pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedBUG #18639: Unexpected behavior with SET ROLE and CREATE ROLE interaction
2+ messages / 2 participants
[nested] [flat]
* BUG #18639: Unexpected behavior with SET ROLE and CREATE ROLE interaction
@ 2024-09-27 23:33 PG Bug reporting form <noreply@postgresql.org>
2024-09-28 13:43 ` Re: BUG #18639: Unexpected behavior with SET ROLE and CREATE ROLE interaction David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 1 reply; 2+ messages in thread
From: PG Bug reporting form @ 2024-09-27 23:33 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org; +Cc: snaperling@gmail.com
The following bug has been logged on the website:
Bug reference: 18639
Logged by: Luis Couto
Email address: snaperling@gmail.com
PostgreSQL version: 16.4
Operating system: Windows Any
Description:
I've observed an unexpected behavior when using SET ROLE in combination with
CREATE ROLE in PostgreSQL. I'd like to confirm if this is intended behavior
or if it's an undocumented side effect.
The scenario:
1. User A sets their role to Role B using SET ROLE.
2. While acting as Role B, User A creates a new Role C using CREATE ROLE.
3. Unexpectedly, Role B becomes a member of the newly created Role C.
Example:
SET ROLE admin_role;
CREATE ROLE new_user WITH PASSWORD 'password';
In this case, admin_role becomes a member of new_user.
This automatic membership assignment seems to prevent adding new_user to the
admin_role group later on.
Questions:
1. Is this behavior intentional or documented anywhere?
2. If intentional, what's the rationale behind this automatic membership
assignment?
3. Are there any recommended best practices to avoid this when creating
roles?
I couldn't find any documentation explicitly mentioning this behavior, so
I'd appreciate any insights or clarification on this matter.
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: BUG #18639: Unexpected behavior with SET ROLE and CREATE ROLE interaction
2024-09-27 23:33 BUG #18639: Unexpected behavior with SET ROLE and CREATE ROLE interaction PG Bug reporting form <noreply@postgresql.org>
@ 2024-09-28 13:43 ` David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 0 replies; 2+ messages in thread
From: David G. Johnston @ 2024-09-28 13:43 UTC (permalink / raw)
To: snaperling@gmail.com <snaperling@gmail.com>; pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
On Friday, September 27, 2024, PG Bug reporting form <noreply@postgresql.org>
wrote:
> The following bug has been logged on the website:
>
> Bug reference: 18639
> Logged by: Luis Couto
> Email address: snaperling@gmail.com
> PostgreSQL version: 16.4
> Operating system: Windows Any
> Description:
>
> I've observed an unexpected behavior when using SET ROLE in combination
> with
> CREATE ROLE in PostgreSQL. I'd like to confirm if this is intended behavior
> or if it's an undocumented side effect.
>
> Yes, this was part of making the usage of the create role attribute more
secure.
See related discussion here:
https://www.postgresql.org/message-id/flat/CAFCRh-_ZVP4emEKSGYJoM2hP657z1ZTq%3DUVkb7xZCYdByawFKQ%40m...
David J.
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2024-09-28 13:43 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2024-09-27 23:33 BUG #18639: Unexpected behavior with SET ROLE and CREATE ROLE interaction PG Bug reporting form <noreply@postgresql.org>
2024-09-28 13:43 ` David G. Johnston <david.g.johnston@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox