From: Tom Lane <tgl@sss.pgh.pa.us>
To: "Bossart, Nathan" <bossartn@amazon.com>
cc: Masahiko Sawada <sawada.mshk@gmail.com>,
        Michael Paquier <michael@paquier.xyz>,
        Neil Chen <carpenter.nail.cz@gmail.com>,
        "Boris P. Korzun" <drtr0jan@yandex.ru>,
        "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
Subject: Re: Inconsistent behavior of pg_dump/pg_restore on DEFAULT PRIVILEGES
In-reply-to: <2C411167-8492-497B-A110-81E7081B1B0E@amazon.com>
References: 
 <CAA3qoJnr2+1dVJObNtfec=qW4Z0nz=A9+r5bZKoTSy5RDjskMw@mail.gmail.com>
 <8261632200581@mail.yandex.ru>
 <CAA3qoJ=f6jZAkkfwH+rtH_8C9z-nfcgNFYZnGYxVdBjz7Vkhig@mail.gmail.com>
 <CAD21AoBrCbjiJt3OCDQCLrM6OQOxjV9cAyM6bn4=SjHq0konBQ@mail.gmail.com>
 <CAD21AoC+m46JEsFE2d6JQuPuNN5ODj1vpZ3z2HtPdn+HFDJfdg@mail.gmail.com>
 <721942.1634180151@sss.pgh.pa.us>
 <CAD21AoAUCNCo77LJLAFGEkhtgruMpzPD153SC7dY7TyahvM_Fg@mail.gmail.com>
 <YWfh9O/36r+GlgNB@paquier.xyz>
 <CAD21AoDRg1E7AEM_5ifyjFbQ71J303OHA-R1HjzqC0FT306dKQ@mail.gmail.com>
 <AB89F451-ED7F-4FA6-ADF8-F8132220D6A2@amazon.com>
 <CAD21AoArNPsNKYE1b-oURYonUA7Zo-kaq-u661uWcZqTURb48A@mail.gmail.com>
 <1737876.1634613552@sss.pgh.pa.us>
 <CAD21AoC5qNd8psDS4x792DCeuC3xcBmq6Bjrkj8_P1sAscJz4Q@mail.gmail.com>
 <1951182.1634673234@sss.pgh.pa.us>
 <2C411167-8492-497B-A110-81E7081B1B0E@amazon.com>
Comments: In-reply-to "Bossart, Nathan" <bossartn@amazon.com>
	message dated "Tue, 19 Oct 2021 21:01:13 -0000"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <2008943.1634680714.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 19 Oct 2021 17:58:34 -0400
Message-ID: <2008944.1634680714@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/2008944.1634680714%40sss.pgh.pa.us>
Precedence: bulk

"Bossart, Nathan" <bossartn@amazon.com> writes:
> On 10/19/21, 12:54 PM, "Tom Lane" <tgl@sss.pgh.pa.us> wrote:
>> I kind of wonder now whether the existing behavior is correct for eithe=
r
>> case.

> Hm.  If we do this, then this command:
>         ALTER DEFAULT PRIVILEGES FOR ROLE myrole REVOKE ALL ON FUNCTIONS=
 FROM PUBLIC;
> is dumped as:
>         ALTER DEFAULT PRIVILEGES FOR ROLE myrole GRANT ALL ON FUNCTIONS =
 TO myrole;

[ pokes at it some more... ]  Yeah, I just didn't have my head screwed
on straight.  We need the global entries to be dumped as deltas from
the proper object-type-specific ACL, while the non-global ones should be
dumped as grants only, which can be modeled as a delta from an empty
ACL.  So the patch should be good as given (though maybe the comment
needs more work to clarify this).  Sorry for the noise.

			regards, tom lane