src/backend/catalog/catalog.c

   1 /*-------------------------------------------------------------------------
   2  *
   3  * catalog.c
   4  *              routines concerned with catalog naming conventions and other
   5  *              bits of hard-wired knowledge
   6  *
   7  *
   8  * Portions Copyright (c) 1996-2024, PostgreSQL Global Development Group
   9  * Portions Copyright (c) 1994, Regents of the University of California
  10  *
  11  *
  12  * IDENTIFICATION
  13  *        src/backend/catalog/catalog.c
  14  *
  15  *-------------------------------------------------------------------------
  16  */
  17
  18 #include "postgres.h"
  19
  20 #include <fcntl.h>
  21 #include <unistd.h>
  22
  23 #include "access/genam.h"
  24 #include "access/htup_details.h"
  25 #include "access/table.h"
  26 #include "access/transam.h"
  27 #include "catalog/catalog.h"
  28 #include "catalog/namespace.h"
  29 #include "catalog/pg_auth_members.h"
  30 #include "catalog/pg_authid.h"
  31 #include "catalog/pg_database.h"
  32 #include "catalog/pg_db_role_setting.h"
  33 #include "catalog/pg_largeobject.h"
  34 #include "catalog/pg_namespace.h"
  35 #include "catalog/pg_parameter_acl.h"
  36 #include "catalog/pg_replication_origin.h"
  37 #include "catalog/pg_shdepend.h"
  38 #include "catalog/pg_shdescription.h"
  39 #include "catalog/pg_shseclabel.h"
  40 #include "catalog/pg_subscription.h"
  41 #include "catalog/pg_tablespace.h"
  42 #include "catalog/pg_type.h"
  43 #include "miscadmin.h"
  44 #include "utils/fmgroids.h"
  45 #include "utils/fmgrprotos.h"
  46 #include "utils/rel.h"
  47 #include "utils/snapmgr.h"
  48 #include "utils/syscache.h"
  49
  50 /*
  51  * Parameters to determine when to emit a log message in
  52  * GetNewOidWithIndex()
  53  */
  54 #define GETNEWOID_LOG_THRESHOLD 1000000
  55 #define GETNEWOID_LOG_MAX_INTERVAL 128000000
  56
  57 /*
  58  * IsSystemRelation
  59  *              True iff the relation is either a system catalog or a toast table.
  60  *              See IsCatalogRelation for the exact definition of a system catalog.
  61  *
  62  *              We treat toast tables of user relations as "system relations" for
  63  *              protection purposes, e.g. you can't change their schemas without
  64  *              special permissions.  Therefore, most uses of this function are
  65  *              checking whether allow_system_table_mods restrictions apply.
  66  *              For other purposes, consider whether you shouldn't be using
  67  *              IsCatalogRelation instead.
  68  *
  69  *              This function does not perform any catalog accesses.
  70  *              Some callers rely on that!
  71  */
  72 bool
  73 IsSystemRelation(Relation relation)
  74 {
  75         return IsSystemClass(RelationGetRelid(relation), relation->rd_rel);
  76 }
  77
  78 /*
  79  * IsSystemClass
  80  *              Like the above, but takes a Form_pg_class as argument.
  81  *              Used when we do not want to open the relation and have to
  82  *              search pg_class directly.
  83  */
  84 bool
  85 IsSystemClass(Oid relid, Form_pg_class reltuple)
  86 {
  87         /* IsCatalogRelationOid is a bit faster, so test that first */
  88         return (IsCatalogRelationOid(relid) || IsToastClass(reltuple));
  89 }
  90
  91 /*
  92  * IsCatalogRelation
  93  *              True iff the relation is a system catalog.
  94  *
  95  *              By a system catalog, we mean one that is created during the bootstrap
  96  *              phase of initdb.  That includes not just the catalogs per se, but
  97  *              also their indexes, and TOAST tables and indexes if any.
  98  *
  99  *              This function does not perform any catalog accesses.
 100  *              Some callers rely on that!
 101  */
 102 bool
 103 IsCatalogRelation(Relation relation)
 104 {
 105         return IsCatalogRelationOid(RelationGetRelid(relation));
 106 }
 107
 108 /*
 109  * IsCatalogRelationOid
 110  *              True iff the relation identified by this OID is a system catalog.
 111  *
 112  *              By a system catalog, we mean one that is created during the bootstrap
 113  *              phase of initdb.  That includes not just the catalogs per se, but
 114  *              also their indexes, and TOAST tables and indexes if any.
 115  *
 116  *              This function does not perform any catalog accesses.
 117  *              Some callers rely on that!
 118  */
 119 bool
 120 IsCatalogRelationOid(Oid relid)
 121 {
 122         /*
 123          * We consider a relation to be a system catalog if it has a pinned OID.
 124          * This includes all the defined catalogs, their indexes, and their TOAST
 125          * tables and indexes.
 126          *
 127          * This rule excludes the relations in information_schema, which are not
 128          * integral to the system and can be treated the same as user relations.
 129          * (Since it's valid to drop and recreate information_schema, any rule
 130          * that did not act this way would be wrong.)
 131          *
 132          * This test is reliable since an OID wraparound will skip this range of
 133          * OIDs; see GetNewObjectId().
 134          */
 135         return (relid < (Oid) FirstUnpinnedObjectId);
 136 }
 137
 138 /*
 139  * IsInplaceUpdateRelation
 140  *              True iff core code performs inplace updates on the relation.
 141  *
 142  *              This is used for assertions and for making the executor follow the
 143  *              locking protocol described at README.tuplock section "Locking to write
 144  *              inplace-updated tables".  Extensions may inplace-update other heap
 145  *              tables, but concurrent SQL UPDATE on the same table may overwrite
 146  *              those modifications.
 147  *
 148  *              The executor can assume these are not partitions or partitioned and
 149  *              have no triggers.
 150  */
 151 bool
 152 IsInplaceUpdateRelation(Relation relation)
 153 {
 154         return IsInplaceUpdateOid(RelationGetRelid(relation));
 155 }
 156
 157 /*
 158  * IsInplaceUpdateOid
 159  *              Like the above, but takes an OID as argument.
 160  */
 161 bool
 162 IsInplaceUpdateOid(Oid relid)
 163 {
 164         return (relid == RelationRelationId ||
 165                         relid == DatabaseRelationId);
 166 }
 167
 168 /*
 169  * IsToastRelation
 170  *              True iff relation is a TOAST support relation (or index).
 171  *
 172  *              Does not perform any catalog accesses.
 173  */
 174 bool
 175 IsToastRelation(Relation relation)
 176 {
 177         /*
 178          * What we actually check is whether the relation belongs to a pg_toast
 179          * namespace.  This should be equivalent because of restrictions that are
 180          * enforced elsewhere against creating user relations in, or moving
 181          * relations into/out of, a pg_toast namespace.  Notice also that this
 182          * will not say "true" for toast tables belonging to other sessions' temp
 183          * tables; we expect that other mechanisms will prevent access to those.
 184          */
 185         return IsToastNamespace(RelationGetNamespace(relation));
 186 }
 187
 188 /*
 189  * IsToastClass
 190  *              Like the above, but takes a Form_pg_class as argument.
 191  *              Used when we do not want to open the relation and have to
 192  *              search pg_class directly.
 193  */
 194 bool
 195 IsToastClass(Form_pg_class reltuple)
 196 {
 197         Oid                     relnamespace = reltuple->relnamespace;
 198
 199         return IsToastNamespace(relnamespace);
 200 }
 201
 202 /*
 203  * IsCatalogNamespace
 204  *              True iff namespace is pg_catalog.
 205  *
 206  *              Does not perform any catalog accesses.
 207  *
 208  * NOTE: the reason this isn't a macro is to avoid having to include
 209  * catalog/pg_namespace.h in a lot of places.
 210  */
 211 bool
 212 IsCatalogNamespace(Oid namespaceId)
 213 {
 214         return namespaceId == PG_CATALOG_NAMESPACE;
 215 }
 216
 217 /*
 218  * IsToastNamespace
 219  *              True iff namespace is pg_toast or my temporary-toast-table namespace.
 220  *
 221  *              Does not perform any catalog accesses.
 222  *
 223  * Note: this will return false for temporary-toast-table namespaces belonging
 224  * to other backends.  Those are treated the same as other backends' regular
 225  * temp table namespaces, and access is prevented where appropriate.
 226  * If you need to check for those, you may be able to use isAnyTempNamespace,
 227  * but beware that that does involve a catalog access.
 228  */
 229 bool
 230 IsToastNamespace(Oid namespaceId)
 231 {
 232         return (namespaceId == PG_TOAST_NAMESPACE) ||
 233                 isTempToastNamespace(namespaceId);
 234 }
 235
 236
 237 /*
 238  * IsReservedName
 239  *              True iff name starts with the pg_ prefix.
 240  *
 241  *              For some classes of objects, the prefix pg_ is reserved for
 242  *              system objects only.  As of 8.0, this was only true for
 243  *              schema and tablespace names.  With 9.6, this is also true
 244  *              for roles.
 245  */
 246 bool
 247 IsReservedName(const char *name)
 248 {
 249         /* ugly coding for speed */
 250         return (name[0] == 'p' &&
 251                         name[1] == 'g' &&
 252                         name[2] == '_');
 253 }
 254
 255
 256 /*
 257  * IsSharedRelation
 258  *              Given the OID of a relation, determine whether it's supposed to be
 259  *              shared across an entire database cluster.
 260  *
 261  * In older releases, this had to be hard-wired so that we could compute the
 262  * locktag for a relation and lock it before examining its catalog entry.
 263  * Since we now have MVCC catalog access, the race conditions that made that
 264  * a hard requirement are gone, so we could look at relaxing this restriction.
 265  * However, if we scanned the pg_class entry to find relisshared, and only
 266  * then locked the relation, pg_class could get updated in the meantime,
 267  * forcing us to scan the relation again, which would definitely be complex
 268  * and might have undesirable performance consequences.  Fortunately, the set
 269  * of shared relations is fairly static, so a hand-maintained list of their
 270  * OIDs isn't completely impractical.
 271  */
 272 bool
 273 IsSharedRelation(Oid relationId)
 274 {
 275         /* These are the shared catalogs (look for BKI_SHARED_RELATION) */
 276         if (relationId == AuthIdRelationId ||
 277                 relationId == AuthMemRelationId ||
 278                 relationId == DatabaseRelationId ||
 279                 relationId == DbRoleSettingRelationId ||
 280                 relationId == ParameterAclRelationId ||
 281                 relationId == ReplicationOriginRelationId ||
 282                 relationId == SharedDependRelationId ||
 283                 relationId == SharedDescriptionRelationId ||
 284                 relationId == SharedSecLabelRelationId ||
 285                 relationId == SubscriptionRelationId ||
 286                 relationId == TableSpaceRelationId)
 287                 return true;
 288         /* These are their indexes */
 289         if (relationId == AuthIdOidIndexId ||
 290                 relationId == AuthIdRolnameIndexId ||
 291                 relationId == AuthMemMemRoleIndexId ||
 292                 relationId == AuthMemRoleMemIndexId ||
 293                 relationId == AuthMemOidIndexId ||
 294                 relationId == AuthMemGrantorIndexId ||
 295                 relationId == DatabaseNameIndexId ||
 296                 relationId == DatabaseOidIndexId ||
 297                 relationId == DbRoleSettingDatidRolidIndexId ||
 298                 relationId == ParameterAclOidIndexId ||
 299                 relationId == ParameterAclParnameIndexId ||
 300                 relationId == ReplicationOriginIdentIndex ||
 301                 relationId == ReplicationOriginNameIndex ||
 302                 relationId == SharedDependDependerIndexId ||
 303                 relationId == SharedDependReferenceIndexId ||
 304                 relationId == SharedDescriptionObjIndexId ||
 305                 relationId == SharedSecLabelObjectIndexId ||
 306                 relationId == SubscriptionNameIndexId ||
 307                 relationId == SubscriptionObjectIndexId ||
 308                 relationId == TablespaceNameIndexId ||
 309                 relationId == TablespaceOidIndexId)
 310                 return true;
 311         /* These are their toast tables and toast indexes */
 312         if (relationId == PgDatabaseToastTable ||
 313                 relationId == PgDatabaseToastIndex ||
 314                 relationId == PgDbRoleSettingToastTable ||
 315                 relationId == PgDbRoleSettingToastIndex ||
 316                 relationId == PgParameterAclToastTable ||
 317                 relationId == PgParameterAclToastIndex ||
 318                 relationId == PgReplicationOriginToastTable ||
 319                 relationId == PgReplicationOriginToastIndex ||
 320                 relationId == PgShdescriptionToastTable ||
 321                 relationId == PgShdescriptionToastIndex ||
 322                 relationId == PgShseclabelToastTable ||
 323                 relationId == PgShseclabelToastIndex ||
 324                 relationId == PgSubscriptionToastTable ||
 325                 relationId == PgSubscriptionToastIndex ||
 326                 relationId == PgTablespaceToastTable ||
 327                 relationId == PgTablespaceToastIndex)
 328                 return true;
 329         return false;
 330 }
 331
 332 /*
 333  * IsPinnedObject
 334  *              Given the class + OID identity of a database object, report whether
 335  *              it is "pinned", that is not droppable because the system requires it.
 336  *
 337  * We used to represent this explicitly in pg_depend, but that proved to be
 338  * an undesirable amount of overhead, so now we rely on an OID range test.
 339  */
 340 bool
 341 IsPinnedObject(Oid classId, Oid objectId)
 342 {
 343         /*
 344          * Objects with OIDs above FirstUnpinnedObjectId are never pinned.  Since
 345          * the OID generator skips this range when wrapping around, this check
 346          * guarantees that user-defined objects are never considered pinned.
 347          */
 348         if (objectId >= FirstUnpinnedObjectId)
 349                 return false;
 350
 351         /*
 352          * Large objects are never pinned.  We need this special case because
 353          * their OIDs can be user-assigned.
 354          */
 355         if (classId == LargeObjectRelationId)
 356                 return false;
 357
 358         /*
 359          * There are a few objects defined in the catalog .dat files that, as a
 360          * matter of policy, we prefer not to treat as pinned.  We used to handle
 361          * that by excluding them from pg_depend, but it's just as easy to
 362          * hard-wire their OIDs here.  (If the user does indeed drop and recreate
 363          * them, they'll have new but certainly-unpinned OIDs, so no problem.)
 364          *
 365          * Checking both classId and objectId is overkill, since OIDs below
 366          * FirstGenbkiObjectId should be globally unique, but do it anyway for
 367          * robustness.
 368          */
 369
 370         /* the public namespace is not pinned */
 371         if (classId == NamespaceRelationId &&
 372                 objectId == PG_PUBLIC_NAMESPACE)
 373                 return false;
 374
 375         /*
 376          * Databases are never pinned.  It might seem that it'd be prudent to pin
 377          * at least template0; but we do this intentionally so that template0 and
 378          * template1 can be rebuilt from each other, thus letting them serve as
 379          * mutual backups (as long as you've not modified template1, anyway).
 380          */
 381         if (classId == DatabaseRelationId)
 382                 return false;
 383
 384         /*
 385          * All other initdb-created objects are pinned.  This is overkill (the
 386          * system doesn't really depend on having every last weird datatype, for
 387          * instance) but generating only the minimum required set of dependencies
 388          * seems hard, and enforcing an accurate list would be much more expensive
 389          * than the simple range test used here.
 390          */
 391         return true;
 392 }
 393
 394
 395 /*
 396  * GetNewOidWithIndex
 397  *              Generate a new OID that is unique within the system relation.
 398  *
 399  * Since the OID is not immediately inserted into the table, there is a
 400  * race condition here; but a problem could occur only if someone else
 401  * managed to cycle through 2^32 OIDs and generate the same OID before we
 402  * finish inserting our row.  This seems unlikely to be a problem.  Note
 403  * that if we had to *commit* the row to end the race condition, the risk
 404  * would be rather higher; therefore we use SnapshotAny in the test, so that
 405  * we will see uncommitted rows.  (We used to use SnapshotDirty, but that has
 406  * the disadvantage that it ignores recently-deleted rows, creating a risk
 407  * of transient conflicts for as long as our own MVCC snapshots think a
 408  * recently-deleted row is live.  The risk is far higher when selecting TOAST
 409  * OIDs, because SnapshotToast considers dead rows as active indefinitely.)
 410  *
 411  * Note that we are effectively assuming that the table has a relatively small
 412  * number of entries (much less than 2^32) and there aren't very long runs of
 413  * consecutive existing OIDs.  This is a mostly reasonable assumption for
 414  * system catalogs.
 415  *
 416  * Caller must have a suitable lock on the relation.
 417  */
 418 Oid
 419 GetNewOidWithIndex(Relation relation, Oid indexId, AttrNumber oidcolumn)
 420 {
 421         Oid                     newOid;
 422         SysScanDesc scan;
 423         ScanKeyData key;
 424         bool            collides;
 425         uint64          retries = 0;
 426         uint64          retries_before_log = GETNEWOID_LOG_THRESHOLD;
 427
 428         /* Only system relations are supported */
 429         Assert(IsSystemRelation(relation));
 430
 431         /* In bootstrap mode, we don't have any indexes to use */
 432         if (IsBootstrapProcessingMode())
 433                 return GetNewObjectId();
 434
 435         /*
 436          * We should never be asked to generate a new pg_type OID during
 437          * pg_upgrade; doing so would risk collisions with the OIDs it wants to
 438          * assign.  Hitting this assert means there's some path where we failed to
 439          * ensure that a type OID is determined by commands in the dump script.
 440          */
 441         Assert(!IsBinaryUpgrade || RelationGetRelid(relation) != TypeRelationId);
 442
 443         /* Generate new OIDs until we find one not in the table */
 444         do
 445         {
 446                 CHECK_FOR_INTERRUPTS();
 447
 448                 newOid = GetNewObjectId();
 449
 450                 ScanKeyInit(&key,
 451                                         oidcolumn,
 452                                         BTEqualStrategyNumber, F_OIDEQ,
 453                                         ObjectIdGetDatum(newOid));
 454
 455                 /* see notes above about using SnapshotAny */
 456                 scan = systable_beginscan(relation, indexId, true,
 457                                                                   SnapshotAny, 1, &key);
 458
 459                 collides = HeapTupleIsValid(systable_getnext(scan));
 460
 461                 systable_endscan(scan);
 462
 463                 /*
 464                  * Log that we iterate more than GETNEWOID_LOG_THRESHOLD but have not
 465                  * yet found OID unused in the relation. Then repeat logging with
 466                  * exponentially increasing intervals until we iterate more than
 467                  * GETNEWOID_LOG_MAX_INTERVAL. Finally repeat logging every
 468                  * GETNEWOID_LOG_MAX_INTERVAL unless an unused OID is found. This
 469                  * logic is necessary not to fill up the server log with the similar
 470                  * messages.
 471                  */
 472                 if (retries >= retries_before_log)
 473                 {
 474                         ereport(LOG,
 475                                         (errmsg("still searching for an unused OID in relation \"%s\"",
 476                                                         RelationGetRelationName(relation)),
 477                                          errdetail_plural("OID candidates have been checked %llu time, but no unused OID has been found yet.",
 478                                                                           "OID candidates have been checked %llu times, but no unused OID has been found yet.",
 479                                                                           retries,
 480                                                                           (unsigned long long) retries)));
 481
 482                         /*
 483                          * Double the number of retries to do before logging next until it
 484                          * reaches GETNEWOID_LOG_MAX_INTERVAL.
 485                          */
 486                         if (retries_before_log * 2 <= GETNEWOID_LOG_MAX_INTERVAL)
 487                                 retries_before_log *= 2;
 488                         else
 489                                 retries_before_log += GETNEWOID_LOG_MAX_INTERVAL;
 490                 }
 491
 492                 retries++;
 493         } while (collides);
 494
 495         /*
 496          * If at least one log message is emitted, also log the completion of OID
 497          * assignment.
 498          */
 499         if (retries > GETNEWOID_LOG_THRESHOLD)
 500         {
 501                 ereport(LOG,
 502                                 (errmsg_plural("new OID has been assigned in relation \"%s\" after %llu retry",
 503                                                            "new OID has been assigned in relation \"%s\" after %llu retries",
 504                                                            retries,
 505                                                            RelationGetRelationName(relation), (unsigned long long) retries)));
 506         }
 507
 508         return newOid;
 509 }
 510
 511 /*
 512  * GetNewRelFileNumber
 513  *              Generate a new relfilenumber that is unique within the
 514  *              database of the given tablespace.
 515  *
 516  * If the relfilenumber will also be used as the relation's OID, pass the
 517  * opened pg_class catalog, and this routine will guarantee that the result
 518  * is also an unused OID within pg_class.  If the result is to be used only
 519  * as a relfilenumber for an existing relation, pass NULL for pg_class.
 520  *
 521  * As with GetNewOidWithIndex(), there is some theoretical risk of a race
 522  * condition, but it doesn't seem worth worrying about.
 523  *
 524  * Note: we don't support using this in bootstrap mode.  All relations
 525  * created by bootstrap have preassigned OIDs, so there's no need.
 526  */
 527 RelFileNumber
 528 GetNewRelFileNumber(Oid reltablespace, Relation pg_class, char relpersistence)
 529 {
 530         RelFileLocatorBackend rlocator;
 531         char       *rpath;
 532         bool            collides;
 533         ProcNumber      procNumber;
 534
 535         /*
 536          * If we ever get here during pg_upgrade, there's something wrong; all
 537          * relfilenumber assignments during a binary-upgrade run should be
 538          * determined by commands in the dump script.
 539          */
 540         Assert(!IsBinaryUpgrade);
 541
 542         switch (relpersistence)
 543         {
 544                 case RELPERSISTENCE_TEMP:
 545                         procNumber = ProcNumberForTempRelations();
 546                         break;
 547                 case RELPERSISTENCE_UNLOGGED:
 548                 case RELPERSISTENCE_PERMANENT:
 549                         procNumber = INVALID_PROC_NUMBER;
 550                         break;
 551                 default:
 552                         elog(ERROR, "invalid relpersistence: %c", relpersistence);
 553                         return InvalidRelFileNumber;    /* placate compiler */
 554         }
 555
 556         /* This logic should match RelationInitPhysicalAddr */
 557         rlocator.locator.spcOid = reltablespace ? reltablespace : MyDatabaseTableSpace;
 558         rlocator.locator.dbOid =
 559                 (rlocator.locator.spcOid == GLOBALTABLESPACE_OID) ?
 560                 InvalidOid : MyDatabaseId;
 561
 562         /*
 563          * The relpath will vary based on the backend number, so we must
 564          * initialize that properly here to make sure that any collisions based on
 565          * filename are properly detected.
 566          */
 567         rlocator.backend = procNumber;
 568
 569         do
 570         {
 571                 CHECK_FOR_INTERRUPTS();
 572
 573                 /* Generate the OID */
 574                 if (pg_class)
 575                         rlocator.locator.relNumber = GetNewOidWithIndex(pg_class, ClassOidIndexId,
 576                                                                                                                         Anum_pg_class_oid);
 577                 else
 578                         rlocator.locator.relNumber = GetNewObjectId();
 579
 580                 /* Check for existing file of same name */
 581                 rpath = relpath(rlocator, MAIN_FORKNUM);
 582
 583                 if (access(rpath, F_OK) == 0)
 584                 {
 585                         /* definite collision */
 586                         collides = true;
 587                 }
 588                 else
 589                 {
 590                         /*
 591                          * Here we have a little bit of a dilemma: if errno is something
 592                          * other than ENOENT, should we declare a collision and loop? In
 593                          * practice it seems best to go ahead regardless of the errno.  If
 594                          * there is a colliding file we will get an smgr failure when we
 595                          * attempt to create the new relation file.
 596                          */
 597                         collides = false;
 598                 }
 599
 600                 pfree(rpath);
 601         } while (collides);
 602
 603         return rlocator.locator.relNumber;
 604 }
 605
 606 /*
 607  * SQL callable interface for GetNewOidWithIndex().  Outside of initdb's
 608  * direct insertions into catalog tables, and recovering from corruption, this
 609  * should rarely be needed.
