Subject: Re: User with BYPASSRLS privilege can't change password
To: Tom Lane <tgl@sss.pgh.pa.us>, Stephen Frost <sfrost@snowman.net>
Cc: pgsql-bugs@lists.postgresql.org
References: <a5548a9f-89ee-3167-129d-162b5985fcf8@technowledgy.de>
 <923005.1604420579@sss.pgh.pa.us> <956994.1604425451@sss.pgh.pa.us>
From: Wolfgang Walther <walther@technowledgy.de>
Message-ID: <3e771893-1ed1-97e7-6c4a-7b0d00992103@technowledgy.de>
Date: Tue, 3 Nov 2020 19:05:32 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.12.1
MIME-Version: 1.0
In-Reply-To: <956994.1604425451@sss.pgh.pa.us>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

Tom Lane:
> It's a little more subtle than that, but not much.  Commit 491c029db
> copied-and-pasted the logic used to deny non-superusers the privilege
> to change anything about a superuser role.  That was certainly not the
> intention, because the error message was phrased differently from the
> superuser case, but that was the effect.  I propose the attached.

Wouldn't the following change allow a non-superuser with createrole 
privilege to grant the replication privilege to a role that does not 
have that privilege, yet? This should still be forbidden, I think.

@@ -739,7 +741,6 @@ AlterRole(AlterRoleStmt *stmt)
  			  createrole < 0 &&
  			  createdb < 0 &&
  			  canlogin < 0 &&
-			  isreplication < 0 &&
  			  !dconnlimit &&
  			  !rolemembers &&
  			  !validUntil &&

This is because the "must be superuser to alter replication users" 
condition only triggers when the altered role already has isrepliaction, 
so isreplication could very well be >= 0 here.

The other change looks good.

Best

Wolfgang