From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
cc: exclusion@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17062: Assert failed in RemoveRoleFromObjectPolicy() on DROP
 OWNED policy applied to duplicate role
In-reply-to: <1067500.1623965562@sss.pgh.pa.us>
References: <17062-11f471ae3199ca23@postgresql.org>
 <1066940.1623964553@sss.pgh.pa.us> <1067500.1623965562@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Thu, 17 Jun 2021 17:32:42 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1068095.1623966678.1@sss.pgh.pa.us>
Date: Thu, 17 Jun 2021 17:51:18 -0400
Message-ID: <1068096.1623966678@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1068096.1623966678%40sss.pgh.pa.us>
Precedence: bulk

I wrote:
> So the proximate problem is RemoveRoleFromObjectPolicy's unfounded
> assumption that there are no duplicate OIDs in a pg_policy.polroles
> entry.  But that function has got some other serious problems too:

While I'm whining ... that function's permissions checks seem
completely out of line too.  How is it that, if I have the right
to drop some role, I lose that right if the role is mentioned in
a policy of some relation I don't own?  It feels like this function
was written by copy-and-pasting a whole bunch of irrelevant logic.

			regards, tom lane