From: Joel Jacobson <joel@compiler.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael@paquier.xyz>
Cc: pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add pg_get_acl() to get the ACL for a database object
Date: Thu, 04 Jul 2024 22:53:49 +0200
Message-ID: <f2688fb7-add6-43da-b1df-97312a451893@app.fastmail.com> (raw)
In-Reply-To: <3408967.1720107891@sss.pgh.pa.us>
References: <E1sPHWu-000GPc-0z@gemulon.postgresql.org>
<3408967.1720107891@sss.pgh.pa.us>
On Thu, Jul 4, 2024, at 17:44, Tom Lane wrote:
> Michael Paquier <michael@paquier.xyz> writes:
>> Add pg_get_acl() to get the ACL for a database object
>> This function returns the ACL for a database object, specified by
>> catalog OID and object OID.
>
> Uh, why is it defined like that rather than allowing a subobject?
> This definition is unable to fetch column-specific ACLs.
Good point, that's surely an important missing feature,
that I hadn't thought about up until now.
Probably because all object classes, except columns, don't have subobjects.
I wonder if it would be motivated to provide overloads for this function,
and perhaps even for pg_get_object_address and pg_identify_object_as_address?
That is, two param versions (class OID and object OID),
and three param versions that in addition also take subobject ID.
Why I think this could be motivated, is since during discussion,
some even wanted reg* overloads, to avoid having to pass the class OID.
As a middle ground, maybe users would appreciate if they at least
didn't have pass in the extra 0, since it's meaningless anyway,
most of the times (for all classes except columns)?
Anyway, that's just an idea. We still need support for subobject,
so I had a look on how to implement it.
Unfortunately, the AlterObjectOwner_internal function in alter.c,
which pg_get_acl in objectaddress.c is based upon,
doesn't deal with subobjects.
I found some code in aclchk.c on line 4452-4468 that seems useful,
but not sure. Maybe there is some other existing code that is better
as an inspiration?
I guess we need to handle the RelationRelationId separately,
and handle all other classes using the current code in pg_get_acl()?
Regards,
Joel
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: joel@compiler.org, tgl@sss.pgh.pa.us, michael@paquier.xyz, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Add pg_get_acl() to get the ACL for a database object
In-Reply-To: <f2688fb7-add6-43da-b1df-97312a451893@app.fastmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox