pg.ddx.io pgsql-bugs@postgresql.org mailing list archive
help / color / mirror / Atom feedUser with BYPASSRLS privilege can't change password
14+ messages / 4 participants
[nested] [flat]
Commits from this thread:
2020-11-03 17fb60387c Improve error messages around REPLICATION and BYPASSRLS properties.
2020-11-03 136f87ea57 501035a0ac 04c4b495b1 77df80cf69 df4405b784 d907bd0543 768dbef0d4 Allow users with BYPASSRLS to alter their own passwords.
* User with BYPASSRLS privilege can't change password
@ 2020-11-03 15:51 Wolfgang Walther <walther@technowledgy.de>
0 siblings, 1 reply; 14+ messages in thread
From: Wolfgang Walther @ 2020-11-03 15:51 UTC (permalink / raw)
To: pgsql-bugs@lists.postgresql.org
Hi,
observed on PG12.4:
CREATE USER alice;
SET ROLE alice;
ALTER USER alice PASSOWRD 'x';
-- works
RESET ROLE;
CREATE USER bob BYPASSRLS;
SET ROLE bob;
ALTER USER bob PASSWORD 'x';
-- ERROR: must be superuser to change bypassrls attribute
I would expect bob to be able to change his password here.
Best
Wolfgang
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 16:22 Tom Lane <tgl@sss.pgh.pa.us>
parent: Wolfgang Walther <walther@technowledgy.de>
0 siblings, 1 reply; 14+ messages in thread
From: Tom Lane @ 2020-11-03 16:22 UTC (permalink / raw)
To: Wolfgang Walther <walther@technowledgy.de>; +Cc: pgsql-bugs@lists.postgresql.org
Wolfgang Walther <walther@technowledgy.de> writes:
> CREATE USER bob BYPASSRLS;
> SET ROLE bob;
> ALTER USER bob PASSWORD 'x';
> -- ERROR: must be superuser to change bypassrls attribute
Yeah, duplicated here on HEAD. The error message seems to think
the command is trying to remove the BYPASSRLS privilege, which
suggests somebody forgot to copy that flag somewhere where it needs
to be copied. Haven't dug further than that.
regards, tom lane
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 17:44 Tom Lane <tgl@sss.pgh.pa.us>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 2 replies; 14+ messages in thread
From: Tom Lane @ 2020-11-03 17:44 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: Wolfgang Walther <walther@technowledgy.de>; pgsql-bugs@lists.postgresql.org
I wrote:
> Wolfgang Walther <walther@technowledgy.de> writes:
>> CREATE USER bob BYPASSRLS;
>> SET ROLE bob;
>> ALTER USER bob PASSWORD 'x';
>> -- ERROR: must be superuser to change bypassrls attribute
> Yeah, duplicated here on HEAD. The error message seems to think
> the command is trying to remove the BYPASSRLS privilege, which
> suggests somebody forgot to copy that flag somewhere where it needs
> to be copied. Haven't dug further than that.
It's a little more subtle than that, but not much. Commit 491c029db
copied-and-pasted the logic used to deny non-superusers the privilege
to change anything about a superuser role. That was certainly not the
intention, because the error message was phrased differently from the
superuser case, but that was the effect. I propose the attached.
(Hm, looks like this behavior is undocumented, too.)
regards, tom lane
Attachments:
fix-bypassrls-privilege-check.patch (text/x-diff, 1.2K) download
diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c
index 9ce9a66921..5cd479a649 100644
--- a/src/backend/commands/user.c
+++ b/src/backend/commands/user.c
@@ -709,8 +709,10 @@ AlterRole(AlterRoleStmt *stmt)
roleid = authform->oid;
/*
- * To mess with a superuser you gotta be superuser; else you need
- * createrole, or just want to change your own password
+ * To mess with a superuser or replication role in any way you gotta be
+ * superuser. We also insist on superuser to change the BYPASSRLS
+ * property. Otherwise, if you don't have createrole, you're only allowed
+ * to change your own password.
*/
if (authform->rolsuper || issuper >= 0)
{
@@ -726,7 +728,7 @@ AlterRole(AlterRoleStmt *stmt)
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
errmsg("must be superuser to alter replication users")));
}
- else if (authform->rolbypassrls || bypassrls >= 0)
+ else if (bypassrls >= 0)
{
if (!superuser())
ereport(ERROR,
@@ -739,7 +741,6 @@ AlterRole(AlterRoleStmt *stmt)
createrole < 0 &&
createdb < 0 &&
canlogin < 0 &&
- isreplication < 0 &&
!dconnlimit &&
!rolemembers &&
!validUntil &&
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 18:05 Wolfgang Walther <walther@technowledgy.de>
parent: Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 1 reply; 14+ messages in thread
From: Wolfgang Walther @ 2020-11-03 18:05 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; Stephen Frost <sfrost@snowman.net>; +Cc: pgsql-bugs@lists.postgresql.org
Tom Lane:
> It's a little more subtle than that, but not much. Commit 491c029db
> copied-and-pasted the logic used to deny non-superusers the privilege
> to change anything about a superuser role. That was certainly not the
> intention, because the error message was phrased differently from the
> superuser case, but that was the effect. I propose the attached.
Wouldn't the following change allow a non-superuser with createrole
privilege to grant the replication privilege to a role that does not
have that privilege, yet? This should still be forbidden, I think.
@@ -739,7 +741,6 @@ AlterRole(AlterRoleStmt *stmt)
createrole < 0 &&
createdb < 0 &&
canlogin < 0 &&
- isreplication < 0 &&
!dconnlimit &&
!rolemembers &&
!validUntil &&
This is because the "must be superuser to alter replication users"
condition only triggers when the altered role already has isrepliaction,
so isreplication could very well be >= 0 here.
The other change looks good.
Best
Wolfgang
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 18:06 Stephen Frost <sfrost@snowman.net>
parent: Tom Lane <tgl@sss.pgh.pa.us>
1 sibling, 2 replies; 14+ messages in thread
From: Stephen Frost @ 2020-11-03 18:06 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Wolfgang Walther <walther@technowledgy.de>; pgsql-bugs@lists.postgresql.org
Greetings,
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> I wrote:
> > Wolfgang Walther <walther@technowledgy.de> writes:
> >> CREATE USER bob BYPASSRLS;
> >> SET ROLE bob;
> >> ALTER USER bob PASSWORD 'x';
> >> -- ERROR: must be superuser to change bypassrls attribute
>
> > Yeah, duplicated here on HEAD. The error message seems to think
> > the command is trying to remove the BYPASSRLS privilege, which
> > suggests somebody forgot to copy that flag somewhere where it needs
> > to be copied. Haven't dug further than that.
>
> It's a little more subtle than that, but not much. Commit 491c029db
> copied-and-pasted the logic used to deny non-superusers the privilege
> to change anything about a superuser role. That was certainly not the
> intention, because the error message was phrased differently from the
> superuser case, but that was the effect. I propose the attached.
>
> (Hm, looks like this behavior is undocumented, too.)
The intent was certainly that non-superusers shouldn't be able to tweak
the BYPASSRLS bit, but it wasn't intended to prevent users who have
BYPASSRLS from being able to change their own password.
I certainly recall the discussion about that requirement and we should
document it.
> diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c
> index 9ce9a66921..5cd479a649 100644
> --- a/src/backend/commands/user.c
> +++ b/src/backend/commands/user.c
> @@ -709,8 +709,10 @@ AlterRole(AlterRoleStmt *stmt)
> roleid = authform->oid;
>
> /*
> - * To mess with a superuser you gotta be superuser; else you need
> - * createrole, or just want to change your own password
> + * To mess with a superuser or replication role in any way you gotta be
> + * superuser. We also insist on superuser to change the BYPASSRLS
> + * property. Otherwise, if you don't have createrole, you're only allowed
> + * to change your own password.
> */
> if (authform->rolsuper || issuper >= 0)
> {
> @@ -726,7 +728,7 @@ AlterRole(AlterRoleStmt *stmt)
> (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
> errmsg("must be superuser to alter replication users")));
> }
> - else if (authform->rolbypassrls || bypassrls >= 0)
> + else if (bypassrls >= 0)
> {
> if (!superuser())
> ereport(ERROR,
This change looks correct, we shouldn't be worrying about what's already
been set on the role.
> @@ -739,7 +741,6 @@ AlterRole(AlterRoleStmt *stmt)
> createrole < 0 &&
> createdb < 0 &&
> canlogin < 0 &&
> - isreplication < 0 &&
> !dconnlimit &&
> !rolemembers &&
> !validUntil &&
This seems like an independent change..? Not saying it's wrong though.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 18:17 Tom Lane <tgl@sss.pgh.pa.us>
parent: Stephen Frost <sfrost@snowman.net>
1 sibling, 0 replies; 14+ messages in thread
From: Tom Lane @ 2020-11-03 18:17 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: Wolfgang Walther <walther@technowledgy.de>; pgsql-bugs@lists.postgresql.org
Stephen Frost <sfrost@snowman.net> writes:
>> @@ -739,7 +741,6 @@ AlterRole(AlterRoleStmt *stmt)
>> createrole < 0 &&
>> createdb < 0 &&
>> canlogin < 0 &&
>> - isreplication < 0 &&
>> !dconnlimit &&
>> !rolemembers &&
>> !validUntil &&
> This seems like an independent change..? Not saying it's wrong though.
That test is redundant, since we wouldn't be in this path at all if
isreplication >= 0. You could alternatively argue that this should
redundantly test all three of issuper, isreplication, and bypassrls;
but testing just one of them is confusing and hence bug-prone.
regards, tom lane
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 18:19 Tom Lane <tgl@sss.pgh.pa.us>
parent: Wolfgang Walther <walther@technowledgy.de>
0 siblings, 1 reply; 14+ messages in thread
From: Tom Lane @ 2020-11-03 18:19 UTC (permalink / raw)
To: Wolfgang Walther <walther@technowledgy.de>; +Cc: Stephen Frost <sfrost@snowman.net>; pgsql-bugs@lists.postgresql.org
Wolfgang Walther <walther@technowledgy.de> writes:
> This is because the "must be superuser to alter replication users"
> condition only triggers when the altered role already has isrepliaction,
> so isreplication could very well be >= 0 here.
How do you figure that? This is in an "else" path after
else if (authform->rolreplication || isreplication >= 0)
so AFAICS it's impossible to get there. If it isn't impossible,
we have a much bigger hole with respect to issuper.
regards, tom lane
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 18:26 Wolfgang Walther <walther@technowledgy.de>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 14+ messages in thread
From: Wolfgang Walther @ 2020-11-03 18:26 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Stephen Frost <sfrost@snowman.net>; pgsql-bugs@lists.postgresql.org
Tom Lane:
> How do you figure that? This is in an "else" path after
>
> else if (authform->rolreplication || isreplication >= 0)
>
> so AFAICS it's impossible to get there. If it isn't impossible,
> we have a much bigger hole with respect to issuper.
Yes, you're right. I read the || as &&. And also missed the ! in else if
(!have_createrole_privilege()) btw. :)
I guess the error message "must be superuser to alter replication users"
led me on the wrong path. I would be more precise as "must be superuser
to alter replication users or change replication attribute" to cover the
change-non-replication-to-replication user case, I think. The same thing
for superusers.
Best
Wolfgang
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 18:51 Tom Lane <tgl@sss.pgh.pa.us>
parent: Wolfgang Walther <walther@technowledgy.de>
0 siblings, 1 reply; 14+ messages in thread
From: Tom Lane @ 2020-11-03 18:51 UTC (permalink / raw)
To: Wolfgang Walther <walther@technowledgy.de>; +Cc: Stephen Frost <sfrost@snowman.net>; pgsql-bugs@lists.postgresql.org
Wolfgang Walther <walther@technowledgy.de> writes:
> Tom Lane:
>> so AFAICS it's impossible to get there. If it isn't impossible,
>> we have a much bigger hole with respect to issuper.
> Yes, you're right. I read the || as &&. And also missed the ! in else if
> (!have_createrole_privilege()) btw. :)
Actually the right way to deal with this potential confusion is to
add a comment, as below. I fixed the docs too.
> I guess the error message "must be superuser to alter replication users"
> led me on the wrong path. I would be more precise as "must be superuser
> to alter replication users or change replication attribute" to cover the
> change-non-replication-to-replication user case, I think. The same thing
> for superusers.
I'd be okay with changing the error text in HEAD, but less so in the back
branches, since that'd cause thrashing of translatable strings.
regards, tom lane
Attachments:
fix-bypassrls-privilege-check-2.patch (text/x-diff, 2.1K) download
diff --git a/doc/src/sgml/ref/alter_role.sgml b/doc/src/sgml/ref/alter_role.sgml
index aef30521bc..5aa5648ae7 100644
--- a/doc/src/sgml/ref/alter_role.sgml
+++ b/doc/src/sgml/ref/alter_role.sgml
@@ -71,7 +71,9 @@ ALTER ROLE { <replaceable class="parameter">role_specification</replaceable> | A
Attributes not mentioned in the command retain their previous settings.
Database superusers can change any of these settings for any role.
Roles having <literal>CREATEROLE</literal> privilege can change any of these
- settings, but only for non-superuser and non-replication roles.
+ settings except <literal>SUPERUSER</literal>, <literal>REPLICATION</literal>,
+ and <literal>BYPASSRLS</literal>; but only for non-superuser and
+ non-replication roles.
Ordinary roles can only change their own password.
</para>
diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c
index 9ce9a66921..293e7e4c0c 100644
--- a/src/backend/commands/user.c
+++ b/src/backend/commands/user.c
@@ -709,8 +709,10 @@ AlterRole(AlterRoleStmt *stmt)
roleid = authform->oid;
/*
- * To mess with a superuser you gotta be superuser; else you need
- * createrole, or just want to change your own password
+ * To mess with a superuser or replication role in any way you gotta be
+ * superuser. We also insist on superuser to change the BYPASSRLS
+ * property. Otherwise, if you don't have createrole, you're only allowed
+ * to change your own password.
*/
if (authform->rolsuper || issuper >= 0)
{
@@ -726,7 +728,7 @@ AlterRole(AlterRoleStmt *stmt)
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
errmsg("must be superuser to alter replication users")));
}
- else if (authform->rolbypassrls || bypassrls >= 0)
+ else if (bypassrls >= 0)
{
if (!superuser())
ereport(ERROR,
@@ -735,11 +737,11 @@ AlterRole(AlterRoleStmt *stmt)
}
else if (!have_createrole_privilege())
{
+ /* We already checked issuper, isreplication, and bypassrls */
if (!(inherit < 0 &&
createrole < 0 &&
createdb < 0 &&
canlogin < 0 &&
- isreplication < 0 &&
!dconnlimit &&
!rolemembers &&
!validUntil &&
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 18:58 David G. Johnston <david.g.johnston@gmail.com>
parent: Stephen Frost <sfrost@snowman.net>
1 sibling, 1 reply; 14+ messages in thread
From: David G. Johnston @ 2020-11-03 18:58 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: Tom Lane <tgl@sss.pgh.pa.us>; Wolfgang Walther <walther@technowledgy.de>; PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Tue, Nov 3, 2020 at 11:06 AM Stephen Frost <sfrost@snowman.net> wrote:
>
> > diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c
> > index 9ce9a66921..5cd479a649 100644
> > --- a/src/backend/commands/user.c
> > +++ b/src/backend/commands/user.c
> > @@ -709,8 +709,10 @@ AlterRole(AlterRoleStmt *stmt)
> > roleid = authform->oid;
> >
> > /*
> > - * To mess with a superuser you gotta be superuser; else you need
> > - * createrole, or just want to change your own password
> > + * To mess with a superuser or replication role in any way you
> gotta be
> > + * superuser. We also insist on superuser to change the BYPASSRLS
> > + * property. Otherwise, if you don't have createrole, you're only
> allowed
> > + * to change your own password.
> > */
> > if (authform->rolsuper || issuper >= 0)
> > {
> > @@ -726,7 +728,7 @@ AlterRole(AlterRoleStmt *stmt)
> >
> (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
> > errmsg("must be superuser to
> alter replication users")));
> > }
> > - else if (authform->rolbypassrls || bypassrls >= 0)
> > + else if (bypassrls >= 0)
> > {
> > if (!superuser())
> > ereport(ERROR,
>
> This change looks correct, we shouldn't be worrying about what's already
> been set on the role.
>
>
Is the nuance that in reality a non-superuser cannot specify BypassRLS even
if the effective value is unchanged unimportant here?
David J.
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 19:06 Tom Lane <tgl@sss.pgh.pa.us>
parent: David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 1 reply; 14+ messages in thread
From: Tom Lane @ 2020-11-03 19:06 UTC (permalink / raw)
To: David G. Johnston <david.g.johnston@gmail.com>; +Cc: Stephen Frost <sfrost@snowman.net>; Wolfgang Walther <walther@technowledgy.de>; PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
"David G. Johnston" <david.g.johnston@gmail.com> writes:
> Is the nuance that in reality a non-superuser cannot specify BypassRLS even
> if the effective value is unchanged unimportant here?
I was wondering about that. You could definitely make a case for a
weaker set of rules here. However, the superuser restriction has been
like that for 15-ish years without much complaint, so it doesn't seem
that it bothers people in practice.
regards, tom lane
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 19:13 David G. Johnston <david.g.johnston@gmail.com>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 14+ messages in thread
From: David G. Johnston @ 2020-11-03 19:13 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Stephen Frost <sfrost@snowman.net>; Wolfgang Walther <walther@technowledgy.de>; PostgreSQL mailing lists <pgsql-bugs@lists.postgresql.org>
On Tue, Nov 3, 2020 at 12:06 PM Tom Lane <tgl@sss.pgh.pa.us> wrote:
> "David G. Johnston" <david.g.johnston@gmail.com> writes:
> > Is the nuance that in reality a non-superuser cannot specify BypassRLS
> even
> > if the effective value is unchanged unimportant here?
>
> I was wondering about that. You could definitely make a case for a
> weaker set of rules here. However, the superuser restriction has been
> like that for 15-ish years without much complaint, so it doesn't seem
> that it bothers people in practice.
>
>
Agreed that the behavior seems fine to keep. Was more about the
documentation saying "change" instead of "specify".
David J.
^ permalink raw reply [nested|flat] 14+ messages in thread
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 20:02 Stephen Frost <sfrost@snowman.net>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 14+ messages in thread
From: Stephen Frost @ 2020-11-03 20:02 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Wolfgang Walther <walther@technowledgy.de>; pgsql-bugs@lists.postgresql.org
Greetings,
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Wolfgang Walther <walther@technowledgy.de> writes:
> > Tom Lane:
> >> so AFAICS it's impossible to get there. If it isn't impossible,
> >> we have a much bigger hole with respect to issuper.
>
> > Yes, you're right. I read the || as &&. And also missed the ! in else if
> > (!have_createrole_privilege()) btw. :)
>
> Actually the right way to deal with this potential confusion is to
> add a comment, as below. I fixed the docs too.
>
> > I guess the error message "must be superuser to alter replication users"
> > led me on the wrong path. I would be more precise as "must be superuser
> > to alter replication users or change replication attribute" to cover the
> > change-non-replication-to-replication user case, I think. The same thing
> > for superusers.
>
> I'd be okay with changing the error text in HEAD, but less so in the back
> branches, since that'd cause thrashing of translatable strings.
I tend to agree with that.
> diff --git a/doc/src/sgml/ref/alter_role.sgml b/doc/src/sgml/ref/alter_role.sgml
> index aef30521bc..5aa5648ae7 100644
> --- a/doc/src/sgml/ref/alter_role.sgml
> +++ b/doc/src/sgml/ref/alter_role.sgml
> @@ -71,7 +71,9 @@ ALTER ROLE { <replaceable class="parameter">role_specification</replaceable> | A
> Attributes not mentioned in the command retain their previous settings.
> Database superusers can change any of these settings for any role.
> Roles having <literal>CREATEROLE</literal> privilege can change any of these
> - settings, but only for non-superuser and non-replication roles.
> + settings except <literal>SUPERUSER</literal>, <literal>REPLICATION</literal>,
> + and <literal>BYPASSRLS</literal>; but only for non-superuser and
> + non-replication roles.
> Ordinary roles can only change their own password.
> </para>
This looks good, though should we also mention that you have to be a
superuser to set BYPASSRLS on a role in the CREATE ROLE documentation
too..? The error message there could also be improved, it looks like.
Also, we don't seem to document in CREATE ROLE that you have to be a
superuser to create a REPLICATION role either, even though the code
clearly says that.
Attached is a patch for all of those. As mentioned, the error message
probably only makes sense to change in HEAD, though improving the
documentation could be back-patched.
Thanks,
Stephen
Attachments:
cleanup_bypassrls_v1.patch (text/x-diff, 1.6K) download
diff --git a/doc/src/sgml/ref/create_role.sgml b/doc/src/sgml/ref/create_role.sgml
index d23133945d..0d9c430789 100644
--- a/doc/src/sgml/ref/create_role.sgml
+++ b/doc/src/sgml/ref/create_role.sgml
@@ -181,6 +181,8 @@ in sync when changing the above synopsis!
highly privileged role, and should only be used on roles actually
used for replication. If not specified,
<literal>NOREPLICATION</literal> is the default.
+ You must be a superuser to create a new role having the
+ <literal>REPLICATION</literal> attribute set.
</para>
</listitem>
</varlistentry>
@@ -196,7 +198,8 @@ in sync when changing the above synopsis!
<literal>OFF</literal> by default, to ensure all contents of a table are
dumped out. If the user running pg_dump does not have appropriate
permissions, an error will be returned. The superuser and owner of the
- table being dumped always bypass RLS.
+ table being dumped always bypass RLS. You must be a superuser to create
+ a new role having the <literal>BYPASSRLS</literal> attribute set.
</para>
</listitem>
</varlistentry>
diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c
index 9ce9a66921..4a93b68ee3 100644
--- a/src/backend/commands/user.c
+++ b/src/backend/commands/user.c
@@ -305,7 +305,7 @@ CreateRole(ParseState *pstate, CreateRoleStmt *stmt)
if (!superuser())
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
- errmsg("must be superuser to change bypassrls attribute")));
+ errmsg("must be superuser to create bypassrls users")));
}
else
{
* Re: User with BYPASSRLS privilege can't change password
@ 2020-11-03 20:05 Tom Lane <tgl@sss.pgh.pa.us>
parent: Stephen Frost <sfrost@snowman.net>
0 siblings, 0 replies; 14+ messages in thread
From: Tom Lane @ 2020-11-03 20:05 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; +Cc: Wolfgang Walther <walther@technowledgy.de>; pgsql-bugs@lists.postgresql.org
Stephen Frost <sfrost@snowman.net> writes:
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> I'd be okay with changing the error text in HEAD, but less so in the back
>> branches, since that'd cause thrashing of translatable strings.
> I tend to agree with that.
OK, will do it that way.
> Attached is a patch for all of those. As mentioned, the error message
> probably only makes sense to change in HEAD, though improving the
> documentation could be back-patched.
Check. I'll merge this with what I was doing and push it all.
regards, tom lane
^ permalink raw reply [nested|flat] 14+ messages in thread
end of thread, other threads:[~2020-11-03 20:05 UTC | newest]
Thread overview: 14+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-11-03 15:51 User with BYPASSRLS privilege can't change password Wolfgang Walther <walther@technowledgy.de>
2020-11-03 16:22 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-03 17:44 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-03 18:05 ` Wolfgang Walther <walther@technowledgy.de>
2020-11-03 18:19 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-03 18:26 ` Wolfgang Walther <walther@technowledgy.de>
2020-11-03 18:51 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-03 20:02 ` Stephen Frost <sfrost@snowman.net>
2020-11-03 20:05 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-03 18:06 ` Stephen Frost <sfrost@snowman.net>
2020-11-03 18:17 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-03 18:58 ` David G. Johnston <david.g.johnston@gmail.com>
2020-11-03 19:06 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-11-03 19:13 ` David G. Johnston <david.g.johnston@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox