From: Tom Lane <tgl@sss.pgh.pa.us>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Revert "Avoid race condition between "GRANT role" and "DROP ROLE
Date: Tue, 16 Sep 2025 17:06:04 +0000
Message-ID: <E1uyZ7z-00125s-1g@gemulon.postgresql.org> (raw)
Revert "Avoid race condition between "GRANT role" and "DROP ROLE"".
This reverts commit 98fc31d6499163a0a781aa6f13582a07f09cd7c6.
That change allowed DROP OWNED BY to drop grants of the target
role to other roles, arguing that nobody would need those
privileges anymore. But that's not so: if you're not superuser,
you still need admin privilege on the target role so you can
drop it.
It's not clear whether or how the dependency-based approach
to solving the original problem can be adapted to keep these
grants. Since v18 release is fast approaching, the sanest
thing to do seems to be to revert this patch for now. The
race-condition problem is low severity and not worth taking
risks for.
I didn't force a catversion bump in 98fc31d64, so I won't do
so here either.
Reported-by: Dipesh Dhameliya <dipeshdhameliya125@gmail.com>
Author: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/CABgZEgczOFicCJoqtrH9gbYMe_BV3Hq8zzCBRcMgmU6LRsihUA@mail.gmail.com
Backpatch-through: 18
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/8abbbbae610cd62faad4f9ec18e7cfa908593796
Modified Files
--------------
doc/src/sgml/ref/drop_owned.sgml | 2 +-
src/backend/commands/user.c | 23 ++++++-----------------
src/test/regress/expected/privileges.out | 30 ------------------------------
src/test/regress/sql/privileges.sql | 15 ---------------
4 files changed, 7 insertions(+), 63 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: tgl@sss.pgh.pa.us, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Revert "Avoid race condition between "GRANT role" and "DROP ROLE
In-Reply-To: <E1uyZ7z-00125s-1g@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox