Merge pull request #92083 from rafiss/backport22.1-92075

fixes #89764
cockroachdb · Nov 18, 2022 · 2f305b3 · 2f305b3
2 parents be3cd3e + 719e6e8
commit 2f305b3
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 0 deletions.
diff --git a/pkg/sql/alter_default_privileges.go b/pkg/sql/alter_default_privileges.go
@@ -14,6 +14,7 @@ import (
 	"context"
 
 	"github.com/cockroachdb/cockroach/pkg/clusterversion"
+	"github.com/cockroachdb/cockroach/pkg/keys"
 	"github.com/cockroachdb/cockroach/pkg/security"
 	"github.com/cockroachdb/cockroach/pkg/sql/catalog/catpb"
 	"github.com/cockroachdb/cockroach/pkg/sql/catalog/catprivilege"
@@ -60,6 +61,9 @@ func (p *planner) alterDefaultPrivileges(
 	if err != nil {
 		return nil, err
 	}
+	if dbDesc.GetID() == keys.SystemDatabaseID {
+		return nil, pgerror.Newf(pgcode.InvalidParameterValue, "cannot alter system database")
+	}
 
 	objectType := n.Grant.Target
 	if !n.IsGrant {

diff --git a/pkg/sql/logictest/testdata/logic_test/alter_default_privileges_for_table b/pkg/sql/logictest/testdata/logic_test/alter_default_privileges_for_table
@@ -15,6 +15,16 @@ ALTER DEFAULT PRIVILEGES FOR ROLE testuser GRANT SELECT ON TABLES to testuser, w
 statement error pq: invalid privilege type USAGE for table
 ALTER DEFAULT PRIVILEGES GRANT USAGE ON TABLES to testuser
 
+# Should not be able to alter system database.
+statement ok
+USE system
+
+statement error cannot alter system database
+ALTER DEFAULT PRIVILEGES FOR ROLE testuser REVOKE ALL ON TABLES FROM testuser
+
+statement ok
+RESET database
+
 # For Tables.
 statement ok
 CREATE DATABASE d;