From: Tom Lane <tgl@sss.pgh.pa.us>
To: Noah Misch <noah@leadboat.com>
cc: Jeff Davis <pgsql@j-davis.com>, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Fix search_path to a safe value during maintenance
 operations.
In-reply-to: <20230613182920.GA259321@gust.leadboat.com>
References: <E1q7j7Y-000z1H-Hr@gemulon.postgresql.org>
 <89a415b86d5421941e4281ba5bf6288934078624.camel@j-davis.com>
 <d20864b929ff769a0ebf772359719f05bb6982cd.camel@j-davis.com>
 <573014.1686375211@sss.pgh.pa.us> <20230612170510.GA201972@gust.leadboat.com>
 <f53df2dbe11bb42764bcdd003a54aa29c9bb6137.camel@j-davis.com>
 <20230613182920.GA259321@gust.leadboat.com>
Comments: In-reply-to Noah Misch <noah@leadboat.com>
	message dated "Tue, 13 Jun 2023 14:29:20 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1799838.1686687804.1@sss.pgh.pa.us>
Date: Tue, 13 Jun 2023 16:23:24 -0400
Message-ID: <1799839.1686687804@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1799839.1686687804%40sss.pgh.pa.us>
Precedence: bulk

Noah Misch <noah@leadboat.com> writes:
> Best argument for shipping without $SUBJECT: we already have REFERENCES and
> TRIGGER privilege that tend to let the grantee hijack the table owner's
> account.  Adding MAINTAIN to the list, while sad, is defensible.  I still
> prefer to ship with $SUBJECT, not without.

What I'm concerned about is making such a fundamental semantics change
post-beta1.  It'll basically invalidate any application compatibility
testing anybody might have done against beta1.  I think this ship has
sailed as far as v16 is concerned, although we could reconsider it
in v17.

Also, I fail to see any connection to the MAINTAIN privilege: the
committed-and-reverted patch would break things whether the user
was making any use of that privilege or not.  Thus, I do not accept
the idea that we're fixing something that's new in 16.

			regards, tom lane