Message-ID: <2c8f7b87b68fd2084faebdcf48b4edb23f4e93e0.camel@cybertec.at>
Subject: Re: Add sentence about SECURITY LABEL object ownership
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Patrick =?ISO-8859-1?Q?St=E4hlin?= <me@packi.ch>,
	pgsql-docs@lists.postgresql.org
Date: Thu, 05 Jun 2025 09:21:47 -0500
In-Reply-To: <931e012a-57ba-41ba-9b88-24323a46dec5@packi.ch>
References: <931e012a-57ba-41ba-9b88-24323a46dec5@packi.ch>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.56.2 (3.56.2-1.fc42) 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/2c8f7b87b68fd2084faebdcf48b4edb23f4e93e0.camel%40cybertec.at>
Precedence: bulk

On Thu, 2025-06-05 at 15:29 +0200, Patrick St=C3=A4hlin wrote:
> Hi,
>=20
> I noticed that we don't document that you need to own the object being=
=20
> modified by SECURITY LABEL.
>=20
> Page: https://www.postgresql.org/docs/current/sql-security-label.html
>=20
> I've attached a patch that would have answered that question (for me)=20
> without diving into the code.

> --- a/doc/src/sgml/ref/security_label.sgml
> +++ b/doc/src/sgml/ref/security_label.sgml
> @@ -84,6 +84,10 @@ SECURITY LABEL [ FOR <replaceable class=3D"parameter">=
provider</replaceable> ] ON
>     based on object labels, rather than traditional discretionary access =
control
>     (DAC) concepts such as users and groups.
>    </para>
> +
> +  <para>
> +   You must own the database object to use the <command>SECURITY LABEL</=
command>.
> +  </para>
>   </refsect1>
> =20
>   <refsect1>

Wouldn't it be more accurate to say that you have to be a member of the own=
ing role?
But perhaps that would be complicated enough to confuse many users.

In general, +1 for documenting that.

Yours,
Laurenz Albe