From afd463de160d0b4fc16fcdb5cc50ad0d431b60d4 Mon Sep 17 00:00:00 2001 From: Cachuela Date: Thu, 28 Sep 2023 08:54:49 +0800 Subject: [PATCH] enter --- .../security/gs_policy/gs_policy_audit.cpp | 32 +++++++++++-------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/src/gausskernel/security/gs_policy/gs_policy_audit.cpp b/src/gausskernel/security/gs_policy/gs_policy_audit.cpp index 44166a2f7..8aff9652e 100644 --- a/src/gausskernel/security/gs_policy/gs_policy_audit.cpp +++ b/src/gausskernel/security/gs_policy/gs_policy_audit.cpp @@ -931,7 +931,7 @@ static void update_audit_policy_actions(privileges_access_set& privs_to_add, pri */ void alter_audit_policy(AlterAuditPolicyStmt *stmt) { - /* check that if has access to config audit policy */ + // 检查是否具有配置审计策略的权限 if (!is_policy_enabled()) { ereport(ERROR, (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), errmsg("Permission denied."))); return; @@ -941,15 +941,19 @@ void alter_audit_policy(AlterAuditPolicyStmt *stmt) char user_name[USERNAME_LEN] = {0}; char session_ip[MAX_IP_LEN] = {0}; + // 获取当前用户的用户名和会话IP地址 get_session_ip(session_ip, MAX_IP_LEN); (void)GetRoleName(GetCurrentUserId(), user_name, sizeof(user_name)); + // 构建管理消息 int rc = snprintf_s(buff, sizeof(buff), sizeof(buff) - 1, "user name: [%s], app_name: [%s], ip: [%s], ALTER AUDIT POLICY [%s] FOR %s", user_name, u_sess->attr.attr_common.application_name, session_ip, stmt->policy_name, stmt->policy_action); securec_check_ss(rc, "", ""); save_manage_message(buff); + const char *policy_name = stmt->policy_name; + policies_set existing_policies; policy_labels_map existing_labels; @@ -961,24 +965,24 @@ void alter_audit_policy(AlterAuditPolicyStmt *stmt) privileges_access_set access_to_remove; privileges_access_set access_to_add; - Relation policy_relation = NULL; - Relation labels_relation = NULL; + Relation policy_relation = NULL; + Relation labels_relation = NULL; - /* Open the relation for read and insertion */ + // 打开审计策略关系以进行读取和插入 policy_relation = heap_open(GsAuditingPolicyRelationId, RowExclusiveLock); load_existing_policies(policy_relation, &existing_policies); - /* first check whether such policy exists */ + // 首先检查是否存在此策略 GsPolicyStruct cur_policy; cur_policy.m_name = policy_name; policies_set::iterator it = existing_policies.find(cur_policy); if (it == existing_policies.end()) { heap_close(policy_relation, RowExclusiveLock); - if (stmt->missing_ok) { /* IF EXISTS is specified, generate a notice */ + if (stmt->missing_ok) { // 如果指定了 IF EXISTS，则生成通知 send_manage_message(AUDIT_OK); ereport(NOTICE, (errmsg("%s policy not found, alter skipping", policy_name))); } else { - /* generate an error */ + // 生成错误消息 send_manage_message(AUDIT_FAILED); ereport(ERROR, (errcode(ERRCODE_WRONG_OBJECT_TYPE), @@ -989,7 +993,7 @@ void alter_audit_policy(AlterAuditPolicyStmt *stmt) cur_policy.m_id = it->m_id; cur_policy.m_enabled = it->m_enabled; - /* Update policy if needed */ + // 如果需要，更新策略 bool policy_status_changed = false; if (stmt->policy_enabled != NULL) { DefElem *defel = (DefElem *) stmt->policy_enabled; @@ -1006,7 +1010,7 @@ void alter_audit_policy(AlterAuditPolicyStmt *stmt) gs_stl::gs_string err_msg; if (!update_policy(&cur_policy, policy_relation, policy_status_changed, &err_msg)) { heap_close(policy_relation, RowExclusiveLock); - /* generate an error */ + // 生成错误消息 send_manage_message(AUDIT_FAILED); ereport(ERROR, (errcode(ERRCODE_WRONG_OBJECT_TYPE), @@ -1016,24 +1020,25 @@ void alter_audit_policy(AlterAuditPolicyStmt *stmt) } heap_close(policy_relation, RowExclusiveLock); + // 打开策略标签关系以进行读取 labels_relation = heap_open(GsPolicyLabelRelationId, RowExclusiveLock); load_existing_labels(labels_relation, &existing_labels); heap_close(labels_relation, RowExclusiveLock); - /* Get current timestamp */ + // 获取当前时间戳 (void)DirectFunctionCall1(timestamptz_timestamp, GetCurrentTimestamp()); load_existing_privileges(&existing_privileges, cur_policy.m_id); load_existing_access(&existing_access, cur_policy.m_id); - /* Extract policy items from the statement node tree */ + // 提取语句节点树中的策略项 gs_stl::gs_string err_msg; - handle_alter_audit_node(stmt, err_msg, cur_policy, access_to_add, access_to_remove, privs_to_add, privs_to_remove, existing_labels, existing_privileges, existing_access); update_audit_policy_actions(privs_to_add, privs_to_remove, access_to_add, access_to_remove, cur_policy, existing_privileges, existing_access, err_msg); handle_alter_add_update_filter(stmt->policy_filters, cur_policy.m_id, false /* update filter */); + // 如果策略操作为 "drop_filter"，则删除策略引用 if (stmt->policy_action && !strcmp(stmt->policy_action, "drop_filter")) { drop_policy_reference(GsAuditingPolicyFiltersRelationId, cur_policy.m_id); } @@ -1050,12 +1055,13 @@ void alter_audit_policy(AlterAuditPolicyStmt *stmt) if (load_audit_policies_hook) { load_audit_policies_hook(false); } - /* load filters must be last */ + // 加载策略过滤器必须放在最后 if (load_policy_filter_hook) { load_policy_filter_hook(false); } } + /** * Main enterance for droping audit policy, which will drop all the catalog information associated with this Policy. * @stmt : Data structure for Drop Policy syntax