pg.ddx.io  pgsql-bugs@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Alexander Kukushkin <cyberdemn@gmail.com>
Cc: Kirill Reshke <reshkekirill@gmail.com>
Cc: pgsql-bugs@postgresql.org
Subject: Re: Superuser can't revoke role granted by non-superuser
Date: Mon, 27 Jan 2025 09:43:13 -0500
Message-ID: <391919.1737988993@sss.pgh.pa.us> (raw)
In-Reply-To: <CAFh8B=k0dciS9gQjF=KANv5REwe+8XqKLyUTuWfMP7DY8xsJVg@mail.gmail.com>
References: <CAFh8B=nCyWbxgD9uF5x7NV8y8PGvH_1t6wAfNQkjRnzEhN7OGA@mail.gmail.com>
	<CALdSSPjrXoUM3VJ-o_H6NEhGXvqDR3jf8VohpMxy1J2hfYDo1w@mail.gmail.com>
	<CAFh8B==5bnZ9eT8fRt0onuh4Qag2OSXUGqv3Vx9JASw5=Zw4Eg@mail.gmail.com>
	<CALdSSPjgndoLCWv0K0qYnjF4s_isODSJ7BTQjSb9DNZMZ-rbcg@mail.gmail.com>
	<CAFh8B=k0dciS9gQjF=KANv5REwe+8XqKLyUTuWfMP7DY8xsJVg@mail.gmail.com>

Alexander Kukushkin <cyberdemn@gmail.com> writes:
> E.g. superuser is supposed to use "revoke bb from aa granted by b"

Exactly.  This is not a bug, you just did not correctly name the
privilege you're trying to revoke.

If memory serves, the default behavior for a superuser is that
we'll revoke the privilege as granted by the object owner, since
that's the most common case.  For everyone else, the default
assumption about "granted by" is "yourself".  Some edge cases
about this might have changed in v16, not sure.

			regards, tom lane





view thread (6+ messages)

Message-ID: <391919.1737988993@sss.pgh.pa.us>
Permalink:  ../391919.1737988993@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/391919.1737988993@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-bugs@postgresql.org
  Cc: tgl@sss.pgh.pa.us, cyberdemn@gmail.com, reshkekirill@gmail.com
  Subject: Re: Superuser can't revoke role granted by non-superuser
  In-Reply-To: <391919.1737988993@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox