From: Tom Lane <tgl@sss.pgh.pa.us>
To: Alvaro Herrera <alvherre@alvh.no-ip.org>
cc: Stephen Frost <sfrost@snowman.net>, Michael Paquier <michael@paquier.xyz>,
        exclusion@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17062: Assert failed in RemoveRoleFromObjectPolicy() on DROP
 OWNED policy applied to duplicate role
In-reply-to: <202106181925.x6ka3pktyblk@alvherre.pgsql>
References: <202106181925.x6ka3pktyblk@alvherre.pgsql>
Comments: In-reply-to Alvaro Herrera <alvherre@alvh.no-ip.org>
	message dated "Fri, 18 Jun 2021 15:25:55 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1285333.1624046402.1@sss.pgh.pa.us>
Date: Fri, 18 Jun 2021 16:00:02 -0400
Message-ID: <1285334.1624046402@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1285334.1624046402%40sss.pgh.pa.us>
Precedence: bulk

Alvaro Herrera <alvherre@alvh.no-ip.org> writes:
> Could you just set the policy to be granted to "only the bootstrap
> superuser" in that case?  I mean as an implementation path for back
> branches; use NONE going forward.  That would make the policy allow
> nobody who can't already access the record, instead of falling back to
> PUBLIC -- which I agree seems suboptimal security-wise.

That doesn't seem like a great solution --- it would produce very
confusing output from pg_dump for instance.  In fact, I think it
breaks pg_dump for cases where the target DB has a different
bootstrap superuser name.

			regards, tom lane