Restrict accesses to non-system views and foreign tables during pg_dump.

When pg_dump retrieves the list of database objects and performs the
data dump, there was possibility that objects are replaced with others
of the same name, such as views, and access them. This vulnerability
could result in code execution with superuser privileges during the
pg_dump process.

This issue can arise when dumping data of sequences, foreign
tables (only 13 or later), or tables registered with a WHERE clause in
the extension configuration table.

To address this, pg_dump now utilizes the newly introduced
restrict_nonsystem_relation_kind GUC parameter to restrict the
accesses to non-system views and foreign tables during the dump
process. This new GUC parameter is added to back branches too, but
these changes do not require cluster recreation.

Back-patch to all supported branches.

Reviewed-by: Noah Misch
Security: CVE-2024-7348
Backpatch-through: 12

diff --git a/contrib/postgres_fdw/expected/postgres_fdw.out b/contrib/postgres_fdw/expected/postgres_fdw.out
index 6efaad0c1b609097bd12ece017c4dbe7f7f55ed7..03bdc3a3aaf8973da7425aa526651fa3b1632016 100644 (file)
--- a/contrib/postgres_fdw/expected/postgres_fdw.out
+++ b/contrib/postgres_fdw/expected/postgres_fdw.out
@@ -637,6 +637,17 @@ EXPLAIN (VERBOSE, COSTS OFF) SELECT * FROM ft_empty ORDER BY c1;
    Remote SQL: SELECT c1, c2 FROM public.loct_empty ORDER BY c1 ASC NULLS LAST
 (3 rows)
 
+-- test restriction on non-system foreign tables.
+SET restrict_nonsystem_relation_kind TO 'foreign-table';
+SELECT * from ft1 where c1 < 1; -- ERROR
+ERROR:  access to non-system foreign table is restricted
+INSERT INTO ft1 (c1) VALUES (1); -- ERROR
+ERROR:  access to non-system foreign table is restricted
+DELETE FROM ft1 WHERE c1 = 1; -- ERROR
+ERROR:  access to non-system foreign table is restricted
+TRUNCATE ft1; -- ERROR
+ERROR:  access to non-system foreign table is restricted
+RESET restrict_nonsystem_relation_kind;
 -- ===================================================================
 -- WHERE with remotely-executable conditions
 -- ===================================================================

diff --git a/contrib/postgres_fdw/sql/postgres_fdw.sql b/contrib/postgres_fdw/sql/postgres_fdw.sql
index f518e5a67a8938acc10dccb2474b65b77fa678d2..0512c633931b5b0c5969120a819ab878c2cc4ecc 100644 (file)
--- a/contrib/postgres_fdw/sql/postgres_fdw.sql
+++ b/contrib/postgres_fdw/sql/postgres_fdw.sql
@@ -326,6 +326,14 @@ DELETE FROM loct_empty;
 ANALYZE ft_empty;
 EXPLAIN (VERBOSE, COSTS OFF) SELECT * FROM ft_empty ORDER BY c1;
 
+-- test restriction on non-system foreign tables.
+SET restrict_nonsystem_relation_kind TO 'foreign-table';
+SELECT * from ft1 where c1 < 1; -- ERROR
+INSERT INTO ft1 (c1) VALUES (1); -- ERROR
+DELETE FROM ft1 WHERE c1 = 1; -- ERROR
+TRUNCATE ft1; -- ERROR
+RESET restrict_nonsystem_relation_kind;
+
 -- ===================================================================
 -- WHERE with remotely-executable conditions
 -- ===================================================================

diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index c2538f3f8e4b4168a8328afa7f69e9b86559c6df..87d050d3fadee075907fdf0e3a27ac73dd50bc2d 100644 (file)
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -9385,6 +9385,23 @@ SET XML OPTION { DOCUMENT | CONTENT };
       </listitem>
      </varlistentry>
 
+     <varlistentry id="guc-restrict-nonsystem-relation-kind" xreflabel="restrict_nonsystem_relation_kind">
+      <term><varname>restrict_nonsystem_relation_kind</varname> (<type>string</type>)
+      <indexterm>
+       <primary><varname>restrict_nonsystem_relation_kind</varname></primary>
+       <secondary>configuration parameter</secondary>
+     </indexterm>
+     </term>
+     <listitem>
+      <para>
+       This variable specifies relation kind to which access is restricted.
+       It contains a comma-separated list of relation kind.  Currently, the
+       supported relation kinds are <literal>view</literal> and
+       <literal>foreign-table</literal>.
+      </para>
+     </listitem>
+     </varlistentry>
+
      </variablelist>
     </sect2>
      <sect2 id="runtime-config-client-format">

diff --git a/doc/src/sgml/ref/pg_dump.sgml b/doc/src/sgml/ref/pg_dump.sgml
index c19e0b65bebee50e498cf17b81f3bab5de52ec72..574e35310fd8556b247f8beb4f5dc3da2aaf51d1 100644 (file)
--- a/doc/src/sgml/ref/pg_dump.sgml
+++ b/doc/src/sgml/ref/pg_dump.sgml
@@ -812,6 +812,14 @@ PostgreSQL documentation
         The only exception is that an empty pattern is disallowed.
        </para>
 
+       <note>
+        <para>
+         Using wildcards in <option>--include-foreign-data</option> may result
+         in access to unexpected foreign servers. Also, to use this option securely,
+         make sure that the named server must have a trusted owner.
+        </para>
+       </note>
+
        <note>
         <para>
          When <option>--include-foreign-data</option> is specified,

diff --git a/src/backend/foreign/foreign.c b/src/backend/foreign/foreign.c
index e60394c7f90901c94caa11b281be8db7feaabbdd..9875547a31a70b67fd0bb2c85c1ecabeffe28941 100644 (file)
--- a/src/backend/foreign/foreign.c
+++ b/src/backend/foreign/foreign.c
@@ -23,6 +23,7 @@
 #include "funcapi.h"
 #include "lib/stringinfo.h"
 #include "miscadmin.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/memutils.h"
 #include "utils/rel.h"
@@ -322,6 +323,15 @@ GetFdwRoutine(Oid fdwhandler)
        Datum           datum;
        FdwRoutine *routine;
 
+       /* Check if the access to foreign tables is restricted */
+       if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+       {
+               /* there must not be built-in FDW handler  */
+               ereport(ERROR,
+                               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                                errmsg("access to non-system foreign table is restricted")));
+       }
+
        datum = OidFunctionCall0(fdwhandler);
        routine = (FdwRoutine *) DatumGetPointer(datum);
 

diff --git a/src/backend/optimizer/plan/createplan.c b/src/backend/optimizer/plan/createplan.c
index 1bc59c94578fc9ef4df7c4d2ecd012ca5ef6e60a..f91562cbea342bc0dc16604f1fb279c1589fd702 100644 (file)
--- a/src/backend/optimizer/plan/createplan.c
+++ b/src/backend/optimizer/plan/createplan.c
@@ -40,6 +40,7 @@
 #include "parser/parse_clause.h"
 #include "parser/parsetree.h"
 #include "partitioning/partprune.h"
+#include "tcop/tcopprot.h"
 #include "utils/lsyscache.h"
 
 
@@ -7111,7 +7112,19 @@ make_modifytable(PlannerInfo *root, Plan *subplan,
                        Assert(rte->rtekind == RTE_RELATION);
                        Assert(operation != CMD_MERGE);
                        if (rte->relkind == RELKIND_FOREIGN_TABLE)
+                       {
+                               /* Check if the access to foreign tables is restricted */
+                               if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+                               {
+                                       /* there must not be built-in foreign tables */
+                                       Assert(rte->relid >= FirstNormalObjectId);
+                                       ereport(ERROR,
+                                                       (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                                                        errmsg("access to non-system foreign table is restricted")));
+                               }
+
                                fdwroutine = GetFdwRoutineByRelId(rte->relid);
+                       }
                        else
                                fdwroutine = NULL;
                }

diff --git a/src/backend/optimizer/util/plancat.c b/src/backend/optimizer/util/plancat.c
index 4b4d3c3e074a7035f7c5437b3d90f308b45e0860..7d2f403212f4d24f36a543756ea03365df9f6d8b 100644 (file)
--- a/src/backend/optimizer/util/plancat.c
+++ b/src/backend/optimizer/util/plancat.c
@@ -47,6 +47,7 @@
 #include "rewrite/rewriteManip.h"
 #include "statistics/statistics.h"
 #include "storage/bufmgr.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/lsyscache.h"
 #include "utils/partcache.h"
@@ -465,6 +466,17 @@ get_relation_info(PlannerInfo *root, Oid relationObjectId, bool inhparent,
        /* Grab foreign-table info using the relcache, while we have it */
        if (relation->rd_rel->relkind == RELKIND_FOREIGN_TABLE)
        {
+               /* Check if the access to foreign tables is restricted */
+               if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_FOREIGN_TABLE) != 0))
+               {
+                       /* there must not be built-in foreign tables */
+                       Assert(RelationGetRelid(relation) >= FirstNormalObjectId);
+
+                       ereport(ERROR,
+                                       (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                                        errmsg("access to non-system foreign table is restricted")));
+               }
+
                rel->serverid = GetForeignServerIdByRelId(RelationGetRelid(relation));
                rel->fdwroutine = GetFdwRoutineForRelation(relation, true);
        }

diff --git a/src/backend/rewrite/rewriteHandler.c b/src/backend/rewrite/rewriteHandler.c
index a7722f96036b49b4694302ec539d57637bb1ff16..7c715258be300039ad76aa99eaebf1e1219daac6 100644 (file)
--- a/src/backend/rewrite/rewriteHandler.c
+++ b/src/backend/rewrite/rewriteHandler.c
@@ -41,6 +41,7 @@
 #include "rewrite/rewriteManip.h"
 #include "rewrite/rewriteSearchCycle.h"
 #include "rewrite/rowsecurity.h"
+#include "tcop/tcopprot.h"
 #include "utils/builtins.h"
 #include "utils/lsyscache.h"
 #include "utils/rel.h"
@@ -1734,6 +1735,14 @@ ApplyRetrieveRule(Query *parsetree,
        if (rule->qual != NULL)
                elog(ERROR, "cannot handle qualified ON SELECT rule");
 
+       /* Check if the expansion of non-system views are restricted */
+       if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_VIEW) != 0 &&
+                                RelationGetRelid(relation) >= FirstNormalObjectId))
+               ereport(ERROR,
+                               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                                errmsg("access to non-system view \"%s\" is restricted",
+                                               RelationGetRelationName(relation))));
+
        if (rt_index == parsetree->resultRelation)
        {
                /*
@@ -3128,6 +3137,14 @@ rewriteTargetView(Query *parsetree, Relation view)
                }
        }
 
+       /* Check if the expansion of non-system views are restricted */
+       if (unlikely((restrict_nonsystem_relation_kind & RESTRICT_RELKIND_VIEW) != 0 &&
+                                RelationGetRelid(view) >= FirstNormalObjectId))
+               ereport(ERROR,
+                               (errcode(ERRCODE_OBJECT_NOT_IN_PREREQUISITE_STATE),
+                                errmsg("access to non-system view \"%s\" is restricted",
+                                               RelationGetRelationName(view))));
+
        /*
         * For INSERT/UPDATE the modified columns must all be updatable.
         */

diff --git a/src/backend/tcop/postgres.c b/src/backend/tcop/postgres.c
index 66294ab4c8b14b05d22518588de628dc70a5f923..d3aba33043cb5b11fc2955c670f9238ce1cb7827 100644 (file)
--- a/src/backend/tcop/postgres.c
+++ b/src/backend/tcop/postgres.c
@@ -81,6 +81,7 @@
 #include "utils/snapmgr.h"
 #include "utils/timeout.h"
 #include "utils/timestamp.h"
+#include "utils/varlena.h"
 
 /* ----------------
  *             global variables
@@ -105,6 +106,9 @@ int                 PostAuthDelay = 0;
 /* Time between checks that the client is still connected. */
 int                    client_connection_check_interval = 0;
 
+/* flags for non-system relation kinds to restrict use */
+int                    restrict_nonsystem_relation_kind;
+
 /* ----------------
  *             private typedefs etc
  * ----------------
@@ -3601,6 +3605,66 @@ assign_max_stack_depth(int newval, void *extra)
        max_stack_depth_bytes = newval_bytes;
 }
 
+/*
+ * GUC check_hook for restrict_nonsystem_relation_kind
+ */
+bool
+check_restrict_nonsystem_relation_kind(char **newval, void **extra, GucSource source)
+{
+       char       *rawstring;
+       List       *elemlist;
+       ListCell   *l;
+       int                     flags = 0;
+
+       /* Need a modifiable copy of string */
+       rawstring = pstrdup(*newval);
+
+       if (!SplitIdentifierString(rawstring, ',', &elemlist))
+       {
+               /* syntax error in list */
+               GUC_check_errdetail("List syntax is invalid.");
+               pfree(rawstring);
+               list_free(elemlist);
+               return false;
+       }
+
+       foreach(l, elemlist)
+       {
+               char       *tok = (char *) lfirst(l);
+
+               if (pg_strcasecmp(tok, "view") == 0)
+                       flags |= RESTRICT_RELKIND_VIEW;
+               else if (pg_strcasecmp(tok, "foreign-table") == 0)
+                       flags |= RESTRICT_RELKIND_FOREIGN_TABLE;
+               else
+               {
+                       GUC_check_errdetail("Unrecognized key word: \"%s\".", tok);
+                       pfree(rawstring);
+                       list_free(elemlist);
+                       return false;
+               }
+       }
+
+       pfree(rawstring);
+       list_free(elemlist);
+
+       /* Save the flags in *extra, for use by the assign function */
+       *extra = malloc(sizeof(int));
+       *((int *) *extra) = flags;
+
+       return true;
+}
+
+/*
+ * GUC assign_hook for restrict_nonsystem_relation_kind
+ */
+void
+assign_restrict_nonsystem_relation_kind(const char *newval, void *extra)
+{
+       int                *flags = (int *) extra;
+
+       restrict_nonsystem_relation_kind = *flags;
+}
 
 /*
  * set_debug_options --- apply "-d N" command line option

diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 949f985a06fd066d143ed987e316801384c70a02..acbcb8bb81b0e1cba71945041ed1cb61edbbce1e 100644 (file)
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -716,6 +716,7 @@ static char *recovery_target_string;
 static char *recovery_target_xid_string;
 static char *recovery_target_name_string;
 static char *recovery_target_lsn_string;
+static char *restrict_nonsystem_relation_kind_string;
 
 
 /* should be static, but commands/variable.c needs to get at this */
@@ -4711,6 +4712,17 @@ static struct config_string ConfigureNamesString[] =
                check_backtrace_functions, assign_backtrace_functions, NULL
        },
 
+       {
+               {"restrict_nonsystem_relation_kind", PGC_USERSET, CLIENT_CONN_STATEMENT,
+                       gettext_noop("Sets relation kinds of non-system relation to restrict use"),
+                       NULL,
+                       GUC_LIST_INPUT | GUC_NOT_IN_SAMPLE
+               },
+               &restrict_nonsystem_relation_kind_string,
+               "",
+               check_restrict_nonsystem_relation_kind, assign_restrict_nonsystem_relation_kind, NULL
+       },
+
        /* End-of-list marker */
        {
                {NULL, 0, 0, NULL, NULL}, NULL, NULL, NULL, NULL, NULL

diff --git a/src/bin/pg_dump/pg_dump.c b/src/bin/pg_dump/pg_dump.c
index 4ac992f7dbd7b0be24a278bcaf716a69cb1905ee..ca86ae705fd04bf563dc4cb2a50efbf1d7822399 100644 (file)
--- a/src/bin/pg_dump/pg_dump.c
+++ b/src/bin/pg_dump/pg_dump.c
@@ -316,6 +316,7 @@ static void appendReloptionsArrayAH(PQExpBuffer buffer, const char *reloptions,
                                                                        const char *prefix, Archive *fout);
 static char *get_synchronized_snapshot(Archive *fout);
 static void setupDumpWorker(Archive *AHX);
+static void set_restrict_relation_kind(Archive *AH, const char *value);
 static TableInfo *getRootTableInfo(const TableInfo *tbinfo);
 static bool forcePartitionRootLoad(const TableInfo *tbinfo);
 
@@ -1175,6 +1176,13 @@ setup_connection(Archive *AH, const char *dumpencoding,
                        ExecuteSqlStatement(AH, "SET row_security = off");
        }
 
+       /*
+        * For security reasons, we restrict the expansion of non-system views and
+        * access to foreign tables during the pg_dump process. This restriction
+        * is adjusted when dumping foreign table data.
+        */
+       set_restrict_relation_kind(AH, "view, foreign-table");
+
        /*
         * Initialize prepared-query state to "nothing prepared".  We do this here
         * so that a parallel dump worker will have its own state.
@@ -2018,6 +2026,10 @@ dumpTableData_copy(Archive *fout, const void *dcontext)
         */
        if (tdinfo->filtercond || tbinfo->relkind == RELKIND_FOREIGN_TABLE)
        {
+               /* Temporary allows to access to foreign tables to dump data */
+               if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+                       set_restrict_relation_kind(fout, "view");
+
                appendPQExpBufferStr(q, "COPY (SELECT ");
                /* klugery to get rid of parens in column list */
                if (strlen(column_list) > 2)
@@ -2129,6 +2141,11 @@ dumpTableData_copy(Archive *fout, const void *dcontext)
                                           classname);
 
        destroyPQExpBuffer(q);
+
+       /* Revert back the setting */
+       if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+               set_restrict_relation_kind(fout, "view, foreign-table");
+
        return 1;
 }
 
@@ -2155,6 +2172,10 @@ dumpTableData_insert(Archive *fout, const void *dcontext)
        int                     rows_per_statement = dopt->dump_inserts;
        int                     rows_this_statement = 0;
 
+       /* Temporary allows to access to foreign tables to dump data */
+       if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+               set_restrict_relation_kind(fout, "view");
+
        /*
         * If we're going to emit INSERTs with column names, the most efficient
         * way to deal with generated columns is to exclude them entirely.  For
@@ -2394,6 +2415,10 @@ dumpTableData_insert(Archive *fout, const void *dcontext)
                destroyPQExpBuffer(insertStmt);
        free(attgenerated);
 
+       /* Revert back the setting */
+       if (tbinfo->relkind == RELKIND_FOREIGN_TABLE)
+               set_restrict_relation_kind(fout, "view, foreign-table");
+
        return 1;
 }
 
@@ -4479,6 +4504,28 @@ is_superuser(Archive *fout)
        return false;
 }
 
+/*
+ * Set the given value to restrict_nonsystem_relation_kind value. Since
+ * restrict_nonsystem_relation_kind is introduced in minor version releases,
+ * the setting query is effective only where available.
+ */
+static void
+set_restrict_relation_kind(Archive *AH, const char *value)
+{
+       PQExpBuffer query = createPQExpBuffer();
+       PGresult   *res;
+
+       appendPQExpBuffer(query,
+                                         "SELECT set_config(name, '%s', false) "
+                                         "FROM pg_settings "
+                                         "WHERE name = 'restrict_nonsystem_relation_kind'",
+                                         value);
+       res = ExecuteSqlQuery(AH, query->data, PGRES_TUPLES_OK);
+
+       PQclear(res);
+       destroyPQExpBuffer(query);
+}
+
 /*
  * getSubscriptions
  *       get information about subscriptions

diff --git a/src/include/tcop/tcopprot.h b/src/include/tcop/tcopprot.h
index 70d9dab25b8d2144527584f7974a452f7c78fda1..d7d307bbfab4e48eb35d48b1c2924497b56a8f42 100644 (file)
--- a/src/include/tcop/tcopprot.h
+++ b/src/include/tcop/tcopprot.h
@@ -43,6 +43,12 @@ typedef enum
 
 extern PGDLLIMPORT int log_statement;
 
