From: Jerry Sievers <gsievers19@comcast.net>
To: "Fehrle\, Brian" <bfehrle@comscore.com>
Cc: "pgsql-admin\@postgresql.org" <pgsql-admin@postgresql.org>,
  "\@ DBA - West" <dba-west@comscore.com>
Subject: Re: Upgrading from 9.2 -> 9.6: ERROR with 'could not execute query:
 ERROR:  permission denied for type my_type_name'
References: 
 <CY4PR03MB2453210E3C1E15901F2F86FFCE390@CY4PR03MB2453.namprd03.prod.outlook.com>
Date: Fri, 01 Dec 2017 09:20:23 -0600
In-Reply-To: 
 <CY4PR03MB2453210E3C1E15901F2F86FFCE390@CY4PR03MB2453.namprd03.prod.outlook.com>
	(Brian Fehrle's message of "Fri, 1 Dec 2017 02:43:07 +0000")
Message-ID: <874lpamq4o.fsf@jsievers.enova.com>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

"Fehrle, Brian" <bfehrle@comscore.com> writes:

> Hi all,=20
>
>
> I'm upgrading a database from 9.2 to 9.6 and I'm running into an
> interesting error. I've upgraded dozens of very similar databases
> already in the same configuration, but each database has different
> schema definitions, and this is the first one with an error like this
> that we've seen.=20

Couple things...

I remember a vaguely similar issue we had also going up from some older
version such as 9.2 and it was due to IIRC a bad grantor aspect in the
ACL entry.

The fix was to manually update same in the related catalog entry (see
warning below).

Look further up in the SQL script pg_dump is trying to run to see just
what session auth is set to at the time of failure because is it about
certainly not postgres or any superuser else you would not get the
perm denied error.

I'd suggest you do this looking into the actual pg_dump result that came
from pg_upgrade since it runs pg_dump with an undocumented
--binary-upgrade option which changes a few things, in case this
matters.

!!Please do *not* perform the aforementioned catalog updates without
  verifying  that there is no other solution.

HTH

>
>
> The error for this one is here from upgrade log:
>
> pg_restore: [archiver (db)] Error while PROCESSING TOC:
> pg_restore: [archiver (db)] Error from TOC entry 214183; 0 0 ACL
> my_type_name some_user
> pg_restore: [archiver (db)] could not execute query: ERROR:=20
> permission denied for type my_type_name
>     Command was: REVOKE ALL ON TYPE "my_type_name" FROM PUBLIC;
> REVOKE ALL ON TYPE "my_type_name" FROM "some_user";
> SET SESSION AUTHORIZATION ...
>
>
> My upgrade command itself is pretty standard:
> /usr/pgsql-9.6/bin/pg_upgrade -k --old-bindir=3D/usr/pgsql-9.2/bin/
> --new-bindir=3D/usr/pgsql-9.6/bin/ --old-datadir=3D/mnt/db/data.old/
> --new-datadir=3D/mnt/db/data/
>
>
> I'm running the upgrade as the linux user 'postgres' as well, and
> verified with the -v (verbose) command that everything in the upgrade
> is running as the superuser 'postgres'. In wonder as to why I could
> be getting this error, I did a pg_dump -s (schema only) of the
> database to be upgraded, and here's the permission section for this
> type:
>
> REVOKE ALL ON TYPE my_type_name FROM PUBLIC;
> REVOKE ALL ON TYPE my_type_name FROM some_user;
> SET SESSION AUTHORIZATION some_other_user;
> GRANT ALL ON TYPE my_type_name TO PUBLIC;
> RESET SESSION AUTHORIZATION;
>
> And here is the \dT+ of the type:
>
> my_database=3D> \dT+ my_type_name
>                                            List of data types
>  Schema |     Name     | Internal name | Size  | Elements |   Owner=20
>   | Access privileges  | Description
> --------+--------------+---------------+-------+----------+------------+-=
-------------------+-------------
>  public | my_type_name | my_type_name  | tuple |          |
> some_user  | =3DU/some_other_user |
> (1 row)
>
>
>
> Using verbose output, the exact command that pg_restore is running
> is:
>
> "/usr/pgsql-9.6/bin/pg_restore" --host '/home/postgres' --port 50432
> --username 'postgres' --exit-on-error --verbose --dbname 'dbname=3D
> my_database' "pg_upgrade_dump_208717.custom" >>
> "pg_upgrade_dump_208717.log" 2>&1
>
>
>
> I've tried revoking all permissions from PUBLIC and all actual users
> associated with this type before upgrade, and no matter what, results
> in the same error. This is 100% reproducible.=20
>
>
>
> Anyone know of anything I may be missing? I don't see how the
> superuser 'postgres' has any permission denied issues.=20
>
>
> Extra Details:
>
> CentOS release 6.9 (Final)
>
> psql (PostgreSQL) 9.2.24 via PGDG RPM
> psql (PostgreSQL) 9.6.5 via PGDG RPM=20=20
>
>
> Brian  Fehrle  Database Administrator II  |  comScore, Inc.=20=20=20=20=
=20=20=20=20=20=20
> bfehrle@comscore.com=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20
> comscore.com=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20
> =E2=80=8B=E2=80=8B=E2=80=8BThis e-mail (including any attachments) may co=
ntain information=20=20=20
> that is private, confidential, or protected by attorney-client or=20=20=
=20=20
> other privilege. If you received this e-mail in error, please delete=20
> it from your system and notify sender.=20=20=20=20=20=20=20=20=20=20=20=
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
>=20=20
>
>

--=20
Jerry Sievers
Postgres DBA/Development Consulting
e: postgres.consulting@comcast.net
p: 312.241.7800