Date: Mon, 11 May 2026 09:24:02 -0500
From: Nathan Bossart <nathandbossart@gmail.com>
To: 798604270@qq.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #19475: VACUUM on a partition still warns after MAINTAIN is
 granted on the partitioned parent
Message-ID: <agHmgqo4MHkJw9mS@nathan>
References: <19475-513aa13168f22afe@postgresql.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <19475-513aa13168f22afe@postgresql.org>
Archived-At: <https://www.postgresql.org/message-id/agHmgqo4MHkJw9mS%40nathan>
Precedence: bulk

On Mon, May 11, 2026 at 07:41:42AM +0000, PG Bug reporting form wrote:
> I tested the current PostgreSQL master at commit 901ed9b352b (postgres
> --version reports PostgreSQL 19devel). The current branch already contains
> commit ff9618e82a466fc9c635f9f087776e57b21e4f14, whose commit message says:
> 
> “For partitions, allow the maintenance command if the user has the MAINTAIN
> privilege on the partition or any parent.”

Note that MAINTAIN was reverted after commit ff9618e82a and was
reintroduced in commit ecb0fd3372, so the former's commit message may no
longer be accurate.

> However, the following test case still produces a permission warning when
> VACUUM is run directly on a partition after granting MAINTAIN only on its
> partitioned parent.
> 
> Reproduction:
> 
> ```
> CREATE TABLE parent (a int) PARTITION BY RANGE (a);
> CREATE TABLE child PARTITION OF parent
>   FOR VALUES FROM (0) TO (100);
> INSERT INTO parent VALUES (1), (2), (3);
> 
> GRANT MAINTAIN ON parent TO main_role;
> 
> SET client_min_messages = warning;
> SET ROLE main_role;
> 
> VACUUM child;  -- WARNING:  permission denied to vacuum "child", skipping it

The current VACUUM documentation states the following:

    To vacuum a table, one must ordinarily have the MAINTAIN privilege on
    the table. However, database owners are allowed to vacuum all tables in
    their databases, except shared catalogs. VACUUM will skip over any
    tables that the calling user does not have permission to vacuum.

-- 
nathan