pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Masahiko Sawada <sawada.mshk@gmail.com>
Cc: Bossart, Nathan <bossartn@amazon.com>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Neil Chen <carpenter.nail.cz@gmail.com>
Cc: Boris P. Korzun <drtr0jan@yandex.ru>
Cc: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: Re: Inconsistent behavior of pg_dump/pg_restore on DEFAULT PRIVILEGES
Date: Tue, 19 Oct 2021 15:53:54 -0400
Message-ID: <1951182.1634673234@sss.pgh.pa.us> (raw)
In-Reply-To: <CAD21AoC5qNd8psDS4x792DCeuC3xcBmq6Bjrkj8_P1sAscJz4Q@mail.gmail.com>
References: <CAA3qoJnr2+1dVJObNtfec=qW4Z0nz=A9+r5bZKoTSy5RDjskMw@mail.gmail.com>
	<8261632200581@mail.yandex.ru>
	<CAA3qoJ=f6jZAkkfwH+rtH_8C9z-nfcgNFYZnGYxVdBjz7Vkhig@mail.gmail.com>
	<CAD21AoBrCbjiJt3OCDQCLrM6OQOxjV9cAyM6bn4=SjHq0konBQ@mail.gmail.com>
	<CAD21AoC+m46JEsFE2d6JQuPuNN5ODj1vpZ3z2HtPdn+HFDJfdg@mail.gmail.com>
	<721942.1634180151@sss.pgh.pa.us>
	<CAD21AoAUCNCo77LJLAFGEkhtgruMpzPD153SC7dY7TyahvM_Fg@mail.gmail.com>
	<YWfh9O/36r+GlgNB@paquier.xyz>
	<CAD21AoDRg1E7AEM_5ifyjFbQ71J303OHA-R1HjzqC0FT306dKQ@mail.gmail.com>
	<AB89F451-ED7F-4FA6-ADF8-F8132220D6A2@amazon.com>
	<CAD21AoArNPsNKYE1b-oURYonUA7Zo-kaq-u661uWcZqTURb48A@mail.gmail.com>
	<1737876.1634613552@sss.pgh.pa.us>
	<CAD21AoC5qNd8psDS4x792DCeuC3xcBmq6Bjrkj8_P1sAscJz4Q@mail.gmail.com>

... BTW, I think this patch is not correct yet.  What I read in
catalogs.sgml is

   ... If a global entry is present then
   it <emphasis>overrides</emphasis> the normal hard-wired default privileges
   for the object type.  A per-schema entry, if present, represents privileges
   to be <emphasis>added to</emphasis> the global or hard-wired default privileges.

I didn't check the code, but if that last bit is correct, then non-global
entries aren't necessarily relative to the acldefault privileges either.

I kind of wonder now whether the existing behavior is correct for either
case.  Why aren't we simply regurgitating the pg_default_acl entries
verbatim?  That is, I think maybe we don't need the acldefault call at
all; we should just use null/empty as the starting ACL in all cases
when printing pg_default_acl entries.  Like this:

        buildACLQueries(acl_subquery, racl_subquery, initacl_subquery,
                        initracl_subquery, "defaclacl", "defaclrole",
                        "pip.initprivs",
-                       "CASE WHEN defaclobjtype = 'S' THEN 's' ELSE defaclobjtype END::\"char\"",
+                       "NULL",
                        dopt->binary_upgrade);

I didn't test that.  I suspect it will cause some regression test
changes, but will they be wrong?

			regards, tom lane





view thread (26+ messages)  latest in thread

Message-ID: <1951182.1634673234@sss.pgh.pa.us>
Permalink:  ../1951182.1634673234@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/1951182.1634673234@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, sawada.mshk@gmail.com, bossartn@amazon.com, michael@paquier.xyz, carpenter.nail.cz@gmail.com, drtr0jan@yandex.ru, pgsql-bugs@lists.postgresql.org
  Subject: Re: Inconsistent behavior of pg_dump/pg_restore on DEFAULT PRIVILEGES
  In-Reply-To: <1951182.1634673234@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox