From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jeff Davis <pgsql@j-davis.com>
cc: "David G. Johnston" <david.g.johnston@gmail.com>,
        Noah Misch <noah@leadboat.com>, Jeff Davis <jdavis@postgresql.org>,
        "pgsql-committers@lists.postgresql.org"
 <pgsql-committers@lists.postgresql.org>,
        Laurenz Albe <laurenz.albe@cybertec.at>
Subject: Re: pgsql: Fix search_path to a safe value during maintenance
 operations.
In-reply-to: <f0228b6529eb2fcdaff639e0a37f0598f5c00d4a.camel@j-davis.com>
References: <E1q7j7Y-000z1H-Hr@gemulon.postgresql.org>
 <89a415b86d5421941e4281ba5bf6288934078624.camel@j-davis.com>
 <d20864b929ff769a0ebf772359719f05bb6982cd.camel@j-davis.com>
 <573014.1686375211@sss.pgh.pa.us> <20230612170510.GA201972@gust.leadboat.com>
 <f53df2dbe11bb42764bcdd003a54aa29c9bb6137.camel@j-davis.com>
 <CAKFQuwaVJkM9u+qpOaom2UkPE1sz0BASF-E5amxWPxncUhm4Hw@mail.gmail.com>
 <CAKFQuwYocyEvpC=_0BgG3t9DVXNmzrWqBTLEov9zy4qW1239yg@mail.gmail.com>
 <32747058519a68f099ac175a3a4bde4ba7cebb22.camel@j-davis.com>
 <CAKFQuwY3AxtE+FT8P3RWGyWz33jQZaShdpD1An7SR5BuvmKFYw@mail.gmail.com>
 <f0228b6529eb2fcdaff639e0a37f0598f5c00d4a.camel@j-davis.com>
Comments: In-reply-to Jeff Davis <pgsql@j-davis.com>
	message dated "Tue, 13 Jun 2023 13:55:13 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1805936.1686691081.1@sss.pgh.pa.us>
Date: Tue, 13 Jun 2023 17:18:01 -0400
Message-ID: <1805937.1686691081@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/1805937.1686691081%40sss.pgh.pa.us>
Precedence: bulk

Jeff Davis <pgsql@j-davis.com> writes:
> The most objection seems to be expressed most succinctly in this
> message:
> https://www.postgresql.org/message-id/16134.1456767564%40sss.pgh.pa.us
> "if we allow non-owners to run ANALYZE, they'd be able to mess things
> up by setting the stats target either much lower or much higher than
> the table owner expected"

> I have trouble seeing much of a problem here if there is an explicit
> MAINTAIN privilege. If you grant someone MAINTAIN to someone, it's not
> surprising that you need to coordinate maintenance-related settings
> with that user; and if you don't, then it's not surprising that the
> statistics could get messed up.

I agree that granting MAINTAIN implies that you trust the grantee
not to mess up your stats.

> Perhaps the objections in that thread were because the proposal
> involved inferring the privilege to ANALYZE from other privileges,
> rather than having an explicit MAINTAIN privilege?

Exactly.

			regards, tom lane