public inbox for [email protected]  

help / color / mirror / Atom feed

From: Jacob Champion <[email protected]>
To: Ayush Tiwari <[email protected]>
Cc: PostgreSQL Hackers <[email protected]>
Subject: Re: REVOKE's CASCADE protection doesn't work with INHERITed table owners
Date: Wed, 8 Jul 2026 15:54:06 -0700
Message-ID: <CAOYmi+nns1VaW6W7kTJBTCTYVSfacJaZKyj-qxRuquT7082+WA@mail.gmail.com> (raw)
In-Reply-To: <CAJTYsWXbrewUuiMekCmah3V3fA+ZvcASyV6CJgaUQ2Wc-M0MLw@mail.gmail.com>
References: <CAOYmi+=KTLd+XsEP=TDiZ48iVf-CEc7JrZd5uhWPYWKEfOgyyQ@mail.gmail.com>
	<CAOYmi+n_hw=SC5V1i3BmqfZPfPBRaUSJc+BeOXEKDwRue+WYrg@mail.gmail.com>
	<CAJTYsWXbrewUuiMekCmah3V3fA+ZvcASyV6CJgaUQ2Wc-M0MLw@mail.gmail.com>

On Mon, Jul 6, 2026 at 4:03 AM Ayush Tiwari <[email protected]> wrote:
> Thanks, this looks right to me.

Thanks for the review!

> One tiny comment question: the phrase "granted by any role on the chain"
> in the new comment reads a little oddly to me, would something like
> "still holds the option directly via another grantor" be closer to what
> the code checks?

The first sentence is still "The grantee might still have some grant
options via another grantor," and I don't think adding "direct" would
have helped me understand this any better the first time I read it.
I'm definitely up for more bikeshedding, though, because I don't
really like what I have...

> On check_circularity() for [1]: I tried the same aclmask_direct() swap,
> but since it runs on every GRANT ... WITH GRANT OPTION, which
> pg_dump/restore replays, erroring there could make restore/pg_upgrade of
> an existing cluster (one already holding the [1] self-grant) fail.

Well, I think the complaint in [1] is that dump/restore *already*
fails, no? Can you provide an example of a correct (or benignly
incorrect) dump that would start failing?

As an aside, I'm not sure if check_circularity() is correctly
preventing cycles independently of this issue, so that part may end up
spiraling a bit.

Thanks,
--Jacob

view thread (5+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: REVOKE's CASCADE protection doesn't work with INHERITed table owners
  In-Reply-To: <CAOYmi+nns1VaW6W7kTJBTCTYVSfacJaZKyj-qxRuquT7082+WA@mail.gmail.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox