From: Wetmore, Matthew (CTR) <Matthew.Wetmore@evernorth.com>
To: Laurenz Albe <laurenz.albe@cybertec.at>
To: Heikki Linnakangas <hlinnaka@iki.fi>
To: maxim.boguk@gmail.com <maxim.boguk@gmail.com>
To: pgsql-bugs@lists.postgresql.org <pgsql-bugs@lists.postgresql.org>
Subject: BUG #18387: Erroneous permission checks and/or misleading error messages with refresh materialized view
Date: Tue, 12 Mar 2024 13:51:46 +0000
Message-ID: <d4ea4f8641a8486e899a3a4f42447ba4@evernorth.com> (raw)
In-Reply-To: <ab150c8f181fd343d08ddf0896dc59496184db62.camel@cybertec.at>
References: <18387-12041858d9efb6f6@postgresql.org>
<36bb333d-13ec-4f8e-af33-48249ca2fe69@iki.fi>
<ab150c8f181fd343d08ddf0896dc59496184db62.camel@cybertec.at>
> I guess we need to allow creating such internal temporary tables,
> despite the missing permission. That'll need some careful analysis to
> make sure we don't accidentally allow creating other temporary tables...
Wouldn't it be sufficient to document that fact, perhaps add an error hint and require the MV owner to have TEMP on the database?
That's not an outrageous requirement, and it couldn't open any security back doors.
Agree. We already have to create a new user (well, that’s what I do) for MV's anyway for the REFRESH by owner only, it would not be a burden to adjust that ROLE's settings at time of creation. The doco is completely clear about MV owner, we can just add to that note to make sure CREATE permission too.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: Matthew.Wetmore@evernorth.com, laurenz.albe@cybertec.at, hlinnaka@iki.fi, maxim.boguk@gmail.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #18387: Erroneous permission checks and/or misleading error messages with refresh materialized view
In-Reply-To: <d4ea4f8641a8486e899a3a4f42447ba4@evernorth.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox