From: Tom Lane <tgl@sss.pgh.pa.us>
To: "David G. Johnston" <david.g.johnston@gmail.com>
cc: khp@equatoria.us,
        PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
Subject: Re: BUG #17511: Inconsistent permissions on some information_schema
 tables
In-reply-to: 
 <CAKFQuwY=7GALr6LJqT3U2uhSf1p_49dc2dyQmMgkXv1s-xM+0g@mail.gmail.com>
References: <17511-ee45925b30436a87@postgresql.org>
 <CAKFQuwY=7GALr6LJqT3U2uhSf1p_49dc2dyQmMgkXv1s-xM+0g@mail.gmail.com>
Comments: In-reply-to "David G. Johnston" <david.g.johnston@gmail.com>
	message dated "Mon, 06 Jun 2022 12:59:32 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <953809.1654550302.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 06 Jun 2022 17:18:22 -0400
Message-ID: <953810.1654550302@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/953810.1654550302%40sss.pgh.pa.us>
Precedence: bulk

"David G. Johnston" <david.g.johnston@gmail.com> writes:
> On Mon, Jun 6, 2022 at 11:50 AM PG Bug reporting form <
> noreply@postgresql.org> wrote:
>> The table at issue is constraint_column_usage--the ordinary role 'apach=
e'
>> does not have SELECT rights to that table, though it does to the other =
two
>> catalog tables used by this query.

> Haven't tried to duplicate but I'm not following.

constraint_column_usage certainly does/should have public read access:

postgres=3D# \z information_schema.constraint_column_usage
                                               Access privileges
       Schema       |          Name           | Type |     Access privileg=
es     | Column privileges | Policies =

--------------------+-------------------------+------+--------------------=
-------+-------------------+----------
 information_schema | constraint_column_usage | view | postgres=3DarwdDxt/=
postgres+|                   | =

                    |                         |      | =3Dr/postgres      =
         |                   | =

(1 row)

I think what the OP is complaining about is that its *contents*
are filtered, ie you can't see rows about tables you don't have
any privileges on.  However, that behavior is mandated by the
SQL standard, and in our view the sole reason for existence
of the information_schema views is to be standard-conforming.
So we won't be removing that filter unless you can talk the
SQL committee into dropping that requirement.  If you want
an unfiltered view, look directly at the system catalogs.

			regards, tom lane