Date: Tue, 24 Sep 2024 09:26:21 -0500
From: Nathan Bossart <nathandbossart@gmail.com>
To: Fujii Masao <masao.fujii@oss.nttdata.com>
Cc: Michael Paquier <michael@paquier.xyz>,
	Christophe Pettus <xof@thebuild.com>,
	vaibhave postgres <postgresvaibhave@gmail.com>,
	Tom Lane <tgl@sss.pgh.pa.us>, Noah Misch <noah@leadboat.com>,
	pgsql-bugs@lists.postgresql.org, vsekar@microsoft.com
Subject: Re: vacuumdb: permission denied for schema "pg_temp_7"
Message-ID: <ZvLMDXv1XrxuJfT3@nathan>
References: <Zu3iMzfiGBTbg3iy@nathan>
 <20240920215030.8d.nmisch@google.com>
 <2603142.1726873660@sss.pgh.pa.us>
 <5f37ee56-14fb-44fe-9150-9eb97e10538b@oss.nttdata.com>
 <2649165.1726898595@sss.pgh.pa.us>
 <CAM_eQjyWnu_LUt6JWjh3boNFHAT9DBrcbamhG3Xy39Q4Ph=2rg@mail.gmail.com>
 <ZvGye19tHrhLCpFl@nathan>
 <E9660D68-5B26-488E-9AB2-2CA1E8EDDDA1@thebuild.com>
 <ZvIRG6282T33q3Ku@paquier.xyz>
 <00d98a9f-bec1-4cd0-b59e-1043ae04c8bc@oss.nttdata.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <00d98a9f-bec1-4cd0-b59e-1043ae04c8bc@oss.nttdata.com>
Archived-At: <https://www.postgresql.org/message-id/ZvLMDXv1XrxuJfT3%40nathan>
Precedence: bulk

On Tue, Sep 24, 2024 at 11:20:43PM +0900, Fujii Masao wrote:
> On 2024/09/24 10:08, Michael Paquier wrote:
>> About the permission restrictions depending on the objects listed, the
>> filtering query uses currently a list of VALUES in a CTE.  Perhaps it
>> would be more elegant to switch that to a SELECT with some
>> has_schema_privilege() for the cases where OBJFILTER_SCHEMA is
>> used?
>> 
>> There permission checks with USAGE and MAINTAIN are broader, so I'd
>> choose to add a skip on the temp persistence first and backpatch it
>> down to 12 as there is also a performance argument.  Then tackle the
>> rest by reworking the VALUES part in the CTE.
> 
> Are you suggesting that any objects a user lacks sufficient privileges for
> should be silently excluded from vacuuming? This could make vacuumdb appear
> successful because no errors occur, but some tables the user intended to
> vacuum might be skipped without notice. That seems more problematic to me.

Yeah, this is what I mentioned upthread [0].  If the user doesn't specify
anything in --table or --schema, then it's probably fine to silently skip
objects for which they lack privileges.  But if they do explicitly specify
a table or schema that they cannot vacuum, then IMHO it'd be better to
fail.

[0] https://postgr.es/m/Zu3iMzfiGBTbg3iy%40nathan

-- 
nathan