Date: Fri, 27 May 2022 21:51:22 -0700
From: Noah Misch <noah@leadboat.com>
To: pgsql-bugs@lists.postgresql.org
Cc: =?iso-8859-1?Q?F=E4rber=2C_Franz-Josef_=28StMUK=29?=
 <Franz-Josef.Faerber@stmuk.bayern.de>,
	Tom Lane <tgl@sss.pgh.pa.us>
Subject: Re: Extension pg_trgm, permissions and pg_dump order
Message-ID: <20220528045122.GA3228881@rfd.leadboat.com>
References: <f8a4105f076544c180a87ef0c4822352@stmuk.bayern.de>
 <1961551.1653498155@sss.pgh.pa.us>
 <20220526055047.GA3153526@rfd.leadboat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20220526055047.GA3153526@rfd.leadboat.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Archived-At: 
 <https://www.postgresql.org/message-id/20220528045122.GA3228881%40rfd.leadboat.com>
Precedence: bulk

On Wed, May 25, 2022 at 10:50:47PM -0700, Noah Misch wrote:
> BEGIN;
> CREATE ROLE limitedrole;
> CREATE SCHEMA ext_trgm;
> CREATE EXTENSION pg_trgm SCHEMA ext_trgm;
> CREATE TABLE x(y text);
> ALTER TABLE x OWNER TO limitedrole;
> CREATE INDEX ON x USING gist(y ext_trgm.gist_trgm_ops);
> ROLLBACK;

> Not too simple, no.  The parts of DefineIndex() that execute user code
> (e.g. DefineIndex->ComputeIndexAttrs->CheckMutability) are interspersed with
> the parts that do permissions checks, like the one yielding $SUBJECT at
> DefineIndex->ComputeIndexAttrs->ResolveOpClass->LookupExplicitNamespace.  My
> first candidate is to undo the userid switch before the ResolveOpClass() call
> and restore it after.  My second candidate is to pass down the userid we want
> used for this sort of permissions check.  Depending on the full list of call
> stacks reaching permissions checks, this could get hairy.

While I'd value the opportunity to work on this, there only a 50% chance I
could get it done by 2022-08-01.  I've set aside four hours on 2022-06-12 to
see how far I get.  For a 95% chance, the date would be 2023-02-01.  (I've
already canceled a 2022-07 vacation for the thing taking my time instead;
there's nothing clearly left to cut.)  If anyone would like it done faster
than that, I welcome that person taking over.