From: Stephen Frost <sfrost@snowman.net>
To: Mats Kindahl <mats@timescale.com>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: Bug in handling default privileges inside extension update scripts
Date: Thu, 22 Apr 2021 11:15:09 -0400
Message-ID: <20210422151509.GU20766@tamriel.snowman.net> (raw)
In-Reply-To: <CA+144272PPX+y7L2V6DiYsv8pLhKrmpLmaZJnka2CKrXLnfY_A@mail.gmail.com>
References: <CA+144272PPX+y7L2V6DiYsv8pLhKrmpLmaZJnka2CKrXLnfY_A@mail.gmail.com>
Greetings,
* Mats Kindahl (mats@timescale.com) wrote:
> * To be able to read the configuration tables, "reader" need to have
> SELECT privileges.
>
> * Since the new role is added by the user and not by the extension,
> the grants have to be dumped as well. Otherwise, a restore of the
> data will have wrong privileges.
>
> * Since new configuration tables could be added by an update of the
> extension, it is necessary to make sure that these privileges are
> added to new tables when updating. Typically, this means changing
> the default privileges on the schema for the configuration files.
If the extension is updated, I think it's entirely reasonable to expect
an admin to have to go in and update the relevant permissions on any new
tables that have come into existance and, as I've said elsewhere, I
don't think that schema-level default privs should be applied to tables
created by extensions. Sadly, no one else seems to have an opinion
regarding that and so there hasn't been a change in that, yet, but
that's the source of the issue imv.
If you want to comment on that, I'd suggest doing so on that thread:
https://www.postgresql.org/message-id/20200205034454.GU3195@tamriel.snowman.net
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: sfrost@snowman.net, mats@timescale.com, pgsql-bugs@lists.postgresql.org
Subject: Re: Bug in handling default privileges inside extension update scripts
In-Reply-To: <20210422151509.GU20766@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox