo Use "CREATE EXTENSION pgaudit" to load this file.\quit pgaudit-17.1/pgaudit--17.1.sql000066400000000000000000000012731475542732400157360ustar00rootroot00000000000000-- complain if script is sourced in psql, rather than via CREATE EXTENSION \echo Use "CREATE EXTENSION pgaudit" to load this file.\quit CREATE FUNCTION pgaudit_ddl_command_end() RETURNS event_trigger SECURITY DEFINER SET search_path = 'pg_catalog, pg_temp' LANGUAGE C AS 'MODULE_PATHNAME', 'pgaudit_ddl_command_end'; CREATE EVENT TRIGGER pgaudit_ddl_command_end ON ddl_command_end EXECUTE PROCEDURE pgaudit_ddl_command_end(); CREATE FUNCTION pgaudit_sql_drop() RETURNS event_trigger SECURITY DEFINER SET search_path = 'pg_catalog, pg_temp' LANGUAGE C AS 'MODULE_PATHNAME', 'pgaudit_sql_drop'; CREATE EVENT TRIGGER pgaudit_sql_drop ON sql_drop EXECUTE PROCEDURE pgaudit_sql_drop(); pgaudit-17.1/pgaudit.c000066400000000000000000002252071475542732400147250ustar00rootroot00000000000000/*------------------------------------------------------------------------------ * pgaudit.c * * An audit logging extension for PostgreSQL. Provides detailed logging classes, * object level logging, and fully-qualified object names for all DML and DDL * statements where possible (See README.md for details). * * Copyright (c) 2014-2025, PostgreSQL Global Development Group *------------------------------------------------------------------------------ */ #include "postgres.h" #include "access/htup_details.h" #include "access/sysattr.h" #include "access/xact.h" #include "access/relation.h" #include "catalog/catalog.h" #include "catalog/objectaccess.h" #include "catalog/pg_class.h" #include "catalog/namespace.h" #include "commands/dbcommands.h" #include "commands/extension.h" #include "catalog/pg_proc.h" #include "commands/event_trigger.h" #include "executor/executor.h" #include "executor/spi.h" #include "miscadmin.h" #include "libpq/auth.h" #include "nodes/nodes.h" #include "nodes/params.h" #include "parser/parse_relation.h" #include "tcop/utility.h" #include "tcop/deparse_utility.h" #include "utils/acl.h" #include "utils/builtins.h" #include "utils/guc.h" #include "utils/lsyscache.h" #include "utils/memutils.h" #include "utils/rel.h" #include "utils/syscache.h" #include "utils/timestamp.h" #include "utils/varlena.h" PG_MODULE_MAGIC; void _PG_init(void); PG_FUNCTION_INFO_V1(pgaudit_ddl_command_end); PG_FUNCTION_INFO_V1(pgaudit_sql_drop); /* * Log Classes * * pgAudit categorizes actions into classes (eg: DDL, FUNCTION calls, READ * queries, WRITE queries). A GUC is provided for the administrator to * configure which class (or classes) of actions to include in the * audit log. We track the currently active set of classes using * auditLogBitmap. */ /* Bits within auditLogBitmap, defines the classes we understand */ #define LOG_DDL (1 << 0) /* CREATE/DROP/ALTER objects */ #define LOG_FUNCTION (1 << 1) /* Functions and DO blocks */ #define LOG_MISC (1 << 2) /* Statements not covered */ #define LOG_READ (1 << 3) /* SELECTs */ #define LOG_ROLE (1 << 4) /* GRANT/REVOKE, CREATE/ALTER/DROP ROLE */ #define LOG_WRITE (1 << 5) /* INSERT, UPDATE, DELETE, TRUNCATE */ #define LOG_MISC_SET (1 << 6) /* SET ... */ #define LOG_NONE 0 /* nothing */ #define LOG_ALL (0xFFFFFFFF) /* All */ /* GUC variable for pgaudit.log, which defines the classes to log. */ static char *auditLog = NULL; /* Bitmap of classes selected */ static int auditLogBitmap = LOG_NONE; /* * String constants for log classes - used when processing tokens in the * pgaudit.log GUC. */ #define CLASS_DDL "DDL" #define CLASS_FUNCTION "FUNCTION" #define CLASS_MISC "MISC" #define CLASS_MISC_SET "MISC_SET" #define CLASS_READ "READ" #define CLASS_ROLE "ROLE" #define CLASS_WRITE "WRITE" #define CLASS_NONE "NONE" #define CLASS_ALL "ALL" /* * GUC variable for pgaudit.log_catalog * * Administrators can choose to NOT log queries when all relations used in * the query are in pg_catalog. Interactive sessions (eg: psql) can cause * a lot of noise in the logs which might be uninteresting. */ static bool auditLogCatalog = true; /* * GUC variable for pgaudit.log_client * * Specifies whether audit messages should be visible to the client. This * setting should generally be left disabled but may be useful for debugging or * other purposes. */ static bool auditLogClient = false; /* * GUC variable for pgaudit.log_level * * Administrators can choose which log level the audit log is to be logged * at. The default level is LOG, which goes into the server log but does * not go to the client. Set to NOTICE in the regression tests. */ static char *auditLogLevelString = NULL; static int auditLogLevel = LOG; /* * GUC variable for pgaudit.log_parameter * * Administrators can choose if parameters passed into a statement are * included in the audit log. */ static bool auditLogParameter = false; /* * GUC variable for pgaudit.log_relation * * Administrators can choose, in SESSION logging, to log each relation involved * in READ/WRITE class queries. By default, SESSION logs include the query but * do not have a log entry for each relation. */ static bool auditLogRelation = false; /* * GUC variable for pgaudit.log_parameter_max_size * * Administrators can choose to prevent the logging of large variable-length * parameters. If set to 0 (the default), all parameters are logged. If set * greater than 0, variable length parameters (before character output) whose * size is greater than the specified number of bytes will be replaced * by a placeholder. */ static int auditLogParameterMaxSize = 0; /* * GUC variable for pgaudit.log_rows * * Administrators can choose if the rows retrieved or affected by a statement * are included in the audit log. */ static bool auditLogRows = false; /* * GUC variable for pgaudit.log_statement * * Administrators can choose to not have the full statement text logged. */ static bool auditLogStatement = true; /* * GUC variable for pgaudit.log_statement_once * * Administrators can choose to have the statement run logged only once instead * of on every line. By default, the statement is repeated on every line of * the audit log to facilitate searching, but this can cause the log to be * unnecessarily bloated in some environments. */ static bool auditLogStatementOnce = false; /* * GUC variable for pgaudit.role * * Administrators can choose which role to base OBJECT auditing off of. * Object-level auditing uses the privileges which are granted to this role to * determine if a statement should be logged. */ static char *auditRole = NULL; /* * String constants for the audit log fields. */ /* * Audit type, which is responsbile for the log message */ #define AUDIT_TYPE_OBJECT "OBJECT" #define AUDIT_TYPE_SESSION "SESSION" /* * Object type, used for SELECT/DML statements and function calls. * * For relation objects, this is essentially relkind (though we do not have * access to a function which will just return a string given a relkind; * getRelationTypeDescription() comes close but is not public currently). * * We also handle functions, so it isn't quite as simple as just relkind. * * This should be kept consistent with what is returned from * pg_event_trigger_ddl_commands(), as that's what we use for DDL. */ #define OBJECT_TYPE_TABLE "TABLE" #define OBJECT_TYPE_INDEX "INDEX" #define OBJECT_TYPE_SEQUENCE "SEQUENCE" #define OBJECT_TYPE_TOASTVALUE "TOAST TABLE" #define OBJECT_TYPE_VIEW "VIEW" #define OBJECT_TYPE_MATVIEW "MATERIALIZED VIEW" #define OBJECT_TYPE_COMPOSITE_TYPE "COMPOSITE TYPE" #define OBJECT_TYPE_FOREIGN_TABLE "FOREIGN TABLE" #define OBJECT_TYPE_FUNCTION "FUNCTION" #define OBJECT_TYPE_UNKNOWN "UNKNOWN" /* * String constants used for redacting text after the password token in * CREATE/ALTER ROLE commands. */ #define TOKEN_PASSWORD "password" #define TOKEN_REDACTED "" /* * An AuditEvent represents an operation that potentially affects a single * object. If a statement affects multiple objects then multiple AuditEvents * are created to represent them. */ typedef struct { int64 statementId; /* Simple counter */ int64 substatementId; /* Simple counter */ LogStmtLevel logStmtLevel; /* From GetCommandLogLevel when possible, generated when not. */ NodeTag commandTag; /* same here */ int command; /* same here */ const char *objectType; /* From event trigger when possible, generated when not. */ char *objectName; /* Fully qualified object identification */ const char *commandText; /* sourceText / queryString */ int commandLen; /* Length of commandText */ ParamListInfo paramList; /* QueryDesc/ProcessUtility parameters */ bool granted; /* Audit role has object permissions? */ bool logged; /* Track if we have logged this event, used post-ProcessUtility to make sure we log */ bool statementLogged; /* Track if we have logged the statement */ int64 rows; /* Track rows processed by the statement */ MemoryContext queryContext; /* Context for query tracking rows */ Oid auditOid; /* Role running query tracking rows */ List *rangeTabls; /* Tables in query tracking rows */ List *permInfos; /* Permission info rows for each table involved in the query */ } AuditEvent; /* * A simple FIFO queue to keep track of the current stack of audit events. */ typedef struct AuditEventStackItem { struct AuditEventStackItem *next; AuditEvent auditEvent; int64 stackId; MemoryContext contextAudit; MemoryContextCallback contextCallback; } AuditEventStackItem; static AuditEventStackItem *auditEventStack = NULL; /* * pgAudit runs queries of its own when using the event trigger system. * * Track when we are running a query and don't log it. */ static bool internalStatement = false; /* * Track running total for statements and substatements and whether or not * anything has been logged since the current statement began. */ static int64 statementTotal = 0; static int64 substatementTotal = 0; static int64 stackTotal = 0; static bool statementLogged = false; /* * Stack functions * * Audit events can go down to multiple levels so a stack is maintained to keep * track of them. */ /* * Respond to callbacks registered with MemoryContextRegisterResetCallback(). * Removes the event(s) off the stack that have become obsolete once the * MemoryContext has been freed. The callback should always be freeing the top * of the stack, but the code is tolerant of out-of-order callbacks. */ static void stack_free(void *stackFree) { AuditEventStackItem *nextItem = auditEventStack; /* Only process if the stack contains items */ while (nextItem != NULL) { /* Check if this item matches the item to be freed */ if (nextItem == (AuditEventStackItem *) stackFree) { /* Move top of stack to the item after the freed item */ auditEventStack = nextItem->next; /* If the stack is not empty */ if (auditEventStack == NULL) { /* * Reset internal statement to false. Normally this will be * reset but in case of an error it might be left set. */ internalStatement = false; /* * Reset sub statement total so the next statement will start * from 1. */ substatementTotal = 0; /* * Reset statement logged so that next statement will be * logged. */ statementLogged = false; } return; } nextItem = nextItem->next; } } /* * Push a new audit event onto the stack and create a new memory context to * store it. */ static AuditEventStackItem * stack_push() { MemoryContext contextAudit; MemoryContext contextOld; AuditEventStackItem *stackItem; /* * Create a new memory context to contain the stack item. This will be * free'd on stack_pop, or by our callback when the parent context is * destroyed. */ contextAudit = AllocSetContextCreate(CurrentMemoryContext, "pgaudit stack context", ALLOCSET_DEFAULT_SIZES); /* Save the old context to switch back to at the end */ contextOld = MemoryContextSwitchTo(contextAudit); /* Create our new stack item in our context */ stackItem = palloc0(sizeof(AuditEventStackItem)); stackItem->contextAudit = contextAudit; stackItem->stackId = ++stackTotal; /* * Setup a callback in case an error happens. stack_free() will truncate * the stack at this item. */ stackItem->contextCallback.func = stack_free; stackItem->contextCallback.arg = (void *) stackItem; MemoryContextRegisterResetCallback(contextAudit, &stackItem->contextCallback); /* Push new item onto the stack */ if (auditEventStack != NULL) stackItem->next = auditEventStack; else stackItem->next = NULL; auditEventStack = stackItem; MemoryContextSwitchTo(contextOld); return stackItem; } /* * Pop an audit event from the stack by deleting the memory context that * contains it. The callback to stack_free() does the actual pop. */ static void stack_pop(int64 stackId) { /* Make sure what we want to delete is at the top of the stack */ if (auditEventStack != NULL && auditEventStack->stackId == stackId) MemoryContextDelete(auditEventStack->contextAudit); else elog(ERROR, "pgaudit stack item " INT64_FORMAT " not found on top - cannot pop", stackId); } /* * Check that an item is on the stack. If not, an error will be raised since * this is a bad state to be in and it might mean audit records are being lost. */ static void stack_valid(int64 stackId) { AuditEventStackItem *nextItem = auditEventStack; /* Look through the stack for the stack entry */ while (nextItem != NULL && nextItem->stackId != stackId) nextItem = nextItem->next; /* If we didn't find it, something went wrong. */ if (nextItem == NULL) elog(ERROR, "pgaudit stack item " INT64_FORMAT " not found - top of stack is " INT64_FORMAT "", stackId, auditEventStack == NULL ? (int64) -1 : auditEventStack->stackId); } /* * Find an item on the stack by the specified query memory context. */ static AuditEventStackItem * stack_find_context(MemoryContext findContext) { AuditEventStackItem *nextItem = auditEventStack; /* Look through the stack for the stack entry by query memory context */ while (nextItem != NULL) { if (nextItem->auditEvent.queryContext == findContext) break; nextItem = nextItem->next; } return nextItem; } /* * Set command text. */ static void command_text_set(AuditEvent *auditEvent, const char *commandText, int commandLoc, int commandLen) { /* If statements are being logged then set command text. */ if (auditLogStatement) { char commandChr; /* If location is not -1 then offset. */ if (commandLoc != -1) commandText += commandLoc; /* If len is zero then use the entire string. */ if (commandLen == 0) commandLen = strlen(commandText); /* * Trim leading whitespace. This assumes that commandText is a valid * zero-terminated string. */ commandChr = *commandText; while (commandChr == ' ' || commandChr == '\t' || commandChr == '\n' || commandChr == '\r') { commandText++; commandLen--; commandChr = *commandText; } /* * Trim trailing whitespace. Also trim trailing semicolons since they * might be included if commandLen was not provided. This makes output * consistent with when commandLen is provided. */ commandChr = *(commandText + commandLen - 1); while (commandLen > 0 && (commandChr == ' ' || commandChr == ';' || commandChr == '\t' || commandChr == '\n' || commandChr == '\r')) { commandLen--; commandChr = *(commandText + commandLen - 1); } /* Assign final command text and length. */ auditEvent->commandText = commandText; auditEvent->commandLen = commandLen; } } /* * Appends a properly quoted CSV field to StringInfo. */ static void append_valid_csv(StringInfoData *buffer, const char *appendStr) { const char *pChar; /* * If the append string is null then do nothing. NULL fields are not * quoted in CSV. */ if (appendStr == NULL) return; /* Only format for CSV if appendStr contains: ", comma, \n, \r */ if (strstr(appendStr, ",") || strstr(appendStr, "\"") || strstr(appendStr, "\n") || strstr(appendStr, "\r")) { appendStringInfoCharMacro(buffer, '"'); for (pChar = appendStr; *pChar; pChar++) { if (*pChar == '"') /* double single quotes */ appendStringInfoCharMacro(buffer, *pChar); appendStringInfoCharMacro(buffer, *pChar); } appendStringInfoCharMacro(buffer, '"'); } /* Else just append */ else appendStringInfoString(buffer, appendStr); } /* * Takes an AuditEvent, classifies it, then logs it if appropriate. * * Logging is decided based on if the statement is in one of the classes being * logged or if an object used has been marked for auditing. * * Objects are marked for auditing by the auditor role being granted access * to the object. The kind of access (INSERT, UPDATE, etc) is also considered * and logging is only performed when the kind of access matches the granted * right on the object. * * This will need to be updated if new kinds of GRANTs are added. */ static void log_audit_event(AuditEventStackItem *stackItem) { /* By default, put everything in the MISC class. */ int class = LOG_MISC; const char *className = CLASS_MISC; MemoryContext contextOld; StringInfoData auditStr; /* * Skip logging script statements if an extension is currently being created * or altered. PostgreSQL reports the statement text for each statement in * the script as the entire script text, which can blow up the logs. The * create/alter statement will still be logged. * * Since a superuser is responsible for determining which extensions are * available, and in most cases installing them, it should not be necessary * to log each statement in the script. */ if (creating_extension) return; /* If this event has already been logged don't log it again */ if (stackItem->auditEvent.logged) return; /* Classify the statement using log stmt level and the command tag */ switch (stackItem->auditEvent.logStmtLevel) { /* All mods go in WRITE class, except EXECUTE */ case LOGSTMT_MOD: className = CLASS_WRITE; class = LOG_WRITE; switch (stackItem->auditEvent.commandTag) { /* Currently, only EXECUTE is different */ case T_ExecuteStmt: className = CLASS_MISC; class = LOG_MISC; break; default: break; } break; /* These are DDL, unless they are ROLE */ case LOGSTMT_DDL: className = CLASS_DDL; class = LOG_DDL; /* Identify role statements */ switch (stackItem->auditEvent.commandTag) { /* In the case of create and alter role or user mapping redact all text in the * command after the password token for security. This doesn't * cover all possible cases where passwords can be leaked but * should take care of the most common usage. */ case T_CreateRoleStmt: case T_AlterRoleStmt: case T_CreateUserMappingStmt: case T_AlterUserMappingStmt: if (stackItem->auditEvent.commandText != NULL) { char *commandStr; char *passwordToken; int i; int passwordPos; /* Copy the command string and convert to lower case */ commandStr = pnstrdup(stackItem->auditEvent.commandText, stackItem->auditEvent.commandLen); for (i = 0; commandStr[i]; i++) commandStr[i] = (char)pg_tolower((unsigned char)commandStr[i]); /* Find index of password token */ passwordToken = strstr(commandStr, TOKEN_PASSWORD); if (passwordToken != NULL) { /* Copy command string up to password token */ passwordPos = (passwordToken - commandStr) + strlen(TOKEN_PASSWORD); commandStr = palloc(passwordPos + 1 + strlen(TOKEN_REDACTED) + 1); strncpy(commandStr, stackItem->auditEvent.commandText, passwordPos); /* And append redacted token */ commandStr[passwordPos] = ' '; strcpy(commandStr + passwordPos + 1, TOKEN_REDACTED); /* Assign new command string */ stackItem->auditEvent.commandText = commandStr; stackItem->auditEvent.commandLen = strlen(commandStr); } } /* Fall through */ /* Classify role statements */ case T_GrantStmt: case T_GrantRoleStmt: case T_DropRoleStmt: case T_AlterRoleSetStmt: case T_AlterDefaultPrivilegesStmt: className = CLASS_ROLE; class = LOG_ROLE; break; /* * Rename and Drop are general and therefore we have to do * an additional check against the command string to see * if they are role or regular DDL. */ case T_RenameStmt: case T_DropStmt: if (stackItem->auditEvent.command == CMDTAG_ALTER_ROLE || stackItem->auditEvent.command == CMDTAG_DROP_ROLE) { className = CLASS_ROLE; class = LOG_ROLE; } break; default: break; } break; /* Classify the rest */ case LOGSTMT_ALL: switch (stackItem->auditEvent.commandTag) { /* READ statements */ case T_CopyStmt: case T_DeclareCursorStmt: case T_SelectStmt: case T_PrepareStmt: case T_PlannedStmt: className = CLASS_READ; class = LOG_READ; break; /* FUNCTION statements */ case T_DoStmt: className = CLASS_FUNCTION; class = LOG_FUNCTION; break; /* * SET statements reported as MISC but filtered by MISC_SET * flags to maintain existing functionality. */ case T_VariableSetStmt: className = CLASS_MISC; class = LOG_MISC_SET; break; default: break; } break; case LOGSTMT_NONE: break; } /* * Only log the statement if: * * 1. The object was selected for audit logging (granted), or * 2. The statement belongs to a class that is being logged * * If neither of these is true, return. */ if (!stackItem->auditEvent.granted && !(auditLogBitmap & class)) return; /* * Use audit memory context in case something is not free'd while * appending strings and parameters. */ contextOld = MemoryContextSwitchTo(stackItem->contextAudit); /* Set statement and substatement IDs */ if (stackItem->auditEvent.statementId == 0) { /* If nothing has been logged yet then create a new statement Id */ if (!statementLogged) { statementTotal++; statementLogged = true; } stackItem->auditEvent.statementId = statementTotal; stackItem->auditEvent.substatementId = ++substatementTotal; } /* * Create the audit substring * * The type-of-audit-log and statement/substatement ID are handled below, * this string is everything else. */ initStringInfo(&auditStr); append_valid_csv(&auditStr, GetCommandTagName(stackItem->auditEvent.command)); appendStringInfoCharMacro(&auditStr, ','); append_valid_csv(&auditStr, stackItem->auditEvent.objectType); appendStringInfoCharMacro(&auditStr, ','); append_valid_csv(&auditStr, stackItem->auditEvent.objectName); /* * If auditLogStatementOnce is true, then only log the statement and * parameters if they have not already been logged for this substatement. */ appendStringInfoCharMacro(&auditStr, ','); if (auditLogStatement && !(stackItem->auditEvent.statementLogged && auditLogStatementOnce)) { /* Log the command. */ char *commandStr = pnstrdup(stackItem->auditEvent.commandText, stackItem->auditEvent.commandLen); append_valid_csv(&auditStr, commandStr); appendStringInfoCharMacro(&auditStr, ','); pfree(commandStr); /* Handle parameter logging, if enabled. */ if (auditLogParameter) { int paramIdx; int numParams; StringInfoData paramStrResult; ParamListInfo paramList = stackItem->auditEvent.paramList; numParams = paramList == NULL ? 0 : paramList->numParams; /* Create the param substring */ initStringInfo(¶mStrResult); /* Iterate through all params */ for (paramIdx = 0; paramList != NULL && paramIdx < numParams; paramIdx++) { ParamExternData *prm = ¶mList->params[paramIdx]; Oid typeOutput; bool typeIsVarLena; /* Add a comma for each param */ if (paramIdx != 0) appendStringInfoCharMacro(¶mStrResult, ','); /* Skip if null or if oid is invalid */ if (prm->isnull || !OidIsValid(prm->ptype)) continue; /* * Append the param, suppressing long params if the appropriate * GUC is set. */ getTypeOutputInfo(prm->ptype, &typeOutput, &typeIsVarLena); if (auditLogParameterMaxSize > 0 && typeIsVarLena && VARSIZE_ANY_EXHDR(prm->value) > auditLogParameterMaxSize) { append_valid_csv(¶mStrResult, ""); } else { char *paramStr = OidOutputFunctionCall(typeOutput, prm->value); append_valid_csv(¶mStrResult, paramStr); pfree(paramStr); } } if (numParams == 0) appendStringInfoString(&auditStr, ""); else append_valid_csv(&auditStr, paramStrResult.data); } else appendStringInfoString(&auditStr, ""); stackItem->auditEvent.statementLogged = true; } /* we were asked to not log it */ else if (!auditLogStatement) appendStringInfoString(&auditStr, ","); else appendStringInfoString(&auditStr, ","); /* Log rows affected */ if (auditLogRows) appendStringInfo(&auditStr, "," INT64_FORMAT, stackItem->auditEvent.rows); /* * Log the audit entry. Note: use of INT64_FORMAT here is bad for * translatability, but we currently haven't got translation support in * pgaudit anyway. */ ereport(auditLogClient ? auditLogLevel : LOG_SERVER_ONLY, (errmsg("AUDIT: %s," INT64_FORMAT "," INT64_FORMAT ",%s,%s", stackItem->auditEvent.granted ? AUDIT_TYPE_OBJECT : AUDIT_TYPE_SESSION, stackItem->auditEvent.statementId, stackItem->auditEvent.substatementId, className, auditStr.data), errhidestmt(true), errhidecontext(true))); stackItem->auditEvent.logged = true; MemoryContextSwitchTo(contextOld); } /* * Check if the role or any inherited role has any permission in the mask. The * public role is excluded from this check and superuser permissions are not * considered. */ static bool audit_on_acl(Datum aclDatum, Oid auditOid, AclMode mask) { bool result = false; Acl *acl; AclItem *aclItemData; int aclIndex; int aclTotal; /* Detoast column's ACL if necessary */ acl = DatumGetAclP(aclDatum); /* Get the acl list and total number of items */ aclTotal = ACL_NUM(acl); aclItemData = ACL_DAT(acl); /* Check privileges granted directly to auditOid */ for (aclIndex = 0; aclIndex < aclTotal; aclIndex++) { AclItem *aclItem = &aclItemData[aclIndex]; if (aclItem->ai_grantee == auditOid && aclItem->ai_privs & mask) { result = true; break; } } /* * Check privileges granted indirectly via role memberships. We do this in * a separate pass to minimize expensive indirect membership tests. In * particular, it's worth testing whether a given ACL entry grants any * privileges still of interest before we perform the has_privs_of_role * test. */ if (!result) { for (aclIndex = 0; aclIndex < aclTotal; aclIndex++) { AclItem *aclItem = &aclItemData[aclIndex]; /* Don't test public or auditOid (it has been tested already) */ if (aclItem->ai_grantee == ACL_ID_PUBLIC || aclItem->ai_grantee == auditOid) continue; /* * Check that the role has the required privileges and that it is * inherited by auditOid. */ if (aclItem->ai_privs & mask && has_privs_of_role(auditOid, aclItem->ai_grantee)) { result = true; break; } } } /* If we have a detoasted copy, free it */ if (acl && (Pointer) acl != DatumGetPointer(aclDatum)) pfree(acl); return result; } /* * Check if a role has any of the permissions in the mask on a relation. */ static bool audit_on_relation(Oid relOid, Oid auditOid, AclMode mask) { bool result = false; HeapTuple tuple; Datum aclDatum; bool isNull; /* Get relation tuple from pg_class */ tuple = SearchSysCache1(RELOID, ObjectIdGetDatum(relOid)); if (!HeapTupleIsValid(tuple)) return false; /* Get the relation's ACL */ aclDatum = SysCacheGetAttr(RELOID, tuple, Anum_pg_class_relacl, &isNull); /* Only check if non-NULL, since NULL means no permissions */ if (!isNull) result = audit_on_acl(aclDatum, auditOid, mask); /* Free the relation tuple */ ReleaseSysCache(tuple); return result; } /* * Check if a role has any of the permissions in the mask on a column. */ static bool audit_on_attribute(Oid relOid, AttrNumber attNum, Oid auditOid, AclMode mask) { bool result = false; HeapTuple attTuple; Datum aclDatum; bool isNull; /* Get the attribute's ACL */ attTuple = SearchSysCache2(ATTNUM, ObjectIdGetDatum(relOid), Int16GetDatum(attNum)); if (!HeapTupleIsValid(attTuple)) return false; /* Only consider attributes that have not been dropped */ if (!((Form_pg_attribute) GETSTRUCT(attTuple))->attisdropped) { aclDatum = SysCacheGetAttr(ATTNUM, attTuple, Anum_pg_attribute_attacl, &isNull); if (!isNull) result = audit_on_acl(aclDatum, auditOid, mask); } /* Free attribute */ ReleaseSysCache(attTuple); return result; } /* * Check if a role has any of the permissions in the mask on a column in * the provided set. If the set is empty, then all valid columns in the * relation will be tested. */ static bool audit_on_any_attribute(Oid relOid, Oid auditOid, Bitmapset *attributeSet, AclMode mode) { bool result = false; AttrNumber index = -1; Bitmapset *tmpSet; /* If bms is empty then check for any column match */ if (bms_is_empty(attributeSet)) { HeapTuple classTuple; AttrNumber nattrs; AttrNumber curr_att; /* Get relation to determine total columns */ classTuple = SearchSysCache1(RELOID, ObjectIdGetDatum(relOid)); if (!HeapTupleIsValid(classTuple)) return false; nattrs = ((Form_pg_class) GETSTRUCT(classTuple))->relnatts; ReleaseSysCache(classTuple); /* Check each column */ for (curr_att = 1; curr_att <= nattrs; curr_att++) if (audit_on_attribute(relOid, curr_att, auditOid, mode)) return true; } /* bms_first_member is destructive, so make a copy before using it. */ tmpSet = bms_copy(attributeSet); /* Check each column */ while ((index = bms_next_member(tmpSet, index)) >= 0) { const AttrNumber col = index + FirstLowInvalidHeapAttributeNumber; if (col != InvalidAttrNumber && audit_on_attribute(relOid, col, auditOid, mode)) { result = true; break; } } bms_free(tmpSet); return result; } /* * Create AuditEvents for SELECT/DML operations via executor permissions checks. */ static void log_select_dml(Oid auditOid, List *rangeTabls, List *permInfos) { ListCell *lr; bool first = true; bool found = false; /* Do not log if this is an internal statement */ if (internalStatement) return; foreach(lr, rangeTabls) { Oid relOid; Oid relNamespaceOid; RangeTblEntry *rte = lfirst(lr); const RTEPermissionInfo *perminfo; /* * We only care about tables/views, which have perminfoindex set. This * excludes table partitions, which do not have perminfoindex set. */ if (rte->perminfoindex == 0) continue; Assert(rte->rtekind == RTE_RELATION || (rte->rtekind == RTE_SUBQUERY && rte->relkind == RELKIND_VIEW)); found = true; /* * Don't log if the session user is not a member of the current * role. This prevents contents of security definer functions * from being logged and suppresses foreign key queries unless the * session user is the owner of the referenced table. */ if (!is_member_of_role(GetSessionUserId(), GetUserId())) return; /* * If we are not logging all-catalog queries (auditLogCatalog is * false) then filter out any system relations here. */ relOid = rte->relid; relNamespaceOid = get_rel_namespace(relOid); if (!auditLogCatalog && IsCatalogNamespace(relNamespaceOid)) continue; /* * Default is that this was not through a grant, to support session * logging. Will be updated below if a grant is found. */ auditEventStack->auditEvent.granted = false; /* * If this is the first RTE then session log unless auditLogRelation * is set. */ if (first && !auditLogRelation) { log_audit_event(auditEventStack); first = false; } /* * We don't have access to the parse tree here, so we have to generate * the node type, object type, and command tag by decoding * rte->requiredPerms and rte->relkind. For updates we also check * rellockmode so that only true UPDATE commands (not * SELECT FOR UPDATE, etc.) are logged as UPDATE. */ perminfo = getRTEPermissionInfo(permInfos, rte); if (perminfo->requiredPerms & ACL_INSERT) { auditEventStack->auditEvent.logStmtLevel = LOGSTMT_MOD; auditEventStack->auditEvent.commandTag = T_InsertStmt; auditEventStack->auditEvent.command = CMDTAG_INSERT; } else if (perminfo->requiredPerms & ACL_UPDATE && rte->rellockmode >= RowExclusiveLock) { auditEventStack->auditEvent.logStmtLevel = LOGSTMT_MOD; auditEventStack->auditEvent.commandTag = T_UpdateStmt; auditEventStack->auditEvent.command = CMDTAG_UPDATE; } else if (perminfo->requiredPerms & ACL_DELETE) { auditEventStack->auditEvent.logStmtLevel = LOGSTMT_MOD; auditEventStack->auditEvent.commandTag = T_DeleteStmt; auditEventStack->auditEvent.command = CMDTAG_DELETE; } else if (perminfo->requiredPerms & ACL_SELECT) { auditEventStack->auditEvent.logStmtLevel = LOGSTMT_ALL; auditEventStack->auditEvent.commandTag = T_SelectStmt; auditEventStack->auditEvent.command = CMDTAG_SELECT; } else { auditEventStack->auditEvent.logStmtLevel = LOGSTMT_ALL; auditEventStack->auditEvent.commandTag = T_Invalid; auditEventStack->auditEvent.command = CMDTAG_UNKNOWN; } /* Use the relation type to assign object type */ switch (rte->relkind) { case RELKIND_RELATION: case RELKIND_PARTITIONED_TABLE: auditEventStack->auditEvent.objectType = OBJECT_TYPE_TABLE; break; case RELKIND_INDEX: case RELKIND_PARTITIONED_INDEX: auditEventStack->auditEvent.objectType = OBJECT_TYPE_INDEX; break; case RELKIND_SEQUENCE: auditEventStack->auditEvent.objectType = OBJECT_TYPE_SEQUENCE; break; case RELKIND_TOASTVALUE: auditEventStack->auditEvent.objectType = OBJECT_TYPE_TOASTVALUE; break; case RELKIND_VIEW: auditEventStack->auditEvent.objectType = OBJECT_TYPE_VIEW; break; case RELKIND_COMPOSITE_TYPE: auditEventStack->auditEvent.objectType = OBJECT_TYPE_COMPOSITE_TYPE; break; case RELKIND_FOREIGN_TABLE: auditEventStack->auditEvent.objectType = OBJECT_TYPE_FOREIGN_TABLE; break; case RELKIND_MATVIEW: auditEventStack->auditEvent.objectType = OBJECT_TYPE_MATVIEW; break; default: auditEventStack->auditEvent.objectType = OBJECT_TYPE_UNKNOWN; break; } /* Get a copy of the relation name and assign it to object name */ auditEventStack->auditEvent.objectName = quote_qualified_identifier( get_namespace_name(relNamespaceOid), get_rel_name(relOid)); /* Perform object auditing only if the audit role is valid */ if (auditOid != InvalidOid) { AclMode auditPerms = (ACL_SELECT | ACL_UPDATE | ACL_INSERT | ACL_DELETE) & perminfo->requiredPerms; /* * If any of the required permissions for the relation are granted * to the audit role then audit the relation */ if (audit_on_relation(relOid, auditOid, auditPerms)) auditEventStack->auditEvent.granted = true; /* * Else check if the audit role has column-level permissions for * select, insert, or update. */ else if (auditPerms != 0) { /* * Check the select columns */ if (auditPerms & ACL_SELECT) auditEventStack->auditEvent.granted = audit_on_any_attribute(relOid, auditOid, perminfo->selectedCols, ACL_SELECT); /* * Check the insert columns */ if (!auditEventStack->auditEvent.granted && auditPerms & ACL_INSERT) auditEventStack->auditEvent.granted = audit_on_any_attribute(relOid, auditOid, perminfo->insertedCols, auditPerms); /* * Check the update columns */ if (!auditEventStack->auditEvent.granted && auditPerms & ACL_UPDATE) auditEventStack->auditEvent.granted = audit_on_any_attribute(relOid, auditOid, perminfo->updatedCols, auditPerms); } } /* Do relation level logging if a grant was found */ if (auditEventStack->auditEvent.granted) { auditEventStack->auditEvent.logged = false; log_audit_event(auditEventStack); } /* Do relation level logging if auditLogRelation is set */ if (auditLogRelation) { auditEventStack->auditEvent.logged = false; auditEventStack->auditEvent.granted = false; log_audit_event(auditEventStack); } pfree(auditEventStack->auditEvent.objectName); } /* * If no tables were found that means that RangeTbls was empty or all * relations were in the system schema. In that case still log a session * record. */ if (!found) { auditEventStack->auditEvent.granted = false; auditEventStack->auditEvent.logged = false; log_audit_event(auditEventStack); } } /* * Create AuditEvents for non-catalog function execution, as detected by * log_object_access() below. */ static void log_function_execute(Oid objectId) { HeapTuple proctup; Form_pg_proc proc; AuditEventStackItem *stackItem; /* Get info about the function. */ proctup = SearchSysCache1(PROCOID, ObjectIdGetDatum(objectId)); if (!proctup) elog(ERROR, "cache lookup failed for function %u", objectId); proc = (Form_pg_proc) GETSTRUCT(proctup); /* * Logging execution of all pg_catalog functions would make the log * unusably noisy. */ if (IsCatalogNamespace(proc->pronamespace)) { ReleaseSysCache(proctup); return; } /* Push audit event onto the stack */ stackItem = stack_push(); /* Generate the fully-qualified function name. */ stackItem->auditEvent.objectName = quote_qualified_identifier(get_namespace_name(proc->pronamespace), NameStr(proc->proname)); ReleaseSysCache(proctup); /* Log the function call */ stackItem->auditEvent.logStmtLevel = LOGSTMT_ALL; stackItem->auditEvent.commandTag = T_DoStmt; stackItem->auditEvent.command = CMDTAG_EXECUTE; stackItem->auditEvent.objectType = OBJECT_TYPE_FUNCTION; stackItem->auditEvent.commandText = stackItem->next->auditEvent.commandText; stackItem->auditEvent.commandLen = stackItem->next->auditEvent.commandLen; log_audit_event(stackItem); /* Pop audit event from the stack */ stack_pop(stackItem->stackId); } /* * Hook functions */ static ExecutorCheckPerms_hook_type next_ExecutorCheckPerms_hook = NULL; static ProcessUtility_hook_type next_ProcessUtility_hook = NULL; static object_access_hook_type next_object_access_hook = NULL; static ExecutorStart_hook_type next_ExecutorStart_hook = NULL; /* The following hook functions are required to get rows */ static ExecutorRun_hook_type next_ExecutorRun_hook = NULL; static ExecutorEnd_hook_type next_ExecutorEnd_hook = NULL; /* * Hook ExecutorStart to get the query text and basic command type for queries * that do not contain a table and so can't be idenitified accurately in * ExecutorCheckPerms. */ static void pgaudit_ExecutorStart_hook(QueryDesc *queryDesc, int eflags) { AuditEventStackItem *stackItem = NULL; if (!internalStatement) { /* Push the audit even onto the stack */ stackItem = stack_push(); /* Initialize command using queryDesc->operation */ switch (queryDesc->operation) { case CMD_SELECT: stackItem->auditEvent.logStmtLevel = LOGSTMT_ALL; stackItem->auditEvent.commandTag = T_SelectStmt; stackItem->auditEvent.command = CMDTAG_SELECT; break; case CMD_INSERT: stackItem->auditEvent.logStmtLevel = LOGSTMT_MOD; stackItem->auditEvent.commandTag = T_InsertStmt; stackItem->auditEvent.command = CMDTAG_INSERT; break; case CMD_UPDATE: stackItem->auditEvent.logStmtLevel = LOGSTMT_MOD; stackItem->auditEvent.commandTag = T_UpdateStmt; stackItem->auditEvent.command = CMDTAG_UPDATE; break; case CMD_DELETE: stackItem->auditEvent.logStmtLevel = LOGSTMT_MOD; stackItem->auditEvent.commandTag = T_DeleteStmt; stackItem->auditEvent.command = CMDTAG_DELETE; break; default: stackItem->auditEvent.logStmtLevel = LOGSTMT_ALL; stackItem->auditEvent.commandTag = T_Invalid; stackItem->auditEvent.command = CMDTAG_UNKNOWN; break; } /* Initialize the audit event */ command_text_set(&stackItem->auditEvent, queryDesc->sourceText, queryDesc->plannedstmt->stmt_location, queryDesc->plannedstmt->stmt_len); stackItem->auditEvent.paramList = copyParamList(queryDesc->params); } /* Call the previous hook or standard function */ if (next_ExecutorStart_hook) next_ExecutorStart_hook(queryDesc, eflags); else standard_ExecutorStart(queryDesc, eflags); /* * Move the stack memory context to the query memory context. This needs * to be done here because the query context does not exist before the * call to standard_ExecutorStart() but the stack item is required by * pgaudit_ExecutorCheckPerms_hook() which is called during * standard_ExecutorStart(). */ if (stackItem) { MemoryContextSetParent(stackItem->contextAudit, queryDesc->estate->es_query_cxt); /* Set query context for tracking rows processed */ if (auditLogRows) stackItem->auditEvent.queryContext = queryDesc->estate->es_query_cxt; } } /* * Hook ExecutorCheckPerms to do session and object auditing for DML. */ static bool pgaudit_ExecutorCheckPerms_hook(List *rangeTabls, List *permInfos, bool abort) { Oid auditOid; /* Get the audit oid if the role exists */ auditOid = get_role_oid(auditRole, true); /* Log DML if the audit role is valid or session logging is enabled */ if ((auditOid != InvalidOid || auditLogBitmap != 0) && !IsAbortedTransactionBlockState()) { /* If auditLogRows is on, wait for rows processed to be set */ if (auditLogRows && auditEventStack != NULL) { /* Check if the top item is SELECT/INSERT for CREATE TABLE AS */ if (auditEventStack->auditEvent.commandTag == T_SelectStmt && auditEventStack->next != NULL && auditEventStack->next->auditEvent.command == CMDTAG_CREATE_TABLE_AS && auditEventStack->auditEvent.rangeTabls != NULL) { /* * First, log the INSERT event for CREATE TABLE AS here. * The SELECT event for CREATE TABLE AS will be logged * in pgaudit_ExecutorEnd_hook() later to get rows. */ log_select_dml(auditOid, rangeTabls, permInfos); } else { /* * Save auditOid and rangeTabls to call log_select_dml() * in pgaudit_ExecutorEnd_hook() later. */ auditEventStack->auditEvent.auditOid = auditOid; auditEventStack->auditEvent.rangeTabls = rangeTabls; auditEventStack->auditEvent.permInfos = permInfos; } } else log_select_dml(auditOid, rangeTabls, permInfos); } /* Call the next hook function */ if (next_ExecutorCheckPerms_hook && !(*next_ExecutorCheckPerms_hook) (rangeTabls, permInfos, abort)) return false; return true; } /* * Hook ExecutorRun to get rows processed by the current statement. */ static void pgaudit_ExecutorRun_hook(QueryDesc *queryDesc, ScanDirection direction, uint64 count, bool execute_once) { AuditEventStackItem *stackItem = NULL; /* Call the previous hook or standard function */ if (next_ExecutorRun_hook) next_ExecutorRun_hook(queryDesc, direction, count, execute_once); else standard_ExecutorRun(queryDesc, direction, count, execute_once); if (auditLogRows && !internalStatement) { /* Find an item from the stack by the query memory context */ stackItem = stack_find_context(queryDesc->estate->es_query_cxt); /* Accumulate the number of rows processed */ if (stackItem != NULL) stackItem->auditEvent.rows += queryDesc->estate->es_processed; } } /* * Hook ExecutorEnd to get rows processed by the current statement. */ static void pgaudit_ExecutorEnd_hook(QueryDesc *queryDesc) { AuditEventStackItem *stackItem = NULL; AuditEventStackItem *auditEventStackFull = NULL; if (auditLogRows && !internalStatement) { /* Find an item from the stack by the query memory context */ stackItem = stack_find_context(queryDesc->estate->es_query_cxt); if (stackItem != NULL && stackItem->auditEvent.rangeTabls != NULL) { /* Reset auditEventStack to use in log_select_dml() */ auditEventStackFull = auditEventStack; auditEventStack = stackItem; /* Log SELECT/DML audit entry */ log_select_dml(stackItem->auditEvent.auditOid, stackItem->auditEvent.rangeTabls, stackItem->auditEvent.permInfos); /* Switch back to the previous auditEventStack */ auditEventStack = auditEventStackFull; } } /* Call the previous hook or standard function */ if (next_ExecutorEnd_hook) next_ExecutorEnd_hook(queryDesc); else standard_ExecutorEnd(queryDesc); } /* * Hook ProcessUtility to do session auditing for DDL and utility commands. */ static void pgaudit_ProcessUtility_hook(PlannedStmt *pstmt, const char *queryString, bool readOnlyTree, ProcessUtilityContext context, ParamListInfo params, QueryEnvironment *queryEnv, DestReceiver *dest, QueryCompletion *qc) { AuditEventStackItem *stackItem = NULL; int64 stackId = 0; /* * Don't audit substatements. All the substatements we care about should * be covered by the event triggers. */ if (context <= PROCESS_UTILITY_QUERY && !IsAbortedTransactionBlockState()) { /* Process top level utility statement */ if (context == PROCESS_UTILITY_TOPLEVEL) { /* * If the stack is not empty then the only allowed entries are call * statements or open, select, show, and explain cursors */ if (auditEventStack != NULL) { AuditEventStackItem *nextItem = auditEventStack; do { if (nextItem->auditEvent.commandTag != T_SelectStmt && nextItem->auditEvent.commandTag != T_VariableShowStmt && nextItem->auditEvent.commandTag != T_ExplainStmt && nextItem->auditEvent.commandTag != T_CallStmt) { elog(ERROR, "pgaudit stack is not empty"); } nextItem = nextItem->next; } while (nextItem != NULL); } stackItem = stack_push(); stackItem->auditEvent.paramList = copyParamList(params); } else stackItem = stack_push(); stackId = stackItem->stackId; stackItem->auditEvent.logStmtLevel = GetCommandLogLevel(pstmt->utilityStmt); stackItem->auditEvent.commandTag = nodeTag(pstmt->utilityStmt); stackItem->auditEvent.command = CreateCommandTag(pstmt->utilityStmt); command_text_set(&stackItem->auditEvent, queryString, pstmt->stmt_location, pstmt->stmt_len); /* * If this is a DO block log it before calling the next ProcessUtility * hook. */ if (auditLogBitmap & LOG_FUNCTION && stackItem->auditEvent.commandTag == T_DoStmt && !IsAbortedTransactionBlockState()) log_audit_event(stackItem); /* * If this is a create/alter extension command log it before calling * the next ProcessUtility hook. Otherwise, any warnings will be emitted * before the create/alter is logged and errors will prevent it from * being logged at all. */ if (auditLogBitmap & LOG_DDL && (stackItem->auditEvent.commandTag == T_CreateExtensionStmt || stackItem->auditEvent.commandTag == T_AlterExtensionStmt) && !IsAbortedTransactionBlockState()) log_audit_event(stackItem); /* * A close will free the open cursor which will also free the close * audit entry. Immediately log the close and set stackItem to NULL so * it won't be logged later. */ if (stackItem->auditEvent.commandTag == T_ClosePortalStmt) { if (auditLogBitmap & LOG_MISC && !IsAbortedTransactionBlockState()) log_audit_event(stackItem); stackItem = NULL; } } /* Call the standard process utility chain. */ if (next_ProcessUtility_hook) (*next_ProcessUtility_hook) (pstmt, queryString, readOnlyTree, context, params, queryEnv, dest, qc); else standard_ProcessUtility(pstmt, queryString, readOnlyTree, context, params, queryEnv, dest, qc); /* * Process the audit event if there is one. Also check that this event * was not popped off the stack by a memory context being free'd * elsewhere. */ if (stackItem && !IsAbortedTransactionBlockState()) { /* * Make sure the item we want to log is still on the stack - if not * then something has gone wrong and an error will be raised. */ stack_valid(stackId); /* * Log the utility command if logging is on, the command has not * already been logged by another hook, and the transaction is not * aborted. */ if (auditLogBitmap != 0 && !stackItem->auditEvent.logged) log_audit_event(stackItem); } } /* * Hook object_access_hook to provide fully-qualified object names for function * calls. */ static void pgaudit_object_access_hook(ObjectAccessType access, Oid classId, Oid objectId, int subId, void *arg) { if (auditLogBitmap & LOG_FUNCTION && access == OAT_FUNCTION_EXECUTE && auditEventStack && !IsAbortedTransactionBlockState()) log_function_execute(objectId); if (next_object_access_hook) (*next_object_access_hook) (access, classId, objectId, subId, arg); } /* * Event trigger functions */ /* * Supply additional data for (non drop) statements that have event trigger * support and can be deparsed. * * Drop statements are handled below through the older sql_drop event trigger. */ Datum pgaudit_ddl_command_end(PG_FUNCTION_ARGS) { EventTriggerData *eventData; int result, row; TupleDesc spiTupDesc; const char *query; MemoryContext contextQuery; MemoryContext contextOld; /* Continue only if session DDL logging is enabled */ if (~auditLogBitmap & LOG_DDL && ~auditLogBitmap & LOG_ROLE) PG_RETURN_NULL(); /* Be sure the module was loaded */ if (!auditEventStack) elog(ERROR, "pgaudit not loaded before call to " "pgaudit_ddl_command_end()"); /* This is an internal statement - do not log it */ internalStatement = true; /* Make sure the fuction was fired as a trigger */ if (!CALLED_AS_EVENT_TRIGGER(fcinfo)) elog(ERROR, "not fired by event trigger manager"); /* Switch memory context for query */ contextQuery = AllocSetContextCreate( CurrentMemoryContext, "pgaudit_func_ddl_command_end temporary context", ALLOCSET_DEFAULT_SIZES); contextOld = MemoryContextSwitchTo(contextQuery); /* Get information about triggered events */ eventData = (EventTriggerData *) fcinfo->context; auditEventStack->auditEvent.logStmtLevel = GetCommandLogLevel(eventData->parsetree); auditEventStack->auditEvent.commandTag = nodeTag(eventData->parsetree); auditEventStack->auditEvent.command = CreateCommandTag(eventData->parsetree); /* Return objects affected by the (non drop) DDL statement */ query = "SELECT pg_catalog.upper(object_type),\n" " object_identity,\n" " pg_catalog.upper(command_tag)\n" " FROM pg_catalog.pg_event_trigger_ddl_commands()"; /* Attempt to connect */ result = SPI_connect(); if (result < 0) elog(ERROR, "pgaudit_ddl_command_end: SPI_connect returned %d", result); /* Execute the query */ result = SPI_execute(query, true, 0); if (result != SPI_OK_SELECT) elog(ERROR, "pgaudit_ddl_command_end: SPI_execute returned %d", result); /* Iterate returned rows */ spiTupDesc = SPI_tuptable->tupdesc; for (row = 0; row < SPI_processed; row++) { HeapTuple spiTuple; spiTuple = SPI_tuptable->vals[row]; /* Supply object name and type for audit event */ auditEventStack->auditEvent.objectType = SPI_getvalue(spiTuple, spiTupDesc, 1); auditEventStack->auditEvent.objectName = SPI_getvalue(spiTuple, spiTupDesc, 2); auditEventStack->auditEvent.command = GetCommandTagEnum(SPI_getvalue(spiTuple, spiTupDesc, 3)); auditEventStack->auditEvent.logged = false; /* * Identify grant/revoke commands - these are the only non-DDL class * commands that should be coming through the event triggers. */ if (auditEventStack->auditEvent.command == CMDTAG_GRANT || auditEventStack->auditEvent.command == CMDTAG_REVOKE) { NodeTag currentCommandTag = auditEventStack->auditEvent.commandTag; auditEventStack->auditEvent.commandTag = T_GrantStmt; log_audit_event(auditEventStack); auditEventStack->auditEvent.commandTag = currentCommandTag; } else log_audit_event(auditEventStack); } /* Complete the query */ SPI_finish(); MemoryContextSwitchTo(contextOld); MemoryContextDelete(contextQuery); /* No longer in an internal statement */ internalStatement = false; PG_RETURN_NULL(); } /* * Supply additional data for drop statements that have event trigger support. */ Datum pgaudit_sql_drop(PG_FUNCTION_ARGS) { int result, row; TupleDesc spiTupDesc; const char *query; MemoryContext contextQuery; MemoryContext contextOld; if (~auditLogBitmap & LOG_DDL) PG_RETURN_NULL(); /* Be sure the module was loaded */ if (!auditEventStack) elog(ERROR, "pgaudit not loaded before call to " "pgaudit_sql_drop()"); /* This is an internal statement - do not log it */ internalStatement = true; /* Make sure the fuction was fired as a trigger */ if (!CALLED_AS_EVENT_TRIGGER(fcinfo)) elog(ERROR, "not fired by event trigger manager"); /* Switch memory context for the query */ contextQuery = AllocSetContextCreate( CurrentMemoryContext, "pgaudit_func_ddl_command_end temporary context", ALLOCSET_DEFAULT_SIZES); contextOld = MemoryContextSwitchTo(contextQuery); /* Return objects affected by the drop statement */ query = "SELECT pg_catalog.upper(object_type),\n" " object_identity\n" " FROM pg_catalog.pg_event_trigger_dropped_objects()\n" " WHERE pg_catalog.lower(object_type) operator(pg_catalog.<>) 'type'\n" " AND schema_name operator(pg_catalog.<>) 'pg_toast'"; /* Attempt to connect */ result = SPI_connect(); if (result < 0) elog(ERROR, "pgaudit_ddl_drop: SPI_connect returned %d", result); /* Execute the query */ result = SPI_execute(query, true, 0); if (result != SPI_OK_SELECT) elog(ERROR, "pgaudit_ddl_drop: SPI_execute returned %d", result); /* Iterate returned rows */ spiTupDesc = SPI_tuptable->tupdesc; for (row = 0; row < SPI_processed; row++) { HeapTuple spiTuple; spiTuple = SPI_tuptable->vals[row]; auditEventStack->auditEvent.objectType = SPI_getvalue(spiTuple, spiTupDesc, 1); auditEventStack->auditEvent.objectName = SPI_getvalue(spiTuple, spiTupDesc, 2); auditEventStack->auditEvent.logged = false; log_audit_event(auditEventStack); } /* Complete the query */ SPI_finish(); MemoryContextSwitchTo(contextOld); MemoryContextDelete(contextQuery); /* No longer in an internal statement */ internalStatement = false; PG_RETURN_NULL(); } /* * GUC check and assign functions */ /* * Take a pgaudit.log value such as "read, write, dml", verify that each of the * comma-separated tokens corresponds to a LogClass value, and convert them into * a bitmap that log_audit_event can check. */ static bool check_pgaudit_log(char **newVal, void **extra, GucSource source) { List *flagRawList; char *rawVal; ListCell *lt; int *flags; /* Make sure newval is a comma-separated list of tokens. */ rawVal = pstrdup(*newVal); if (!SplitIdentifierString(rawVal, ',', &flagRawList)) { GUC_check_errdetail("List syntax is invalid"); list_free(flagRawList); pfree(rawVal); return false; } /* * Check that we recognise each token, and add it to the bitmap we're * building up in a newly-allocated int *f. */ if (!(flags = (int *)guc_malloc(FATAL, sizeof(int)))) return false; *flags = 0; foreach(lt, flagRawList) { char *token = (char *) lfirst(lt); bool subtract = false; int class; /* If token is preceded by -, then the token is subtractive */ if (token[0] == '-') { token++; subtract = true; } /* Test each token */ if (pg_strcasecmp(token, CLASS_NONE) == 0) class = LOG_NONE; else if (pg_strcasecmp(token, CLASS_ALL) == 0) class = LOG_ALL; else if (pg_strcasecmp(token, CLASS_DDL) == 0) class = LOG_DDL; else if (pg_strcasecmp(token, CLASS_FUNCTION) == 0) class = LOG_FUNCTION; else if (pg_strcasecmp(token, CLASS_MISC) == 0) class = LOG_MISC | LOG_MISC_SET; else if (pg_strcasecmp(token, CLASS_MISC_SET) == 0) class = LOG_MISC_SET; else if (pg_strcasecmp(token, CLASS_READ) == 0) class = LOG_READ; else if (pg_strcasecmp(token, CLASS_ROLE) == 0) class = LOG_ROLE; else if (pg_strcasecmp(token, CLASS_WRITE) == 0) class = LOG_WRITE; else { guc_free(flags); pfree(rawVal); list_free(flagRawList); return false; } /* Add or subtract class bits from the log bitmap */ if (subtract) *flags &= ~class; else *flags |= class; } pfree(rawVal); list_free(flagRawList); /* Store the bitmap for assign_pgaudit_log */ *extra = flags; return true; } /* * Set pgaudit_log from extra (ignoring newVal, which has already been * converted to a bitmap above). Note that extra may not be set if the * assignment is to be suppressed. */ static void assign_pgaudit_log(const char *newVal, void *extra) { if (extra) auditLogBitmap = *(int *) extra; } /* * Take a pgaudit.log_level value such as "debug" and check that is is valid. * Return the enum value so it does not have to be checked again in the assign * function. */ static bool check_pgaudit_log_level(char **newVal, void **extra, GucSource source) { int *logLevel; /* Allocate memory to store the log level */ if (!(logLevel = (int *)guc_malloc(FATAL, sizeof(int)))) return false; /* Find the log level enum */ if (pg_strcasecmp(*newVal, "debug") == 0) *logLevel = DEBUG2; else if (pg_strcasecmp(*newVal, "debug5") == 0) *logLevel = DEBUG5; else if (pg_strcasecmp(*newVal, "debug4") == 0) *logLevel = DEBUG4; else if (pg_strcasecmp(*newVal, "debug3") == 0) *logLevel = DEBUG3; else if (pg_strcasecmp(*newVal, "debug2") == 0) *logLevel = DEBUG2; else if (pg_strcasecmp(*newVal, "debug1") == 0) *logLevel = DEBUG1; else if (pg_strcasecmp(*newVal, "info") == 0) *logLevel = INFO; else if (pg_strcasecmp(*newVal, "notice") == 0) *logLevel = NOTICE; else if (pg_strcasecmp(*newVal, "warning") == 0) *logLevel = WARNING; else if (pg_strcasecmp(*newVal, "log") == 0) *logLevel = LOG; /* Error if the log level enum is not found */ else { guc_free(logLevel); return false; } /* Return the log level enum */ *extra = logLevel; return true; } /* * Set pgaudit_log from extra (ignoring newVal, which has already been * converted to an enum above). Note that extra may not be set if the * assignment is to be suppressed. */ static void assign_pgaudit_log_level(const char *newVal, void *extra) { if (extra) auditLogLevel = *(int *) extra; } /* * Define GUC variables and install hooks upon module load. */ void _PG_init(void) { /* Be sure we do initialization only once */ static bool inited = false; if (inited) return; /* Must be loaded with shared_preload_libraries */ if (!process_shared_preload_libraries_in_progress) ereport(ERROR, (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE), errmsg("pgaudit must be loaded via shared_preload_libraries"))); /* Define pgaudit.log */ DefineCustomStringVariable( "pgaudit.log", "Specifies which classes of statements will be logged by session audit " "logging. Multiple classes can be provided using a comma-separated " "list and classes can be subtracted by prefacing the class with a " "- sign.", NULL, &auditLog, "none", PGC_SUSET, GUC_LIST_INPUT | GUC_NOT_IN_SAMPLE, check_pgaudit_log, assign_pgaudit_log, NULL); /* Define pgaudit.log_catalog */ DefineCustomBoolVariable( "pgaudit.log_catalog", "Specifies that session logging should be enabled in the case where " "all relations in a statement are in pg_catalog. Disabling this " "setting will reduce noise in the log from tools like psql and PgAdmin " "that query the catalog heavily.", NULL, &auditLogCatalog, true, PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* Define pgaudit.log_client */ DefineCustomBoolVariable( "pgaudit.log_client", "Specifies whether audit messages should be visible to the client. " "This setting should generally be left disabled but may be useful for " "debugging or other purposes.", NULL, &auditLogClient, false, PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* Define pgaudit.log_level */ DefineCustomStringVariable( "pgaudit.log_level", "Specifies the log level that will be used for log entries. This " "setting is used for regression testing and may also be useful to end " "users for testing or other purposes. It is not intended to be used " "in a production environment as it may leak which statements are being " "logged to the user.", NULL, &auditLogLevelString, "log", PGC_SUSET, GUC_LIST_INPUT | GUC_NOT_IN_SAMPLE, check_pgaudit_log_level, assign_pgaudit_log_level, NULL); /* Define pgaudit.log_parameter */ DefineCustomBoolVariable( "pgaudit.log_parameter", "Specifies that audit logging should include the parameters that were " "passed with the statement. When parameters are present they will be " "be included in CSV format after the statement text.", NULL, &auditLogParameter, false, PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* Define pgaudit.log_parameter_max_size */ DefineCustomIntVariable( "pgaudit.log_parameter_max_size", "Specifies, in bytes, the maximum length of variable-length parameters " "to log. If 0 (the default), parameters are not checked for size. If " "set, when the size of the parameter is longer than the setting, the " "value in the audit log is replaced with a placeholder. Note that for " "character types, the length is in bytes for the parameter's encoding, " "not characters.", NULL, &auditLogParameterMaxSize, 0, 0, (1 << 30) - 1, PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* Define pgaudit.log_relation */ DefineCustomBoolVariable( "pgaudit.log_relation", "Specifies whether session audit logging should create a separate log " "entry for each relation referenced in a SELECT or DML statement. " "This is a useful shortcut for exhaustive logging without using object " "audit logging.", NULL, &auditLogRelation, false, PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* Define pgaudit.log_rows */ DefineCustomBoolVariable( "pgaudit.log_rows", "Specifies whether logging will include the rows retrieved or " "affected by a statement.", NULL, &auditLogRows, false, PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* Define pgaudit.log_statement */ DefineCustomBoolVariable( "pgaudit.log_statement", "Specifies whether logging will include the statement text and " "parameters. Depending on requirements, the full statement text might " "not be required in the audit log.", NULL, &auditLogStatement, true, PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* Define pgaudit.log_statement_once */ DefineCustomBoolVariable( "pgaudit.log_statement_once", "Specifies whether logging will include the statement text and " "parameters with the first log entry for a statement/substatement " "combination or with every entry. Enabling this setting will result " "in less verbose logging but may make it more difficult to determine " "the statement that generated a log entry, though the " "statement/substatement pair along with the process id should suffice " "to identify the statement text logged with a previous entry.", NULL, &auditLogStatementOnce, false, PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* Define pgaudit.role */ DefineCustomStringVariable( "pgaudit.role", "Specifies the master role to use for object audit logging. Multiple " "audit roles can be defined by granting them to the master role. This " "allows multiple groups to be in charge of different aspects of audit " "logging.", NULL, &auditRole, "", PGC_SUSET, GUC_NOT_IN_SAMPLE, NULL, NULL, NULL); /* * Install our hook functions after saving the existing pointers to * preserve the chains. */ next_ExecutorStart_hook = ExecutorStart_hook; ExecutorStart_hook = pgaudit_ExecutorStart_hook; next_ExecutorCheckPerms_hook = ExecutorCheckPerms_hook; ExecutorCheckPerms_hook = pgaudit_ExecutorCheckPerms_hook; next_ProcessUtility_hook = ProcessUtility_hook; ProcessUtility_hook = pgaudit_ProcessUtility_hook; next_object_access_hook = object_access_hook; object_access_hook = pgaudit_object_access_hook; /* The following hook functions are required to get rows */ next_ExecutorRun_hook = ExecutorRun_hook; ExecutorRun_hook = pgaudit_ExecutorRun_hook; next_ExecutorEnd_hook = ExecutorEnd_hook; ExecutorEnd_hook = pgaudit_ExecutorEnd_hook; /* Log that the extension has completed initialization */ #ifndef EXEC_BACKEND ereport(LOG, (errmsg("pgaudit extension initialized"))); #else ereport(DEBUG1, (errmsg("pgaudit extension initialized"))); #endif /* EXEC_BACKEND */ inited = true; } pgaudit-17.1/pgaudit.conf000066400000000000000000000000431475542732400154150ustar00rootroot00000000000000shared_preload_libraries = pgaudit pgaudit-17.1/pgaudit.control000066400000000000000000000002201475542732400161450ustar00rootroot00000000000000# pgaudit extension comment = 'provides auditing functionality' default_version = '17.1' module_pathname = '$libdir/pgaudit' relocatable = true pgaudit-17.1/sql/000077500000000000000000000000001475542732400137135ustar00rootroot00000000000000pgaudit-17.1/sql/pgaudit.sql000066400000000000000000000764461475542732400161120ustar00rootroot00000000000000\set VERBOSITY terse -- Create pgaudit extension CREATE EXTENSION IF NOT EXISTS pgaudit; -- Grant all on public schema to public GRANT ALL ON SCHEMA public TO public; -- Make sure events don't get logged twice when session logging SET pgaudit.log = 'all'; SET pgaudit.log_client = ON; SET pgaudit.log_level = 'notice'; CREATE TABLE tmp (id int, data text); CREATE TABLE tmp2 AS (SELECT * FROM tmp); -- Reset log_client first to show that audits logs are not set to client RESET pgaudit.log_client; DROP TABLE tmp; DROP TABLE tmp2; RESET pgaudit.log; RESET pgaudit.log_level; -- -- Audit log fields are: -- AUDIT_TYPE - SESSION or OBJECT -- STATEMENT_ID - ID of the statement in the current backend -- SUBSTATEMENT_ID - ID of the substatement in the current backend -- CLASS - Class of statement being logged (e.g. ROLE, READ, WRITE) -- COMMAND - e.g. SELECT, CREATE ROLE, UPDATE -- OBJECT_TYPE - When available, type of object acted on (e.g. TABLE, VIEW) -- OBJECT_NAME - When available, fully-qualified table of object -- STATEMENT - The statement being logged -- PARAMETER - If parameter logging is requested, they will follow the -- statement -- ROWS - If rows logging is requested, they will follow the parameter SELECT current_user \gset -- -- Set pgaudit parameters for the current (super)user. ALTER ROLE :current_user SET pgaudit.log = 'Role'; ALTER ROLE :current_user SET pgaudit.log_level = 'notice'; ALTER ROLE :current_user SET pgaudit.log_client = ON; \connect - :current_user; -- -- Create auditor role CREATE ROLE regress_auditor; -- -- Create first test user CREATE USER regress_user1 password 'password'; ALTER ROLE regress_user1 SET pgaudit.log = 'ddl, ROLE'; ALTER ROLE regress_user1 SET pgaudit.log_level = 'notice'; ALTER ROLE regress_user1 PassWord 'password2' NOLOGIN; ALTER USER regress_user1 encrypted /* random comment */PASSWORD /* random comment */ 'md565cb1da342495ea6bb0418a6e5718c38' LOGIN; ALTER ROLE regress_user1 SET pgaudit.log_client = ON; -- -- Create, select, drop (select will not be audited) \connect - regress_user1 CREATE TABLE public.test ( id INT ); SELECT * FROM test; DROP TABLE test; -- -- Create second test user \connect - :current_user CREATE ROLE regress_user2 LOGIN password 'password'; ALTER ROLE regress_user2 SET pgaudit.log = 'Read, writE'; ALTER ROLE regress_user2 SET pgaudit.log_catalog = OFF; ALTER ROLE regress_user2 SET pgaudit.log_client = ON; ALTER ROLE regress_user2 SET pgaudit.log_level = 'warning'; ALTER ROLE regress_user2 SET pgaudit.role = regress_auditor; ALTER ROLE regress_user2 SET pgaudit.log_statement_once = ON; -- -- Setup role-based tests CREATE TABLE test2 ( id INT ); GRANT SELECT, INSERT, UPDATE, DELETE ON test2 TO regress_user2, regress_user1; GRANT SELECT, UPDATE ON TABLE public.test2 TO regress_auditor; CREATE TABLE test3 ( id INT ); GRANT SELECT, INSERT, UPDATE, DELETE ON test3 TO regress_user2; GRANT INSERT ON TABLE public.test3 TO regress_auditor; CREATE FUNCTION test2_insert() RETURNS TRIGGER AS $$ BEGIN UPDATE test2 SET id = id + 90 WHERE id = new.id; RETURN new; END $$ LANGUAGE plpgsql security definer; ALTER FUNCTION test2_insert() OWNER TO regress_user1; CREATE TRIGGER test2_insert_trg AFTER INSERT ON test2 FOR EACH ROW EXECUTE PROCEDURE test2_insert(); CREATE FUNCTION test2_change(change_id int) RETURNS void AS $$ BEGIN UPDATE test2 SET id = id + 1 WHERE id = change_id; END $$ LANGUAGE plpgsql security definer; ALTER FUNCTION test2_change(int) OWNER TO regress_user2; CREATE VIEW vw_test3 AS SELECT * FROM test3; GRANT SELECT ON vw_test3 TO regress_user2; GRANT SELECT ON vw_test3 TO regress_auditor; \connect - regress_user2 -- -- Role-based tests SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) SUBQUERY; SELECT * FROM test3, test2; -- -- Object logged because of: -- select on vw_test3 -- select on test2 SELECT * FROM vw_test3, test2; -- -- Object logged because of: -- insert on test3 -- select on test2 WITH CTE AS ( SELECT id FROM test2 ) INSERT INTO test3 SELECT id FROM cte; -- -- Object logged because of: -- insert on test3 WITH CTE AS ( INSERT INTO test3 VALUES (1) RETURNING id ) INSERT INTO test2 SELECT id FROM cte; DO $$ BEGIN PERFORM test2_change(91); END $$; -- -- Object logged because of: -- insert on test3 -- update on test2 WITH CTE AS ( UPDATE test2 SET id = 45 WHERE id = 92 RETURNING id ) INSERT INTO test3 SELECT id FROM cte; -- -- Object logged because of: -- insert on test2 WITH CTE AS ( INSERT INTO test2 VALUES (37) RETURNING id ) UPDATE test3 SET id = cte.id FROM cte WHERE test3.id <> cte.id; -- -- Be sure that test has correct contents SELECT * FROM test2 ORDER BY ID; -- -- Change permissions of user 2 so that only object logging will be done \connect - :current_user ALTER ROLE regress_user2 SET pgaudit.log = 'NONE'; \connect - regress_user2 -- -- Create test4 and add permissions CREATE TABLE test4 ( id int, name text ); GRANT SELECT (name) ON TABLE public.test4 TO regress_auditor; GRANT UPDATE (id) ON TABLE public.test4 TO regress_auditor; GRANT insert (name) ON TABLE public.test4 TO regress_auditor; -- -- Not object logged SELECT id FROM public.test4; -- -- Object logged because of: -- select (name) on test4 SELECT name FROM public.test4; -- -- Not object logged INSERT INTO public.test4 (id) VALUES (1); -- -- Object logged because of: -- insert (name) on test4 INSERT INTO public.test4 (name) VALUES ('test'); -- -- Not object logged UPDATE public.test4 SET name = 'foo'; -- -- Object logged because of: -- update (id) on test4 UPDATE public.test4 SET id = 1; -- -- Object logged because of: -- update (name) on test4 -- update (name) takes precedence over select (name) due to ordering update public.test4 set name = 'foo' where name = 'bar'; -- -- Confirm that "long" parameter values will not be logged if pgaudit.log_parameter_max_size -- is set. \connect - :current_user ALTER ROLE regress_user2 SET pgaudit.log_parameter_max_size = 50; ALTER ROLE regress_user2 SET pgaudit.log_parameter = 'on'; \connect - regress_user2 PREPARE testinsert(int, text) AS INSERT INTO test4 VALUES($1, $2); EXECUTE testinsert(1, '*******************************************************'); DEALLOCATE testinsert; \connect - :current_user ALTER ROLE regress_user2 RESET pgaudit.log_parameter_max_size; \connect - regress_user2 PREPARE testinsert(int, text) AS INSERT INTO test4 VALUES($1, $2); EXECUTE testinsert(2, '*******************************************************'); DEALLOCATE testinsert; \connect - :current_user ALTER ROLE regress_user2 RESET pgaudit.log_parameter; -- -- Change permissions of user 1 so that session logging will be done \connect - :current_user -- -- Drop test tables DROP TABLE test2; DROP VIEW vw_test3; DROP TABLE test3; DROP TABLE test4; DROP FUNCTION test2_insert(); DROP FUNCTION test2_change(int); ALTER ROLE regress_user1 SET pgaudit.log = 'DDL, READ'; \connect - regress_user1 -- -- Create table is session logged CREATE TABLE public.account ( id INT, name TEXT, password TEXT, description TEXT ); -- -- Select is session logged SELECT * FROM account; -- -- Insert is not logged INSERT INTO account (id, name, password, description) VALUES (1, 'regress_user1', 'HASH1', 'blah, blah'); -- -- Change permissions of user 1 so that only object logging will be done \connect - :current_user ALTER ROLE regress_user1 SET pgaudit.log = 'none'; ALTER ROLE regress_user1 SET pgaudit.role = 'regress_auditor'; \connect - regress_user1 -- -- ROLE class not set, so regress_auditor grants not logged GRANT SELECT (password), UPDATE (name, password) ON TABLE public.account TO regress_auditor; -- -- Not object logged SELECT id, name FROM account; -- -- Object logged because of: -- select (password) on account SELECT password FROM account; -- -- Not object logged UPDATE account SET description = 'yada, yada'; -- -- Object logged because of: -- update (password) on account UPDATE account SET password = 'HASH2'; -- -- Change permissions of user 1 so that session relation logging will be done \connect - :current_user ALTER ROLE regress_user1 SET pgaudit.log_relation = on; ALTER ROLE regress_user1 SET pgaudit.log = 'read, WRITE'; \connect - regress_user1 -- -- Not logged CREATE TABLE ACCOUNT_ROLE_MAP ( account_id INT, role_id INT ); -- -- ROLE class not set, so regress_auditor grants not logged GRANT SELECT ON TABLE public.account_role_map TO regress_auditor; -- -- Object logged because of: -- select (password) on account -- select on account_role_map -- Session logged on all tables because log = read and log_relation = on SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id; -- -- Object logged because of: -- select (password) on account -- Session logged on all tables because log = read and log_relation = on SELECT password FROM account; -- -- Not object logged -- Session logged on all tables because log = read and log_relation = on UPDATE account SET description = 'yada, yada'; -- -- Object logged because of: -- select (password) on account (in the where clause) -- Session logged on all tables because log = read and log_relation = on SELECT * FROM account WHERE password = 'HASH2' FOR UPDATE; -- -- Object logged because of: -- select (password) on account (in the where clause) -- Session logged on all tables because log = read and log_relation = on UPDATE account SET description = 'yada, yada' where password = 'HASH2'; -- -- Object logged because of: -- update (password) on account -- Session logged on all tables because log = read and log_relation = on UPDATE account SET password = 'HASH2'; -- -- Change configuration of user 1 so that full statements are not logged \connect - :current_user ALTER ROLE regress_user1 RESET pgaudit.log_relation; ALTER ROLE regress_user1 RESET pgaudit.log; ALTER ROLE regress_user1 SET pgaudit.log_statement = OFF; \connect - regress_user1 -- -- Logged but without full statement SELECT * FROM account; -- -- Change back to superuser to do exhaustive tests \connect - :current_user SET pgaudit.log = 'ALL'; SET pgaudit.log_level = 'notice'; SET pgaudit.log_client = ON; SET pgaudit.log_relation = ON; SET pgaudit.log_parameter = ON; -- -- Simple DO block DO $$ BEGIN raise notice 'test'; END $$; -- -- Create test schema CREATE SCHEMA test; -- -- Copy account to stdout COPY account TO stdout; -- -- Create a table from a query CREATE TABLE test.account_copy AS SELECT * FROM account; -- -- Copy from stdin to account copy COPY test.account_copy from stdin; 1 regress_user1 HASH2 yada, yada \. -- -- Test prepared statement PREPARE pgclassstmt (oid) AS SELECT * FROM account WHERE id = $1; EXECUTE pgclassstmt (1); DEALLOCATE pgclassstmt; -- -- Test cursor BEGIN; DECLARE ctest SCROLL CURSOR FOR SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) subquery; FETCH NEXT FROM ctest; CLOSE ctest; COMMIT; -- -- Turn off log_catalog and pg_class will not be logged SET pgaudit.log_catalog = OFF; SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) subquery; -- -- Test prepared insert CREATE TABLE test.test_insert ( id INT ); PREPARE pgclassstmt (oid) AS INSERT INTO test.test_insert (id) VALUES ($1); EXECUTE pgclassstmt (1); -- -- Check that primary key creation is logged CREATE TABLE public.test ( id INT, name TEXT, description TEXT, CONSTRAINT test_pkey PRIMARY KEY (id) ); -- -- Check that analyze is logged ANALYZE test; -- -- Grants to public should not cause object logging (session logging will -- still happen) GRANT SELECT ON TABLE public.test TO PUBLIC; SELECT * FROM test; -- Check that statements without columns log SELECT FROM test; SELECT 1, substring('Thomas' from 2 for 3); DO $$ DECLARE test INT; BEGIN SELECT 1 INTO test; END $$; explain select 1; -- -- Test that looks inside of do blocks log INSERT INTO TEST (id) VALUES (1); INSERT INTO TEST (id) VALUES (2); INSERT INTO TEST (id) VALUES (3); DO $$ DECLARE result RECORD; BEGIN FOR result IN SELECT id FROM test LOOP INSERT INTO test (id) VALUES (result.id + 100); END LOOP; END $$; -- -- Test obfuscated dynamic sql for clean logging DO $$ DECLARE table_name TEXT = 'do_table'; BEGIN EXECUTE E'\t\n\r CREATE TABLE ' || table_name || E' ("weird name" INT)\t\n\r ; DROP table ' || table_name; END $$; -- -- Generate an error and make sure the stack gets cleared DO $$ BEGIN CREATE TABLE bogus.test_block ( id INT ); END $$; -- -- Test alter table statements ALTER TABLE public.test DROP COLUMN description ; ALTER TABLE public.test RENAME TO test2; ALTER TABLE public.test2 SET SCHEMA test; ALTER TABLE test.test2 ADD COLUMN description TEXT; ALTER TABLE test.test2 DROP COLUMN description; DROP TABLE test.test2; -- -- Test multiple statements with one semi-colon CREATE SCHEMA foo CREATE TABLE foo.bar (id int) CREATE TABLE foo.baz (id int); -- -- Test aggregate CREATE FUNCTION public.int_add ( a INT, b INT ) RETURNS INT LANGUAGE plpgsql AS $$ BEGIN return a + b; END $$; SELECT int_add(1, 1); CREATE AGGREGATE public.sum_test(INT) (SFUNC=public.int_add, STYPE=INT, INITCOND='0'); ALTER AGGREGATE public.sum_test(integer) RENAME TO sum_test2; -- -- Test conversion CREATE CONVERSION public.conversion_test FOR 'latin1' TO 'utf8' FROM pg_catalog.iso8859_1_to_utf8; ALTER CONVERSION public.conversion_test RENAME TO conversion_test2; -- -- Test create/alter/drop database CREATE DATABASE contrib_regression_pgaudit; ALTER DATABASE contrib_regression_pgaudit RENAME TO contrib_regression_pgaudit2; DROP DATABASE contrib_regression_pgaudit2; -- Test role as a substmt SET pgaudit.log = 'ROLE'; CREATE TABLE t (); CREATE ROLE regress_alice; CREATE SCHEMA foo2 GRANT SELECT ON public.t TO regress_alice; drop table public.t; drop role regress_alice; -- -- Test for non-empty stack error CREATE OR REPLACE FUNCTION get_test_id(_ret REFCURSOR) RETURNS REFCURSOR LANGUAGE plpgsql IMMUTABLE AS $$ BEGIN OPEN _ret FOR SELECT 200; RETURN _ret; END $$; BEGIN; SELECT get_test_id('_ret'); SELECT get_test_id('_ret2'); FETCH ALL FROM _ret; FETCH ALL FROM _ret2; CLOSE _ret; CLOSE _ret2; END; -- -- Test that frees a memory context earlier than expected SET pgaudit.log = 'ALL'; CREATE TABLE hoge ( id int ); CREATE FUNCTION test() RETURNS INT AS $$ DECLARE cur1 cursor for select * from hoge; tmp int; BEGIN OPEN cur1; FETCH cur1 into tmp; RETURN tmp; END $$ LANGUAGE plpgsql ; SELECT test(); -- -- Delete all rows then delete 1 row SET pgaudit.log = 'write'; SET pgaudit.role = 'regress_auditor'; create table bar ( col int ); grant delete on bar to regress_auditor; insert into bar (col) values (1); delete from bar; insert into bar (col) values (1); delete from bar where col = 1; drop table bar; -- -- Grant roles to each other SET pgaudit.log = 'role'; GRANT regress_user1 TO regress_user2; REVOKE regress_user1 FROM regress_user2; -- -- Test that FK references do not log but triggers still do SET pgaudit.log = 'READ,WRITE'; SET pgaudit.role TO 'regress_auditor'; CREATE TABLE aaa ( ID int primary key ); CREATE TABLE bbb ( id int references aaa(id) ); CREATE FUNCTION bbb_insert() RETURNS TRIGGER AS $$ BEGIN UPDATE bbb set id = new.id + 1; RETURN new; END $$ LANGUAGE plpgsql; CREATE TRIGGER bbb_insert_trg AFTER INSERT ON bbb FOR EACH ROW EXECUTE PROCEDURE bbb_insert(); GRANT SELECT, UPDATE ON aaa TO regress_auditor; GRANT UPDATE ON bbb TO regress_auditor; INSERT INTO aaa VALUES (generate_series(1,100)); SET pgaudit.log_parameter TO OFF; INSERT INTO bbb VALUES (1); SET pgaudit.log_parameter TO ON; DROP TABLE bbb; DROP TABLE aaa; -- Test create table as after extension as been dropped DROP EXTENSION pgaudit; CREATE TABLE tmp (id int, data text); CREATE TABLE tmp2 AS (SELECT * FROM tmp); DROP TABLE tmp; DROP TABLE tmp2; -- -- Test MISC SET pgaudit.log = 'MISC'; SET pgaudit.log_level = 'notice'; SET pgaudit.log_client = ON; SET pgaudit.log_relation = ON; SET pgaudit.log_parameter = ON; CREATE ROLE regress_alice; SET ROLE regress_alice; CREATE TABLE t (a int, b text); SET search_path TO test, public; INSERT INTO t VALUES (1, 'misc'); VACUUM t; RESET ROLE; -- -- Test MISC_SET SET pgaudit.log = 'MISC_SET'; SET ROLE regress_alice; SET search_path TO public; INSERT INTO t VALUES (2, 'misc_set'); VACUUM t; RESET ROLE; -- -- Test ALL, -MISC, MISC_SET SET pgaudit.log = 'ALL, -MISC, MISC_SET'; SET search_path TO public; INSERT INTO t VALUES (3, 'all, -misc, misc_set'); VACUUM t; RESET ROLE; DROP TABLE public.t; DROP ROLE regress_alice; -- -- Test PARTITIONED table CREATE TABLE h(x int ,y int) PARTITION BY HASH(x); CREATE TABLE h_0 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 0); CREATE TABLE h_1 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 1); INSERT INTO h VALUES(1,1); SELECT * FROM h; SELECT * FROM h_0; CREATE INDEX h_idx ON h (x); DROP INDEX h_idx; DROP TABLE h; -- -- Test rows retrived or affected by statements \connect - :current_user SET pgaudit.log = 'all'; SET pgaudit.log_client = on; SET pgaudit.log_relation = on; SET pgaudit.log_statement_once = off; SET pgaudit.log_parameter = on; SET pgaudit.log_rows = on; -- -- Test DDL CREATE TABLE test2 ( id int, name text ); CREATE TABLE test3 ( id int, name text ); CREATE FUNCTION test2_insert() RETURNS TRIGGER AS $$ BEGIN UPDATE test2 SET id = id + 90 WHERE id = new.id; RETURN new; END $$ LANGUAGE plpgsql security definer; CREATE TRIGGER test2_insert_trg AFTER INSERT ON test2 FOR EACH ROW EXECUTE PROCEDURE test2_insert(); CREATE FUNCTION test2_change(change_id int) RETURNS void AS $$ BEGIN UPDATE test2 SET id = id + 1 WHERE id = change_id; END $$ LANGUAGE plpgsql security definer; CREATE VIEW vw_test3 AS SELECT * FROM test3; -- -- Test DML INSERT INTO test2 (id, name) VALUES (1, 'a'); INSERT INTO test2 (id, name) VALUES (2, 'b'); INSERT INTO test2 (id, name) VALUES (3, 'c'); INSERT INTO test3 (id, name) VALUES (1, 'a'); INSERT INTO test3 (id, name) VALUES (2, 'b'); INSERT INTO test3 (id, name) VALUES (3, 'c'); SELECT * FROM test3, test2; SELECT * FROM vw_test3, test2; SELECT * FROM test2 ORDER BY ID; UPDATE test2 SET name = 'd'; UPDATE test3 SET name = 'd' WHERE id > 0; SELECT 1 FROM ( SELECT relname FROM pg_class LIMIT 3 ) SUBQUERY; WITH CTE AS ( SELECT id FROM test2 ) INSERT INTO test3 SELECT id FROM cte; WITH CTE AS ( INSERT INTO test3 VALUES (1) RETURNING id ) INSERT INTO test2 SELECT id FROM cte; DO $$ BEGIN PERFORM test2_change(91); END $$; WITH CTE AS ( UPDATE test2 SET id = 45 WHERE id = 92 RETURNING id ) INSERT INTO test3 SELECT id FROM cte; WITH CTE AS ( INSERT INTO test2 VALUES (37) RETURNING id ) UPDATE test3 SET id = cte.id FROM cte WHERE test3.id <> cte.id; DELETE FROM test2; DELETE FROM test3 WHERE id > 0; -- -- Drop test tables DROP TABLE test2; DROP VIEW vw_test3; DROP TABLE test3; DROP FUNCTION test2_insert(); DROP FUNCTION test2_change(int); -- -- Only object logging will be done SET pgaudit.log = 'none'; SET pgaudit.role = 'regress_auditor'; -- -- Select is session logged SELECT * FROM account; -- -- Insert is not logged INSERT INTO account (id, name, password, description) VALUES (1, 'regress_user2', 'HASH3', 'blah, blah2'); INSERT INTO account (id, name, password, description) VALUES (1, 'user3', 'HASH4', 'blah, blah3'); -- -- Not object logged SELECT id, name FROM account; -- -- Object logged because of: -- select (password) on account SELECT password FROM account; -- -- Not object logged UPDATE account SET description = 'yada, yada1'; -- -- Object logged because of: -- update (password) on account UPDATE account SET password = 'HASH4'; -- -- Session relation logging will be done SET pgaudit.log_relation = on; SET pgaudit.log = 'read, write'; -- -- Object logged because of: -- select (password) on account -- select on account_role_map -- Session logged on all tables because log = read and log_relation = on SELECT account.password, account_role_map.role_id FROM account INNER JOIN account_role_map on account.id = account_role_map.account_id; -- -- Object logged because of: -- select (password) on account -- Session logged on all tables because log = read and log_relation = on SELECT password FROM account; -- -- Not object logged -- Session logged on all tables because log = read and log_relation = on UPDATE account SET description = 'yada, yada2'; -- -- Object logged because of: -- select (password) on account (in the where clause) -- Session logged on all tables because log = read and log_relation = on UPDATE account SET description = 'yada, yada3' where password = 'HASH4'; -- -- Object logged because of: -- update (password) on account -- Session logged on all tables because log = read and log_relation = on UPDATE account SET password = 'HASH4'; -- -- Exhaustive tests SET pgaudit.log = 'all'; SET pgaudit.log_client = on; SET pgaudit.log_relation = on; SET pgaudit.log_parameter = on; SET pgaudit.log_rows = on; -- -- Simple DO block DO $$ BEGIN raise notice 'test'; END $$; -- -- Copy account to stdout COPY account TO stdout; -- -- Drop a table from a query DROP TABLE test.account_copy; -- -- Create a table from a query CREATE TABLE test.account_copy AS SELECT * FROM account; -- -- Copy from stdin to account copy COPY test.account_copy from stdin; 1 regress_user1 HASH4 yada, yada4 \. -- -- Test prepared statement PREPARE pgclassstmt1 (oid) AS SELECT 1 FROM account WHERE id = $1; PREPARE pgclassstmt2 (oid) AS SELECT 2 FROM account WHERE id = $1; EXECUTE pgclassstmt2 (1); EXECUTE pgclassstmt1 (1); DEALLOCATE pgclassstmt2; DEALLOCATE pgclassstmt1; -- -- Test cursor BEGIN; DECLARE ctest1 SCROLL CURSOR FOR SELECT 1 FROM ( SELECT relname FROM pg_class LIMIT 3 ) subquery; DECLARE ctest2 SCROLL CURSOR FOR SELECT 2 FROM ( SELECT relname FROM pg_class LIMIT 3 ) subquery; FETCH NEXT FROM ctest1; FETCH NEXT FROM ctest2; FETCH NEXT FROM ctest1; FETCH NEXT FROM ctest2; FETCH NEXT FROM ctest1; FETCH NEXT FROM ctest2; CLOSE ctest2; CLOSE ctest1; COMMIT; -- -- Turn off log_catalog and pg_class will not be logged SET pgaudit.log_catalog = off; SELECT count(*) FROM ( SELECT relname FROM pg_class LIMIT 1 ) subquery; -- -- Test prepared insert DROP TABLE test.test_insert; -- -- Test prepared insert CREATE TABLE test.test_insert ( id INT ); PREPARE pgclassstmt (oid) AS INSERT INTO test.test_insert (id) VALUES ($1); EXECUTE pgclassstmt (1); -- -- Check that primary key creation is logged CREATE TABLE public.test ( id INT, name TEXT, description TEXT, CONSTRAINT test_pkey PRIMARY KEY (id) ); -- -- Check that analyze is logged ANALYZE test; -- -- Grants to public should not cause object logging (session logging will -- still happen) GRANT SELECT ON TABLE public.test TO PUBLIC; SELECT * FROM test; -- Check that statements without columns log SELECT FROM test; SELECT 1, substring('Thomas' from 2 for 3); DO $$ DECLARE test INT; BEGIN SELECT 1 INTO test; END $$; explain select 1; -- -- Test that looks inside of do blocks log INSERT INTO TEST (id) VALUES (1); INSERT INTO TEST (id) VALUES (2); INSERT INTO TEST (id) VALUES (3); DO $$ DECLARE result RECORD; BEGIN FOR result IN SELECT id FROM test LOOP INSERT INTO test (id) VALUES (result.id + 100); END LOOP; END $$; -- -- Test obfuscated dynamic sql for clean logging DO $$ DECLARE table_name TEXT = 'do_table'; BEGIN EXECUTE 'CREATE TABLE ' || table_name || ' ("weird name" INT)'; EXECUTE 'DROP table ' || table_name; END $$; -- -- Generate an error and make sure the stack gets cleared DO $$ BEGIN CREATE TABLE bogus.test_block ( id INT ); END $$; -- -- Test alter table statements ALTER TABLE public.test DROP COLUMN description ; ALTER TABLE public.test RENAME TO test2; ALTER TABLE public.test2 SET SCHEMA test; ALTER TABLE test.test2 ADD COLUMN description TEXT; ALTER TABLE test.test2 DROP COLUMN description; DROP TABLE test.test2; -- -- Test multiple statements with one semi-colon CREATE SCHEMA foo1 CREATE TABLE foo1.bar1 (id int) CREATE TABLE foo1.baz1 (id int); DROP TABLE foo1.bar1; DROP TABLE foo1.baz1; DROP SCHEMA foo1; -- -- Test aggregate CREATE FUNCTION public.int_add1 ( a INT, b INT ) RETURNS INT LANGUAGE plpgsql AS $$ BEGIN return a + b; END $$; SELECT int_add1(1, 1); CREATE AGGREGATE public.sum_test(INT) (SFUNC=public.int_add1, STYPE=INT, INITCOND='0'); ALTER AGGREGATE public.sum_test(integer) RENAME TO sum_test3; -- -- Test conversion CREATE CONVERSION public.conversion_test FOR 'latin1' TO 'utf8' FROM pg_catalog.iso8859_1_to_utf8; ALTER CONVERSION public.conversion_test RENAME TO conversion_test3; -- -- Test create/alter/drop database CREATE DATABASE contrib_regression_pgaudit; ALTER DATABASE contrib_regression_pgaudit RENAME TO contrib_regression_pgaudit2; DROP DATABASE contrib_regression_pgaudit2; -- Test role as a substmt SET pgaudit.log = 'role'; CREATE TABLE t (); CREATE ROLE regress_alice; CREATE SCHEMA foo3 GRANT SELECT ON public.t TO regress_alice; drop table public.t; drop role regress_alice; -- -- Test for non-empty stack error CREATE OR REPLACE FUNCTION get_test_id(_ret REFCURSOR) RETURNS REFCURSOR LANGUAGE plpgsql IMMUTABLE AS $$ BEGIN OPEN _ret FOR SELECT 200; RETURN _ret; END $$; BEGIN; SELECT get_test_id('_ret'); SELECT get_test_id('_ret2'); FETCH ALL FROM _ret; FETCH ALL FROM _ret2; CLOSE _ret; CLOSE _ret2; END; -- -- Test that frees a memory context earlier than expected SET pgaudit.log = 'all'; CREATE FUNCTION test1() RETURNS INT AS $$ DECLARE cur1 cursor for select * from hoge; tmp int; BEGIN OPEN cur1; FETCH cur1 into tmp; RETURN tmp; END $$ LANGUAGE plpgsql ; SELECT test1(); -- -- Delete all rows then delete 1 row SET pgaudit.log = 'write'; SET pgaudit.role = 'regress_auditor'; create table bar ( col int ); grant delete on bar to regress_auditor; insert into bar (col) values (1); delete from bar; insert into bar (col) values (1); delete from bar where col = 1; drop table bar; -- -- Test that FK references do not log but triggers still do SET pgaudit.log = 'read, write'; SET pgaudit.role TO 'regress_auditor'; CREATE TABLE aaa ( ID int primary key ); CREATE TABLE bbb ( id int references aaa(id) ); CREATE FUNCTION bbb_insert1() RETURNS TRIGGER AS $$ BEGIN UPDATE bbb set id = new.id + 1; RETURN new; END $$ LANGUAGE plpgsql; CREATE TRIGGER bbb_insert_trg1 AFTER INSERT ON bbb FOR EACH ROW EXECUTE PROCEDURE bbb_insert1(); GRANT SELECT, UPDATE ON aaa TO regress_auditor; GRANT UPDATE ON bbb TO regress_auditor; INSERT INTO aaa VALUES (generate_series(1,100)); SET pgaudit.log_parameter TO OFF; INSERT INTO bbb VALUES (1); SET pgaudit.log_parameter TO ON; DROP TABLE bbb; DROP TABLE aaa; -- -- Test MISC SET pgaudit.log = 'misc'; SET pgaudit.log_client = on; SET pgaudit.log_relation = on; SET pgaudit.log_parameter = on; CREATE ROLE regress_alice; SET ROLE regress_alice; CREATE TABLE t (a int, b text); SET search_path TO test, public; INSERT INTO t VALUES (1, 'misc'); VACUUM t; RESET ROLE; -- -- Test MISC_SET SET pgaudit.log = 'MISC_SET'; SET ROLE regress_alice; SET search_path TO public; INSERT INTO t VALUES (2, 'misc_set'); VACUUM t; RESET ROLE; -- -- Test ALL, -MISC, MISC_SET SET pgaudit.log = 'ALL, -MISC, MISC_SET'; SET search_path TO public; INSERT INTO t VALUES (3, 'all, -misc, misc_set'); VACUUM t; RESET ROLE; DROP TABLE public.t; DROP ROLE regress_alice; -- -- Test PARTITIONED table CREATE TABLE h(x int ,y int) PARTITION BY HASH(x); CREATE TABLE h_0 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 0); CREATE TABLE h_1 partition OF h FOR VALUES WITH ( MODULUS 2, REMAINDER 1); INSERT INTO h VALUES(1,1); SELECT * FROM h; SELECT * FROM h_0; CREATE INDEX h_idx ON h (x); DROP INDEX h_idx; DROP TABLE h; -- -- Change configuration of user 1 so that full statements are not logged \connect - :current_user ALTER ROLE regress_user1 RESET pgaudit.log_relation; ALTER ROLE regress_user1 RESET pgaudit.log; ALTER ROLE regress_user1 SET pgaudit.log_statement = OFF; ALTER ROLE regress_user1 SET pgaudit.log_rows = on; \connect - regress_user1 -- -- Logged but without full statement SELECT * FROM account; -- -- Change back to superuser to do exhaustive tests \connect - :current_user -- -- Test that pgaudit event triggers are immune to search-path-based attacks -- Attempt to capture unqualified references to standard functions CREATE FUNCTION upper(text) RETURNS text LANGUAGE SQL AS 'SELECT (1/0)::text'; CREATE FUNCTION lower(text) RETURNS text LANGUAGE SQL AS 'SELECT (1/0)::text'; CREATE FUNCTION my_ne(text, text) RETURNS bool LANGUAGE SQL AS 'SELECT (1/0)::bool'; CREATE OPERATOR <> (FUNCTION = my_ne, LEFTARG = text, RIGHTARG = text); CREATE EXTENSION IF NOT EXISTS pgaudit; SET pgaudit.log = 'DDL'; -- Put public schema before pg_catalog to capture unqualified references SET search_path = public, pg_catalog; -- If there was a vulnerability, these would fail with division by zero error CREATE TABLE wombat (); DROP TABLE wombat; SET pgaudit.log = 'NONE'; DROP EXTENSION pgaudit; DROP OPERATOR <> (text, text); DROP FUNCTION my_ne(text, text); DROP FUNCTION lower(text); DROP FUNCTION upper(text); -- Create/drop extension. Note that the log level here must be warning because the create extension code will reset any higher log -- levels like notice SET pgaudit.log = 'all,-misc_set'; SET pgaudit.log_level = 'warning'; CREATE EXTENSION pg_stat_statements; ALTER EXTENSION pg_stat_statements UPDATE TO '1.11'; DROP EXTENSION pg_stat_statements; SET pgaudit.log_level = 'notice'; -- Check that password redaction works with CREATE/ALTER USER MAPPING CREATE EXTENSION postgres_fdw; CREATE SERVER fdw_server FOREIGN DATA WRAPPER postgres_fdw OPTIONS (host 'foo', dbname 'foodb', port '5432'); CREATE USER MAPPING FOR regress_user1 SERVER fdw_server OPTIONS (user 'regress_user1', password 'secret'); ALTER USER MAPPING FOR regress_user1 SERVER fdw_server OPTIONS (SET /* comment */ password 'secret2'); DROP USER MAPPING FOR regress_user1 SERVER fdw_server; DROP SERVER fdw_server; DROP EXTENSION postgres_fdw; -- Cleanup -- Set client_min_messages up to warning to avoid noise SET client_min_messages = 'warning'; ALTER ROLE :current_user RESET pgaudit.log; ALTER ROLE :current_user RESET pgaudit.log_catalog; ALTER ROLE :current_user RESET pgaudit.log_client; ALTER ROLE :current_user RESET pgaudit.log_level; ALTER ROLE :current_user RESET pgaudit.log_parameter; ALTER ROLE :current_user RESET pgaudit.log_parameter_max_size; ALTER ROLE :current_user RESET pgaudit.log_relation; ALTER ROLE :current_user RESET pgaudit.log_statement; ALTER ROLE :current_user RESET pgaudit.log_statement_once; ALTER ROLE :current_user RESET pgaudit.role; RESET pgaudit.log; RESET pgaudit.log_catalog; RESET pgaudit.log_level; RESET pgaudit.log_parameter; RESET pgaudit.log_parameter_max_size; RESET pgaudit.log_relation; RESET pgaudit.log_statement; RESET pgaudit.log_statement_once; RESET pgaudit.role; DROP TABLE test.account_copy; DROP TABLE test.test_insert; DROP SCHEMA test; DROP TABLE foo.bar; DROP TABLE foo.baz; DROP SCHEMA foo; DROP TABLE hoge; DROP TABLE account; DROP TABLE account_role_map; DROP USER regress_user2; DROP USER regress_user1; DROP ROLE regress_auditor; RESET client_min_messages; pgaudit-17.1/test/000077500000000000000000000000001475542732400140735ustar00rootroot00000000000000pgaudit-17.1/test/Dockerfile.debian000066400000000000000000000023721475542732400173120ustar00rootroot00000000000000FROM ubuntu:jammy # Install packages RUN apt-get update RUN DEBIAN_FRONTEND=noninteractive apt-get install -y sudo wget gnupg tzdata locales lsb-release apt-utils make gcc libssl-dev \ libkrb5-dev # Create postgres user/group with specific IDs ARG UID=1000 ARG GID=1000 RUN groupadd -g $GID -o postgres RUN useradd -m -u $UID -g $GID -o -s /bin/bash postgres # Add PostgreSQL repository RUN RELEASE_CODENAME=`lsb_release -c | awk '{print $2}'` && \ echo 'deb http://apt.postgresql.org/pub/repos/apt/ '${RELEASE_CODENAME?}'-pgdg main 17' | \ tee -a /etc/apt/sources.list.d/pgdg.list RUN APT_KEY_DONT_WARN_ON_DANGEROUS_USAGE=1 && \ wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc | sudo apt-key add - RUN apt-get update # Install PostgreSQL ENV PGVERSION=17 RUN apt-get install -y postgresql-${PGVERSION?} postgresql-server-dev-${PGVERSION?} # Create PostgreSQL cluster ENV PGBIN=/usr/lib/postgresql/${PGVERSION}/bin ENV PGDATA="/var/lib/postgresql/${PGVERSION}/test" ENV PATH="${PATH}:${PGBIN}" RUN sudo -u postgres ${PGBIN?}/initdb -A trust -k ${PGDATA?} RUN echo "shared_preload_libraries = 'pgaudit'" >> ${PGDATA}/postgresql.conf # Configure sudo RUN echo 'postgres ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers USER postgres pgaudit-17.1/test/Dockerfile.rhel000066400000000000000000000026001475542732400170140ustar00rootroot00000000000000FROM rockylinux/rockylinux:8 # Install packages RUN dnf install -y sudo make gcc llvm-toolset openssl-devel redhat-rpm-config # Install and enable EPEL repository RUN dnf -y install epel-release RUN crb enable # Create postgres user/group with specific IDs ARG UID=1000 ARG GID=1000 RUN groupadd -g $GID -o postgres RUN useradd -m -u $UID -g $GID -o -s /bin/bash postgres # Add PostgreSQL repository RUN dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-8-`uname -m`/pgdg-redhat-repo-latest.noarch.rpm # Disable PostgreSQL in default repository RUN dnf -qy module disable postgresql # Enable PG17 repo (can be removed after the official release) RUN dnf config-manager --set-enabled pgdg17-updates-testing # Install PostgreSQL ENV PGVERSION=17 RUN dnf install -y postgresql${PGVERSION?}-server postgresql${PGVERSION?}-devel postgresql${PGVERSION?}-contrib # Configure llvm lib (required for aarch64) RUN echo /opt/rh/llvm-toolset-7.0/root/usr/lib64/ > /etc/ld.so.conf.d/llvm-toolset.conf RUN ldconfig # Create PostgreSQL cluster ENV PGBIN=/usr/pgsql-${PGVERSION}/bin ENV PGDATA="/var/lib/pgsql/${PGVERSION}/data" ENV PATH="${PATH}:${PGBIN}" RUN sudo -u postgres ${PGBIN?}/initdb -A trust -k ${PGDATA?} RUN echo "shared_preload_libraries = 'pgaudit'" >> ${PGDATA?}/postgresql.conf # Configure sudo RUN echo 'postgres ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers USER postgres pgaudit-17.1/test/README.md000066400000000000000000000006351475542732400153560ustar00rootroot00000000000000# Testing Testing is performed using a Docker container. First build the container: ``` docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g) -f test/Dockerfile.debian -t pgaudit-test . ``` or ``` docker build --build-arg UID=$(id -u) --build-arg GID=$(id -g) -f test/Dockerfile.rhel -t pgaudit-test . ``` Then run the test: ``` docker run --rm -v $(pwd):/pgaudit pgaudit-test /pgaudit/test/test.sh ``` pgaudit-17.1/test/test.sh000077500000000000000000000005221475542732400154100ustar00rootroot00000000000000#!/bin/bash set -e # Clean and build pgaudit make -C /pgaudit clean all USE_PGXS=1 # Install pgaudit so postgres will start with shared_preload_libraries set sudo bash -c "PATH=${PATH?} make -C /pgaudit install USE_PGXS=1" # Start postgres ${PGBIN}/pg_ctl -w start -D ${PGDATA} # Test pgaudit make -C /pgaudit installcheck USE_PGXS=1