+/* Flags for restrict_nonsystem_relation_kind value */
+#define RESTRICT_RELKIND_VIEW                  0x01
+#define RESTRICT_RELKIND_FOREIGN_TABLE 0x02
+
+extern PGDLLIMPORT int restrict_nonsystem_relation_kind;
+
 extern List *pg_parse_query(const char *query_string);
 extern List *pg_rewrite_query(Query *query);
 extern List *pg_analyze_and_rewrite_fixedparams(RawStmt *parsetree,
@@ -68,6 +74,9 @@ extern List *pg_plan_queries(List *querytrees, const char *query_string,
 
 extern bool check_max_stack_depth(int *newval, void **extra, GucSource source);
 extern void assign_max_stack_depth(int newval, void *extra);
+extern bool check_restrict_nonsystem_relation_kind(char **newval, void **extra,
+                                                                                                  GucSource source);
+extern void assign_restrict_nonsystem_relation_kind(const char *newval, void *extra);
 
 extern void die(SIGNAL_ARGS);
 extern void quickdie(SIGNAL_ARGS) pg_attribute_noreturn();

diff --git a/src/test/regress/expected/create_view.out b/src/test/regress/expected/create_view.out
index 63c3c2aa9af7b7b7a1fba1f5ee5c6c23928b8144..4fc636c85fc21ab9223763e3830813a87ca457d3 100644 (file)
--- a/src/test/regress/expected/create_view.out
+++ b/src/test/regress/expected/create_view.out
@@ -2145,6 +2145,21 @@ CREATE RULE "_RETURN" AS ON SELECT TO tt28 DO INSTEAD SELECT * FROM tt26;
 CREATE RULE "_RETURN" AS ON SELECT TO tt28 DO INSTEAD SELECT * FROM tt26;
 ERROR:  "tt28" is already a view
 ROLLBACK;
+-- test restriction on non-system view expansion.
+create table tt27v_tbl (a int);
+create view tt27v as select a from tt27v_tbl;
+set restrict_nonsystem_relation_kind to 'view';
+select a from tt27v where a > 0; -- Error
+ERROR:  access to non-system view "tt27v" is restricted
+insert into tt27v values (1); -- Error
+ERROR:  access to non-system view "tt27v" is restricted
+select viewname from pg_views where viewname = 'tt27v'; -- Ok to access a system view.
+ viewname 
+----------
+ tt27v
+(1 row)
+
+reset restrict_nonsystem_relation_kind;
 -- clean up all the random objects we made above
 DROP SCHEMA temp_view_test CASCADE;
 NOTICE:  drop cascades to 27 other objects
@@ -2176,7 +2191,7 @@ drop cascades to view aliased_view_2
 drop cascades to view aliased_view_3
 drop cascades to view aliased_view_4
 DROP SCHEMA testviewschm2 CASCADE;
-NOTICE:  drop cascades to 78 other objects
+NOTICE:  drop cascades to 80 other objects
 DETAIL:  drop cascades to table t1
 drop cascades to view temporal1
 drop cascades to view temporal2
@@ -2255,3 +2270,5 @@ drop cascades to view tt24v
 drop cascades to view tt25v
 drop cascades to view tt26v
 drop cascades to table tt26
+drop cascades to table tt27v_tbl
+drop cascades to view tt27v

diff --git a/src/test/regress/sql/create_view.sql b/src/test/regress/sql/create_view.sql
index ee28d4502d4a504c8ce82442b3d85e0c615a40e1..d57219516e926c1d87fc96fd87e725858148dbbe 100644 (file)
--- a/src/test/regress/sql/create_view.sql
+++ b/src/test/regress/sql/create_view.sql
@@ -803,6 +803,14 @@ CREATE RULE "_RETURN" AS ON SELECT TO tt28 DO INSTEAD SELECT * FROM tt26;
 CREATE RULE "_RETURN" AS ON SELECT TO tt28 DO INSTEAD SELECT * FROM tt26;
 ROLLBACK;
 
+-- test restriction on non-system view expansion.
+create table tt27v_tbl (a int);
+create view tt27v as select a from tt27v_tbl;
+set restrict_nonsystem_relation_kind to 'view';
+select a from tt27v where a > 0; -- Error
+insert into tt27v values (1); -- Error
+select viewname from pg_views where viewname = 'tt27v'; -- Ok to access a system view.
+reset restrict_nonsystem_relation_kind;
 
 -- clean up all the random objects we made above
 DROP SCHEMA temp_view_test CASCADE;