 610  *
 611  * Function is intentionally not documented in the user facing docs.
 612  */
 613 Datum
 614 pg_nextoid(PG_FUNCTION_ARGS)
 615 {
 616         Oid                     reloid = PG_GETARG_OID(0);
 617         Name            attname = PG_GETARG_NAME(1);
 618         Oid                     idxoid = PG_GETARG_OID(2);
 619         Relation        rel;
 620         Relation        idx;
 621         HeapTuple       atttuple;
 622         Form_pg_attribute attform;
 623         AttrNumber      attno;
 624         Oid                     newoid;
 625
 626         /*
 627          * As this function is not intended to be used during normal running, and
 628          * only supports system catalogs (which require superuser permissions to
 629          * modify), just checking for superuser ought to not obstruct valid
 630          * usecases.
 631          */
 632         if (!superuser())
 633                 ereport(ERROR,
 634                                 (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
 635                                  errmsg("must be superuser to call %s()",
 636                                                 "pg_nextoid")));
 637
 638         rel = table_open(reloid, RowExclusiveLock);
 639         idx = index_open(idxoid, RowExclusiveLock);
 640
 641         if (!IsSystemRelation(rel))
 642                 ereport(ERROR,
 643                                 (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
 644                                  errmsg("pg_nextoid() can only be used on system catalogs")));
 645
 646         if (idx->rd_index->indrelid != RelationGetRelid(rel))
 647                 ereport(ERROR,
 648                                 (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
 649                                  errmsg("index \"%s\" does not belong to table \"%s\"",
 650                                                 RelationGetRelationName(idx),
 651                                                 RelationGetRelationName(rel))));
 652
 653         atttuple = SearchSysCacheAttName(reloid, NameStr(*attname));
 654         if (!HeapTupleIsValid(atttuple))
 655                 ereport(ERROR,
 656                                 (errcode(ERRCODE_UNDEFINED_COLUMN),
 657                                  errmsg("column \"%s\" of relation \"%s\" does not exist",
 658                                                 NameStr(*attname), RelationGetRelationName(rel))));
 659
 660         attform = ((Form_pg_attribute) GETSTRUCT(atttuple));
 661         attno = attform->attnum;
 662
 663         if (attform->atttypid != OIDOID)
 664                 ereport(ERROR,
 665                                 (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
 666                                  errmsg("column \"%s\" is not of type oid",
 667                                                 NameStr(*attname))));
 668
 669         if (IndexRelationGetNumberOfKeyAttributes(idx) != 1 ||
 670                 idx->rd_index->indkey.values[0] != attno)
 671                 ereport(ERROR,
 672                                 (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
 673                                  errmsg("index \"%s\" is not the index for column \"%s\"",
 674                                                 RelationGetRelationName(idx),
 675                                                 NameStr(*attname))));
 676
 677         newoid = GetNewOidWithIndex(rel, idxoid, attno);
 678
 679         ReleaseSysCache(atttuple);
 680         table_close(rel, RowExclusiveLock);
 681         index_close(idx, RowExclusiveLock);
 682
 683         PG_RETURN_OID(newoid);
 684 }
 685
 686 /*
 687  * SQL callable interface for StopGeneratingPinnedObjectIds().
 688  *
 689  * This is only to be used by initdb, so it's intentionally not documented in
 690  * the user facing docs.
 691  */
 692 Datum
 693 pg_stop_making_pinned_objects(PG_FUNCTION_ARGS)
 694 {
 695         /*
 696          * Belt-and-suspenders check, since StopGeneratingPinnedObjectIds will
 697          * fail anyway in non-single-user mode.
 698          */
 699         if (!superuser())
 700                 ereport(ERROR,
 701                                 (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
 702                                  errmsg("must be superuser to call %s()",
 703                                                 "pg_stop_making_pinned_objects")));
 704
 705         StopGeneratingPinnedObjectIds();
 706
 707         PG_RETURN_VOID();
 708 }