Check criticalSharedRelcachesBuilt in GetSharedSecurityLabel().

An extension may want to call GetSecurityLabel() on a shared object
before the shared relcaches are fully initialized. For instance, a
ClientAuthentication_hook might want to retrieve the security label on
a role.

Discussion: https://postgr.es/m/ecb7af0b26e3be1d96d291c8453a86f1f82d9061[email protected]
Backpatch-through: 9.6

diff --git a/src/backend/commands/seclabel.c b/src/backend/commands/seclabel.c
index ddc019cb39a597b672d39dafa5f30f1814df0d2c..308e0adb553cc85141082577c9b9b5fee5e0e3ff 100644 (file)
--- a/src/backend/commands/seclabel.c
+++ b/src/backend/commands/seclabel.c
@@ -244,8 +244,8 @@ GetSharedSecurityLabel(const ObjectAddress *object, const char *provider)
 
        pg_shseclabel = table_open(SharedSecLabelRelationId, AccessShareLock);
 
-       scan = systable_beginscan(pg_shseclabel, SharedSecLabelObjectIndexId, true,
-                                                         NULL, 3, keys);
+       scan = systable_beginscan(pg_shseclabel, SharedSecLabelObjectIndexId,
+                                                         criticalSharedRelcachesBuilt, NULL, 3, keys);
 
        tuple = systable_getnext(scan);
        if (HeapTupleIsValid(tuple))