Message-ID: <199dfdd7fdea9ac1d654442dd154f3ef6f6db51d.camel@cybertec.at>
Subject: Re: Add sentence about SECURITY LABEL object ownership
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Patrick =?ISO-8859-1?Q?St=E4hlin?= <me@packi.ch>,
	pgsql-docs@lists.postgresql.org
Date: Thu, 05 Jun 2025 20:18:02 -0500
In-Reply-To: <1284778.1749136742@sss.pgh.pa.us>
References: <931e012a-57ba-41ba-9b88-24323a46dec5@packi.ch>
	 <2c8f7b87b68fd2084faebdcf48b4edb23f4e93e0.camel@cybertec.at>
	 <1284778.1749136742@sss.pgh.pa.us>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/199dfdd7fdea9ac1d654442dd154f3ef6f6db51d.camel%40cybertec.at>
Precedence: bulk

On Thu, 2025-06-05 at 11:19 -0400, Tom Lane wrote:
> Laurenz Albe <laurenz.albe@cybertec.at> writes:
> > On Thu, 2025-06-05 at 15:29 +0200, Patrick St=C3=A4hlin wrote:
> > > I noticed that we don't document that you need to own the object bein=
g=20
> > > modified by SECURITY LABEL.
>=20
> Yeah, clearly a documentation oversight.
>=20
> > Wouldn't it be more accurate to say that you have to be a member of the=
 owning role?
> > But perhaps that would be complicated enough to confuse many users.
> > In general, +1 for documenting that.
>=20
> Our standard boilerplate for this is, eg,
>=20
>    You must own the table to use <command>ALTER TABLE</command>.
>=20
> I don't see a reason to do it differently here.

Objection withdrawn.

Yours,
Laurenz Albe