From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Heikki Linnakangas <hlinnaka@iki.fi>
To: maxim.boguk@gmail.com
To: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18387: Erroneous permission checks and/or misleading error messages with refresh materialized view
Date: Tue, 12 Mar 2024 08:34:40 +0100
Message-ID: <ab150c8f181fd343d08ddf0896dc59496184db62.camel@cybertec.at> (raw)
In-Reply-To: <36bb333d-13ec-4f8e-af33-48249ca2fe69@iki.fi>
References: <18387-12041858d9efb6f6@postgresql.org>
<36bb333d-13ec-4f8e-af33-48249ca2fe69@iki.fi>
On Tue, 2024-03-12 at 01:02 +0200, Heikki Linnakangas wrote:
> test=# \c test
> > You are now connected to database "test" as user "postgres".
> > test=# REFRESH MATERIALIZED VIEW CONCURRENTLY test_mv;
> > ERROR: permission denied to create temporary tables in database "test"
> > --what??? N2
>
> That's interesting. REFRESH MATERIALIZED VIEW CONCURRENTLY uses
> temporary tables internally, which fails if the user doesn't have
> permissions to create temporary tables.
>
> I guess we need to allow creating such internal temporary tables,
> despite the missing permission. That'll need some careful analysis to
> make sure we don't accidentally allow creating other temporary tables...
Wouldn't it be sufficient to document that fact, perhaps add an
error hint and require the MV owner to have TEMP on the database?
That's not an outrageous requirement, and it couldn't open any
security back doors.
Yours,
Laurenz Albe
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: laurenz.albe@cybertec.at, hlinnaka@iki.fi, maxim.boguk@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18387: Erroneous permission checks and/or misleading error messages with refresh materialized view
In-Reply-To: <ab150c8f181fd343d08ddf0896dc59496184db62.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox