pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedSET ROLE documentation not entirely correct
23+ messages / 6 participants
[nested] [flat]
* SET ROLE documentation not entirely correct
@ 2019-04-23 15:52 PG Doc comments form <noreply@postgresql.org>
0 siblings, 1 reply; 23+ messages in thread
From: PG Doc comments form @ 2019-04-23 15:52 UTC (permalink / raw)
To: pgsql-docs@lists.postgresql.org; +Cc: steven.winfield@cantabcapital.com
The following documentation comment has been logged on the website:
Page: https://www.postgresql.org/docs/11/sql-set-role.html
Description:
In the course of trying to sanitise our roles and permissions I found the
notes in the SET ROLE docs a little misleading:
"If the session user role has the INHERITS attribute, then it automatically
has all the privileges of every role that it could SET ROLE to; in this case
SET ROLE effectively drops all the privileges assigned directly to the
session user and to the other roles it is a member of, leaving only the
privileges available to the named role."
This doesn't seem to be true. Consider the following:
CREATE ROLE userrole INHERIT LOGIN;
CREATE ROLE usergroup NOINHERIT NOLOGIN;
GRANT usergroup TO userrole;
CREATE ROLE sensitive;
GRANT sensitive TO usergroup;
SET SESSION AUTHORIZATION userrole;
SELECT session_user, current_user, rolinherit, pg_has_role('sensitive',
'USAGE') as usage, pg_has_role('sensitive', 'MEMBER') as member
FROM pg_roles
WHERE rolname = session_user;
+--------------+--------------+------------+-------+--------+
| session_user | current_user | rolinherit | usage | member |
+--------------+--------------+------------+-------+--------+
| userrole | userrole | True | False | True |
+--------------+--------------+------------+-------+--------+
Here the session role 'userrole' has the INHERITS attribute, and can SET
ROLE to 'sensitive', but contrary to the docs it does not automatically have
the privileges associated with 'sensitive'. The intermediate 'usergroup'
NOINHERIT role blocks automatic inheritance.
That can be demonstrated like this:
SET ROLE sensitive;
SELECT session_user, current_user, rolinherit, pg_has_role('sensitive',
'USAGE') as usage, pg_has_role('sensitive', 'MEMBER') as member
FROM pg_roles
WHERE rolname = session_user;
+--------------+--------------+------------+-------+--------+
| session_user | current_user | rolinherit | usage | member |
+--------------+--------------+------------+-------+--------+
| userrole | sensitive | True | True | True |
+--------------+--------------+------------+-------+--------+
(This is all on v11.2, in case it matters)
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-24 19:23 Joe Conway <mail@joeconway.com>
parent: PG Doc comments form <noreply@postgresql.org>
0 siblings, 1 reply; 23+ messages in thread
From: Joe Conway @ 2019-04-24 19:23 UTC (permalink / raw)
To: steven.winfield@cantabcapital.com; pgsql-docs@lists.postgresql.org
On 4/23/19 11:52 AM, PG Doc comments form wrote:
> The following documentation comment has been logged on the website:
>
> Page: https://www.postgresql.org/docs/11/sql-set-role.html
> Description:
>
> In the course of trying to sanitise our roles and permissions I found the
> notes in the SET ROLE docs a little misleading:
>
> "If the session user role has the INHERITS attribute, then it automatically
> has all the privileges of every role that it could SET ROLE to; in this case
> SET ROLE effectively drops all the privileges assigned directly to the
> session user and to the other roles it is a member of, leaving only the
> privileges available to the named role."
> This doesn't seem to be true. Consider the following:
Additionally s/INHERITS/INHERIT/
And similarly this sentence is wrong or at least not completely clear:
8<-----------
The specified role_name must be a role that the current session user is
a member of.
8<-----------
The wording should be something like
8<-----------
The specified role_name must be a role that the current session user is
a member of directly or indirectly.
8<-----------
I believe the paragraph you cite should be reworded, but I am at a loss
as to how best to describe the actual situation clearly. Maybe something
like:
8<-----------
If the session user role has the INHERIT attribute, then it
automatically has all the privileges of every role that it is a member
of directly, and any that it is a member of indirectly which is not
blocked by a NOINHERIT attribute of another reachable role; in this case
SET ROLE effectively drops all the privileges assigned directly to the
session user and to the other roles it is a member of, leaving only the
privileges available to the named role.
8<-----------
Thoughts?
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
[application/pgp-signature] signature.asc (832B, ../../03796ce5-8366-cd32-0436-9981ffbeb993@joeconway.com/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* RE: SET ROLE documentation not entirely correct
@ 2019-04-25 15:25 Steven Winfield <Steven.Winfield@cantabcapital.com>
parent: Joe Conway <mail@joeconway.com>
0 siblings, 2 replies; 23+ messages in thread
From: Steven Winfield @ 2019-04-25 15:25 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
> Additionally s/INHERITS/INHERIT/
Good spot.
> The wording should be something like
>
> 8<-----------
> The specified role_name must be a role that the current session user is
> a member of directly or indirectly.
> 8<-----------
That’s certainly much better (perhaps with a comma after “of”, if I’m being pedantic).
> I believe the paragraph you cite should be reworded, but I am at a loss
> as to how best to describe the actual situation clearly. Maybe something
> like:
>
> 8<-----------
> If the session user role has the INHERIT attribute, then it
> automatically has all the privileges of every role that it is a member
> of directly, and any that it is a member of indirectly which is not
> blocked by a NOINHERIT attribute of another reachable role; in this case
> SET ROLE effectively drops all the privileges assigned directly to the
> session user and to the other roles it is a member of, leaving only the
> privileges available to the named role.
> 8<-----------
>
> Thoughts?
Again, that's much clearer than what is currently there. It might help if some of the language/definitions from pg_has_role() is used, though.
For example:
A role X is a "MEMBER" of another role Y if there is a chain of GRANTs from X to Y via zero or more intermediate roles. This allows X to execute "SET ROLE Y".
Additionally X has "USAGE" of Y if X and all the intermediate roles (but *not* necessarily Y) are marked INHERIT. In this case X automatically has the privileges of Y, without the need to "SET ROLE Y".
Just my 2p, but being fairly new to postgres' roles and privilege set-up I can tell you that the things I have found difficult, but important, to get my head around are:
* A role either pulls in all privileges it can (INHERIT) or none at all (NOINHERIT). It is not possible to create a role that all direct members are guaranteed to require, or not require, a "SET ROLE" to use (i.e. you can't mark a role as "inheritable" or "not inheritable")
* A role's attributes are not inherited by its members - SUPERUSER, CREATEROLE, etc. The CREATE ROLE docs refer to these things as both "attributes" and "privileges", which is a bit unhelpful. It would be better to refer to them only as "attributes" everywhere, so it is clear that "attributes" are never inherited whereas "privileges" can be inherited.
* As mentioned above, "X is a member of Y" implies "X can SET ROLE Y". Membership requires a GRANT chain from X to Y.
* Also mentioned above, "X has usage of Y" implies "X doesn't need to SET ROLE Y, other than to use Y's attributes". Usage requires everything apart from Y in the GRANT chain to be marked INHERIT.
Is there the ability to include diagrams or other images in the postgres docs? I think it could really help. Boxes for roles, arrows for membership - pointing from group to member (to show the flow of privileges), with a solid line if the member has INHERIT and a broken line if they have NOINHERIT... that sort of thing.
Steve.
This email is confidential. If you are not the intended recipient, please advise us immediately and delete this message.
The registered name of Cantab- part of GAM Systematic is Cantab Capital Partners LLP.
See - http://www.gam.com/en/Legal/Email+disclosures+EU for further information on confidentiality, the risks of non-secure electronic communication, and certain disclosures which we are required to make in accordance with applicable legislation and regulations.
If you cannot access this link, please notify us by reply message and we will send the contents to you.
GAM Holding AG and its subsidiaries (Cantab – GAM Systematic) will collect and use information about you in the course of your interactions with us.
Full details about the data types we collect and what we use this for and your related rights is set out in our online privacy policy at https://www.gam.com/en/legal/privacy-policy.
Please familiarise yourself with this policy and check it from time to time for updates as it supplements this notice.
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 15:46 Joe Conway <mail@joeconway.com>
parent: Steven Winfield <Steven.Winfield@cantabcapital.com>
1 sibling, 1 reply; 23+ messages in thread
From: Joe Conway @ 2019-04-25 15:46 UTC (permalink / raw)
To: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On 4/25/19 11:25 AM, Steven Winfield wrote:
>> Additionally s/INHERITS/INHERIT/
>
> Good spot.
>
>> The wording should be something like
>>
>> 8<-----------
>> The specified role_name must be a role that the current session user is
>> a member of directly or indirectly.
>> 8<-----------
>
> That’s certainly much better (perhaps with a comma after “of”, if I’m
> being pedantic).
>
>> I believe the paragraph you cite should be reworded, but I am at a loss
>> as to how best to describe the actual situation clearly. Maybe something
>> like:
>>
>> 8<-----------
>> If the session user role has the INHERIT attribute, then it
>> automatically has all the privileges of every role that it is a member
>> of directly, and any that it is a member of indirectly which is not
>> blocked by a NOINHERIT attribute of another reachable role; in this case
>> SET ROLE effectively drops all the privileges assigned directly to the
>> session user and to the other roles it is a member of, leaving only the
>> privileges available to the named role.
>> 8<-----------
>>
>> Thoughts?
>
> Again, that's much clearer than what is currently there. It might help
> if some of the language/definitions from pg_has_role() is used, though.
>
> For example:
> A role X is a "MEMBER" of another role Y if there is a chain of GRANTs
> from X to Y via zero or more intermediate roles. This allows X to
> execute "SET ROLE Y".
> Additionally X has "USAGE" of Y if X and all the intermediate roles (but
> *not* necessarily Y) are marked INHERIT. In this case X automatically
> has the privileges of Y, without the need to "SET ROLE Y".
>
>
> Just my 2p, but being fairly new to postgres' roles and privilege set-up
> I can tell you that the things I have found difficult, but important, to
> get my head around are:
>
> * A role either pulls in all privileges it can (INHERIT) or none at all
> (NOINHERIT). It is not possible to create a role that all direct members
> are guaranteed to require, or not require, a "SET ROLE" to use (i.e. you
> can't mark a role as "inheritable" or "not inheritable")
>
> * A role's attributes are not inherited by its members - SUPERUSER,
> CREATEROLE, etc. The CREATE ROLE docs refer to these things as both
> "attributes" and "privileges", which is a bit unhelpful. It would be
> better to refer to them only as "attributes" everywhere, so it is clear
> that "attributes" are never inherited whereas "privileges" can be inherited.
>
> * As mentioned above, "X is a member of Y" implies "X can SET ROLE Y".
> Membership requires a GRANT chain from X to Y.
>
> * Also mentioned above, "X has usage of Y" implies "X doesn't need to
> SET ROLE Y, other than to use Y's attributes". Usage requires everything
> apart from Y in the GRANT chain to be marked INHERIT.
All good stuff. I will try to take this into account and submit an
actual proposed patch -- hopefully over this weekend.
> Is there the ability to include diagrams or other images in the postgres
> docs? I think it could really help. Boxes for roles, arrows for
> membership - pointing from group to member (to show the flow of
> privileges), with a solid line if the member has INHERIT and a broken
> line if they have NOINHERIT... that sort of thing.
We *just* very recently added the ability to add images. Not sure I want
to attempt creating one for this, but perhaps after I write the patch
you could give it a go with an image to match your thoughts?
By the way, I wrote an extension to aid in sorting this stuff out -- you
might want to have a look:
https://github.com/CrunchyData/crunchy_check_access
Feedback welcomed. Patches even more so ;-)
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
[application/pgp-signature] signature.asc (832B, ../../c7dfb7a9-f9d9-245c-1b8a-4d5c1cea6a00@joeconway.com/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* RE: SET ROLE documentation not entirely correct
@ 2019-04-25 16:39 Steven Winfield <Steven.Winfield@cantabcapital.com>
parent: Joe Conway <mail@joeconway.com>
0 siblings, 1 reply; 23+ messages in thread
From: Steven Winfield @ 2019-04-25 16:39 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
> All good stuff. I will try to take this into account and submit an
> actual proposed patch -- hopefully over this weekend.
Thanks.
> We *just* very recently added the ability to add images. Not sure I want
> to attempt creating one for this, but perhaps after I write the patch
> you could give it a go with an image to match your thoughts?
That's great. Is there a page somewhere with a styling guide - preferred RGB values, fonts, allowable bitmap and/or vector formats... that sort of thing?
> By the way, I wrote an extension to aid in sorting this stuff out -- you
> might want to have a look:
>
> https://github.com/CrunchyData/crunchy_check_access
>
> Feedback welcomed. Patches even more so ;-)
Nice - will definitely have a look.
Steve.
This email is confidential. If you are not the intended recipient, please advise us immediately and delete this message.
The registered name of Cantab- part of GAM Systematic is Cantab Capital Partners LLP.
See - http://www.gam.com/en/Legal/Email+disclosures+EU for further information on confidentiality, the risks of non-secure electronic communication, and certain disclosures which we are required to make in accordance with applicable legislation and regulations.
If you cannot access this link, please notify us by reply message and we will send the contents to you.
GAM Holding AG and its subsidiaries (Cantab – GAM Systematic) will collect and use information about you in the course of your interactions with us.
Full details about the data types we collect and what we use this for and your related rights is set out in our online privacy policy at https://www.gam.com/en/legal/privacy-policy.
Please familiarise yourself with this policy and check it from time to time for updates as it supplements this notice.
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 17:08 Joe Conway <mail@joeconway.com>
parent: Steven Winfield <Steven.Winfield@cantabcapital.com>
0 siblings, 1 reply; 23+ messages in thread
From: Joe Conway @ 2019-04-25 17:08 UTC (permalink / raw)
To: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On 4/25/19 12:39 PM, Steven Winfield wrote:
>> We *just* very recently added the ability to add images. Not sure I want
>> to attempt creating one for this, but perhaps after I write the patch
>> you could give it a go with an image to match your thoughts?
>
> That's great. Is there a page somewhere with a styling guide - preferred
> RGB values, fonts, allowable bitmap and/or vector formats... that sort
> of thing?
There is a documentation style guide (of sorts) here:
https://www.postgresql.org/docs/devel/docguide-style.html
But it has nothing from what I can see to say about images.
FWIW, I believe images need to be svg format, but I am not entirely sure
of that.
There is also nothing I could find quickly searching through the docs
which describes how to insert images into the documentation. There is
one image which can be used as an example though:
https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD
Likely both of those omissions should be fixed...
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
[application/pgp-signature] signature.asc (832B, ../../67c97dbc-9caf-aa7e-622a-e20b28b7e597@joeconway.com/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 17:13 Joe Conway <mail@joeconway.com>
parent: Joe Conway <mail@joeconway.com>
0 siblings, 1 reply; 23+ messages in thread
From: Joe Conway @ 2019-04-25 17:13 UTC (permalink / raw)
To: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On 4/25/19 1:08 PM, Joe Conway wrote:
> There is one image which can be used as an example though:
>
> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD
Here is a more precise URL:
https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD#l934
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
[application/pgp-signature] signature.asc (832B, ../../02e17cb3-f8a9-234f-f3ce-2b80bc49031d@joeconway.com/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 18:33 Tom Lane <tgl@sss.pgh.pa.us>
parent: Joe Conway <mail@joeconway.com>
0 siblings, 1 reply; 23+ messages in thread
From: Tom Lane @ 2019-04-25 18:33 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
Joe Conway <mail@joeconway.com> writes:
> On 4/25/19 1:08 PM, Joe Conway wrote:
>> There is one image which can be used as an example though:
>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD
> Here is a more precise URL:
> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD#l934
Comparing that to what I see at
https://www.postgresql.org/docs/devel/storage-page-layout.html
does not lead to a warm feeling about our images-in-docs stuff
really being ready for prime time. It works OK in some browsers
but others (at least Safari) cut off the image.
regards, tom lane
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 19:06 Stephen Frost <sfrost@snowman.net>
parent: Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 23+ messages in thread
From: Stephen Frost @ 2019-04-25 19:06 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Joe Conway <mail@joeconway.com>; Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
Greetings,
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Joe Conway <mail@joeconway.com> writes:
> > On 4/25/19 1:08 PM, Joe Conway wrote:
> >> There is one image which can be used as an example though:
> >> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD
>
> > Here is a more precise URL:
> > https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD#l934
>
> Comparing that to what I see at
>
> https://www.postgresql.org/docs/devel/storage-page-layout.html
>
> does not lead to a warm feeling about our images-in-docs stuff
> really being ready for prime time. It works OK in some browsers
> but others (at least Safari) cut off the image.
Yeah, I'm seeing it cut off in Chrome too, initially, and then it seems
to fix itself if I resize the window down from 4k (and stay fixed even
if I then go back to the original, much larger, size). That seems like
a CSS or layout issue though, not an issue with the image itself..?
Thanks!
Stephen
Attachments:
[application/pgp-signature] signature.asc (818B, ../../20190425190626.GY6197@tamriel.snowman.net/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 19:20 Joe Conway <mail@joeconway.com>
parent: Stephen Frost <sfrost@snowman.net>
0 siblings, 1 reply; 23+ messages in thread
From: Joe Conway @ 2019-04-25 19:20 UTC (permalink / raw)
To: Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 3:06 PM, Stephen Frost wrote:
> Greetings,
>
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> Joe Conway <mail@joeconway.com> writes:
>> > On 4/25/19 1:08 PM, Joe Conway wrote:
>> >> There is one image which can be used as an example though:
>> >> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD
>>
>> > Here is a more precise URL:
>> > https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD#l934
>>
>> Comparing that to what I see at
>>
>> https://www.postgresql.org/docs/devel/storage-page-layout.html
>>
>> does not lead to a warm feeling about our images-in-docs stuff
>> really being ready for prime time. It works OK in some browsers
>> but others (at least Safari) cut off the image.
>
> Yeah, I'm seeing it cut off in Chrome too, initially, and then it seems
> to fix itself if I resize the window down from 4k (and stay fixed even
> if I then go back to the original, much larger, size). That seems like
> a CSS or layout issue though, not an issue with the image itself..?
Yeah, I see the same thing in Chrome -- maybe Jonathan has an idea what
is going on and how to best fix it?
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
[application/pgp-signature] signature.asc (832B, ../../97c6e8d5-7e51-5cd2-4fc2-652ad02659d9@joeconway.com/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 20:52 Jonathan S. Katz <jkatz@postgresql.org>
parent: Joe Conway <mail@joeconway.com>
0 siblings, 1 reply; 23+ messages in thread
From: Jonathan S. Katz @ 2019-04-25 20:52 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 3:20 PM, Joe Conway wrote:
> On 4/25/19 3:06 PM, Stephen Frost wrote:
>> Greetings,
>>
>> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>>> Joe Conway <mail@joeconway.com> writes:
>>>> On 4/25/19 1:08 PM, Joe Conway wrote:
>>>>> There is one image which can be used as an example though:
>>>>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD
>>>
>>>> Here is a more precise URL:
>>>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD#l934
>>>
>>> Comparing that to what I see at
>>>
>>> https://www.postgresql.org/docs/devel/storage-page-layout.html
>>>
>>> does not lead to a warm feeling about our images-in-docs stuff
>>> really being ready for prime time. It works OK in some browsers
>>> but others (at least Safari) cut off the image.
>>
>> Yeah, I'm seeing it cut off in Chrome too, initially, and then it seems
>> to fix itself if I resize the window down from 4k (and stay fixed even
>> if I then go back to the original, much larger, size). That seems like
>> a CSS or layout issue though, not an issue with the image itself..?
>
>
> Yeah, I see the same thing in Chrome -- maybe Jonathan has an idea what
> is going on and how to best fix it?
See[1] - I'm not sure if the final piece is committed -- if when it is I
can finish fixing the pgweb part.
Jonathan
[1]
https://www.postgresql.org/message-id/flat/6d2442d1-84a2-36ef-e014-b6d1ece8a139%40postgresql.org
Attachments:
[application/pgp-signature] signature.asc (832B, ../../eb139a20-811b-91ed-fbe3-00968c614425@postgresql.org/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 21:22 Jonathan S. Katz <jkatz@postgresql.org>
parent: Jonathan S. Katz <jkatz@postgresql.org>
0 siblings, 2 replies; 23+ messages in thread
From: Jonathan S. Katz @ 2019-04-25 21:22 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 4:52 PM, Jonathan S. Katz wrote:
> On 4/25/19 3:20 PM, Joe Conway wrote:
>> On 4/25/19 3:06 PM, Stephen Frost wrote:
>>> Greetings,
>>>
>>> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>>>> Joe Conway <mail@joeconway.com> writes:
>>>>> On 4/25/19 1:08 PM, Joe Conway wrote:
>>>>>> There is one image which can be used as an example though:
>>>>>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD
>>>>
>>>>> Here is a more precise URL:
>>>>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD#l934
>>>>
>>>> Comparing that to what I see at
>>>>
>>>> https://www.postgresql.org/docs/devel/storage-page-layout.html
>>>>
>>>> does not lead to a warm feeling about our images-in-docs stuff
>>>> really being ready for prime time. It works OK in some browsers
>>>> but others (at least Safari) cut off the image.
>>>
>>> Yeah, I'm seeing it cut off in Chrome too, initially, and then it seems
>>> to fix itself if I resize the window down from 4k (and stay fixed even
>>> if I then go back to the original, much larger, size). That seems like
>>> a CSS or layout issue though, not an issue with the image itself..?
>>
>>
>> Yeah, I see the same thing in Chrome -- maybe Jonathan has an idea what
>> is going on and how to best fix it?
>
> See[1] - I'm not sure if the final piece is committed -- if when it is I
> can finish fixing the pgweb part
OK, so I took a quick look at the existing SVGs with my patched version
of pgweb.
The short answer is that it's better: the SVGs are not responsive, but
they are displaying. There still needs to be work on the SVGs as
indicated in that thread to make them responsive[1].
With that said, the pgweb patch does fix their current display at least
in full view, so I pushed the current patch to pgweb to do that. The fix
will take effect the next time the nightly docload runs, or if someone
on pginfra forces it to occur more quickly.
Thanks,
Jonathan
[1]
https://www.postgresql.org/message-id/flat/6d2442d1-84a2-36ef-e014-b6d1ece8a139%40postgresql.org
Attachments:
[application/pgp-signature] signature.asc (832B, ../../6bd15afe-69ea-33b7-379a-f71fda68b427@postgresql.org/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 21:26 Joe Conway <mail@joeconway.com>
parent: Jonathan S. Katz <jkatz@postgresql.org>
1 sibling, 1 reply; 23+ messages in thread
From: Joe Conway @ 2019-04-25 21:26 UTC (permalink / raw)
To: Jonathan S. Katz <jkatz@postgresql.org>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 5:22 PM, Jonathan S. Katz wrote:
> On 4/25/19 4:52 PM, Jonathan S. Katz wrote:
>> On 4/25/19 3:20 PM, Joe Conway wrote:
>>> On 4/25/19 3:06 PM, Stephen Frost wrote:
>>>> Yeah, I'm seeing it cut off in Chrome too, initially, and then it seems
>>>> to fix itself if I resize the window down from 4k (and stay fixed even
>>>> if I then go back to the original, much larger, size). That seems like
>>>> a CSS or layout issue though, not an issue with the image itself..?
>>>
>>> Yeah, I see the same thing in Chrome -- maybe Jonathan has an idea what
>>> is going on and how to best fix it?
>>
>> See[1] - I'm not sure if the final piece is committed -- if when it is I
>> can finish fixing the pgweb part
> OK, so I took a quick look at the existing SVGs with my patched version
> of pgweb.
>
> The short answer is that it's better: the SVGs are not responsive, but
> they are displaying. There still needs to be work on the SVGs as
> indicated in that thread to make them responsive[1].
> [1]
> https://www.postgresql.org/message-id/flat/6d2442d1-84a2-36ef-e014-b6d1ece8a139%40postgresql.org
Is there any written instruction anywhere with guidance on how the SVGs
should be made?
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 21:58 Jonathan S. Katz <jkatz@postgresql.org>
parent: Jonathan S. Katz <jkatz@postgresql.org>
1 sibling, 1 reply; 23+ messages in thread
From: Jonathan S. Katz @ 2019-04-25 21:58 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 5:22 PM, Jonathan S. Katz wrote:
> On 4/25/19 4:52 PM, Jonathan S. Katz wrote:
>> On 4/25/19 3:20 PM, Joe Conway wrote:
>>> On 4/25/19 3:06 PM, Stephen Frost wrote:
>>>> Greetings,
>>>>
>>>> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>>>>> Joe Conway <mail@joeconway.com> writes:
>>>>>> On 4/25/19 1:08 PM, Joe Conway wrote:
>>>>>>> There is one image which can be used as an example though:
>>>>>>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD
>>>>>
>>>>>> Here is a more precise URL:
>>>>>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/storage.sgml;hb=HEAD#l934
>>>>>
>>>>> Comparing that to what I see at
>>>>>
>>>>> https://www.postgresql.org/docs/devel/storage-page-layout.html
>>>>>
>>>>> does not lead to a warm feeling about our images-in-docs stuff
>>>>> really being ready for prime time. It works OK in some browsers
>>>>> but others (at least Safari) cut off the image.
>>>>
>>>> Yeah, I'm seeing it cut off in Chrome too, initially, and then it seems
>>>> to fix itself if I resize the window down from 4k (and stay fixed even
>>>> if I then go back to the original, much larger, size). That seems like
>>>> a CSS or layout issue though, not an issue with the image itself..?
>>>
>>>
>>> Yeah, I see the same thing in Chrome -- maybe Jonathan has an idea what
>>> is going on and how to best fix it?
>>
>> See[1] - I'm not sure if the final piece is committed -- if when it is I
>> can finish fixing the pgweb part
> OK, so I took a quick look at the existing SVGs with my patched version
> of pgweb.
>
> The short answer is that it's better: the SVGs are not responsive, but
> they are displaying. There still needs to be work on the SVGs as
> indicated in that thread to make them responsive[1].
>
> With that said, the pgweb patch does fix their current display at least
> in full view, so I pushed the current patch to pgweb to do that. The fix
> will take effect the next time the nightly docload runs, or if someone
> on pginfra forces it to occur more quickly.
Good news - I did test against an older snapshot. With a newer snapshot,
the SVG on the GIN implementation page[1] is responsive but not the one
on the storage page layout[2], which is what the proposed fix in the
other thread handles.
Jonathan
[1] https://www.postgresql.org/docs/devel/gin-implementation.html
[2] https://www.postgresql.org/docs/devel/storage-page-layout.html
Attachments:
[application/pgp-signature] signature.asc (832B, ../../627584c3-d4fe-7a04-feb5-210b08642284@postgresql.org/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 21:59 Jonathan S. Katz <jkatz@postgresql.org>
parent: Joe Conway <mail@joeconway.com>
0 siblings, 1 reply; 23+ messages in thread
From: Jonathan S. Katz @ 2019-04-25 21:59 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 5:26 PM, Joe Conway wrote:
>
> Is there any written instruction anywhere with guidance on how the SVGs
> should be made?
https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/images/README;
but I would suggest we had some guidance on how to ensure the image
stays scalable.
Jonathan
Attachments:
[application/pgp-signature] signature.asc (832B, ../../0a062c73-68e7-9890-ab68-cd3e50842df0@postgresql.org/2-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-25 22:54 Joe Conway <mail@joeconway.com>
parent: Jonathan S. Katz <jkatz@postgresql.org>
0 siblings, 1 reply; 23+ messages in thread
From: Joe Conway @ 2019-04-25 22:54 UTC (permalink / raw)
To: Jonathan S. Katz <jkatz@postgresql.org>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 5:59 PM, Jonathan S. Katz wrote:
> On 4/25/19 5:26 PM, Joe Conway wrote:
>>
>> Is there any written instruction anywhere with guidance on how the SVGs
>> should be made?
>
> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/images/README;
Awesome -- that is what I had been looking for. Shouldn't we add that to
the actual documentation style guide?
> but I would suggest we had some guidance on how to ensure the image
> stays scalable.
Since you seem to know the magic incarnations, can you propose some words?
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-26 19:04 Jonathan S. Katz <jkatz@postgresql.org>
parent: Joe Conway <mail@joeconway.com>
0 siblings, 1 reply; 23+ messages in thread
From: Jonathan S. Katz @ 2019-04-26 19:04 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 6:54 PM, Joe Conway wrote:
> On 4/25/19 5:59 PM, Jonathan S. Katz wrote:
>> On 4/25/19 5:26 PM, Joe Conway wrote:
>>>
>>> Is there any written instruction anywhere with guidance on how the SVGs
>>> should be made?
>>
>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/images/README;
>
> Awesome -- that is what I had been looking for. Shouldn't we add that to
> the actual documentation style guide?
>
>> but I would suggest we had some guidance on how to ensure the image
>> stays scalable.
>
> Since you seem to know the magic incarnations, can you propose some words?
Please see attached.
Jonathan
diff --git a/doc/src/sgml/images/README b/doc/src/sgml/images/README
index dd29486a09..81b426c066 100644
--- a/doc/src/sgml/images/README
+++ b/doc/src/sgml/images/README
@@ -59,3 +59,10 @@ Notes:
- The width should be set to something. This ensures that the image
is scaled to fit the page in PDF output. (Other widths than 100%
might be appropriate.)
+
+- SVG images should be scalable as they will be rendered in a variety
+ of places (web, PDF, etc.) as well as in different viewports
+ (desktop, mobile, etc.). To help the images successfully scale,
+ please employe a "viewBox" attribute in the svg tag. For example,
+ to set an image to contain a default width and heigh of 400x300,
+ you would use viewBox="0.00 0.00 400.00 300.00"
Attachments:
[text/plain] viewBox.patch (754B, ../../dc5b0391-ad27-4738-7942-50bf3fbd8523@postgresql.org/2-viewBox.patch)
download | inline diff:
diff --git a/doc/src/sgml/images/README b/doc/src/sgml/images/README
index dd29486a09..81b426c066 100644
--- a/doc/src/sgml/images/README
+++ b/doc/src/sgml/images/README
@@ -59,3 +59,10 @@ Notes:
- The width should be set to something. This ensures that the image
is scaled to fit the page in PDF output. (Other widths than 100%
might be appropriate.)
+
+- SVG images should be scalable as they will be rendered in a variety
+ of places (web, PDF, etc.) as well as in different viewports
+ (desktop, mobile, etc.). To help the images successfully scale,
+ please employe a "viewBox" attribute in the svg tag. For example,
+ to set an image to contain a default width and heigh of 400x300,
+ you would use viewBox="0.00 0.00 400.00 300.00"
[application/pgp-signature] signature.asc (832B, ../../dc5b0391-ad27-4738-7942-50bf3fbd8523@postgresql.org/3-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-26 19:14 Jonathan S. Katz <jkatz@postgresql.org>
parent: Jonathan S. Katz <jkatz@postgresql.org>
0 siblings, 1 reply; 23+ messages in thread
From: Jonathan S. Katz @ 2019-04-26 19:14 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/26/19 3:04 PM, Jonathan S. Katz wrote:
> On 4/25/19 6:54 PM, Joe Conway wrote:
>> On 4/25/19 5:59 PM, Jonathan S. Katz wrote:
>>> On 4/25/19 5:26 PM, Joe Conway wrote:
>>>>
>>>> Is there any written instruction anywhere with guidance on how the SVGs
>>>> should be made?
>>>
>>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/images/README;
>>
>> Awesome -- that is what I had been looking for. Shouldn't we add that to
>> the actual documentation style guide?
>>
>>> but I would suggest we had some guidance on how to ensure the image
>>> stays scalable.
>>
>> Since you seem to know the magic incarnations, can you propose some words?
>
> Please see attached.
v2 -- fixed typo in height, and modified some of the language.
Jonathan
diff --git a/doc/src/sgml/images/README b/doc/src/sgml/images/README
index dd29486a09..089375c485 100644
--- a/doc/src/sgml/images/README
+++ b/doc/src/sgml/images/README
@@ -59,3 +59,10 @@ Notes:
- The width should be set to something. This ensures that the image
is scaled to fit the page in PDF output. (Other widths than 100%
might be appropriate.)
+
+- SVG images should be scalable as they will be rendered in a variety
+ of places (web, PDF, etc.) as well as in different viewports
+ (desktop, mobile, etc.). To help the images successfully scale,
+ please employe a "viewBox" attribute in the svg tag. For example,
+ to create with a default width and height of 400x300, you would use
+ viewBox="0.00 0.00 400.00 300.00"
Attachments:
[text/plain] viewBox-v2.patch (743B, ../../6358ae6f-7191-a02b-e7b5-68050636ae71@postgresql.org/2-viewBox-v2.patch)
download | inline diff:
diff --git a/doc/src/sgml/images/README b/doc/src/sgml/images/README
index dd29486a09..089375c485 100644
--- a/doc/src/sgml/images/README
+++ b/doc/src/sgml/images/README
@@ -59,3 +59,10 @@ Notes:
- The width should be set to something. This ensures that the image
is scaled to fit the page in PDF output. (Other widths than 100%
might be appropriate.)
+
+- SVG images should be scalable as they will be rendered in a variety
+ of places (web, PDF, etc.) as well as in different viewports
+ (desktop, mobile, etc.). To help the images successfully scale,
+ please employe a "viewBox" attribute in the svg tag. For example,
+ to create with a default width and height of 400x300, you would use
+ viewBox="0.00 0.00 400.00 300.00"
[application/pgp-signature] signature.asc (832B, ../../6358ae6f-7191-a02b-e7b5-68050636ae71@postgresql.org/3-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-27 15:14 Joe Conway <mail@joeconway.com>
parent: Jonathan S. Katz <jkatz@postgresql.org>
0 siblings, 0 replies; 23+ messages in thread
From: Joe Conway @ 2019-04-27 15:14 UTC (permalink / raw)
To: Jonathan S. Katz <jkatz@postgresql.org>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/26/19 3:14 PM, Jonathan S. Katz wrote:
> On 4/26/19 3:04 PM, Jonathan S. Katz wrote:
>> On 4/25/19 6:54 PM, Joe Conway wrote:
>>> On 4/25/19 5:59 PM, Jonathan S. Katz wrote:
>>>> On 4/25/19 5:26 PM, Joe Conway wrote:
>>>>>
>>>>> Is there any written instruction anywhere with guidance on how the SVGs
>>>>> should be made?
>>>>
>>>> https://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=doc/src/sgml/images/README;
>>>
>>> Awesome -- that is what I had been looking for. Shouldn't we add that to
>>> the actual documentation style guide?
>>>
>>>> but I would suggest we had some guidance on how to ensure the image
>>>> stays scalable.
>>>
>>> Since you seem to know the magic incarnations, can you propose some words?
>>
>> Please see attached.
>
> v2 -- fixed typo in height, and modified some of the language.
Pushed with a bit of editorialization.
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-27 15:38 Joe Conway <mail@joeconway.com>
parent: Jonathan S. Katz <jkatz@postgresql.org>
0 siblings, 0 replies; 23+ messages in thread
From: Joe Conway @ 2019-04-27 15:38 UTC (permalink / raw)
To: Jonathan S. Katz <jkatz@postgresql.org>; Stephen Frost <sfrost@snowman.net>; Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>; Jonathan S. Katz <jonathan.katz@excoventures.com>
On 4/25/19 5:58 PM, Jonathan S. Katz wrote:
> Good news - I did test against an older snapshot. With a newer snapshot,
> the SVG on the GIN implementation page[1] is responsive but not the one
> on the storage page layout[2], which is what the proposed fix in the
> other thread handles.
> [2] https://www.postgresql.org/docs/devel/storage-page-layout.html
I pushed that change too.
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-04-27 20:02 Joe Conway <mail@joeconway.com>
parent: Steven Winfield <Steven.Winfield@cantabcapital.com>
1 sibling, 2 replies; 23+ messages in thread
From: Joe Conway @ 2019-04-27 20:02 UTC (permalink / raw)
To: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On 4/25/19 11:25 AM, Steven Winfield wrote:
> Again, that's much clearer than what is currently there. It might help
> if some of the language/definitions from pg_has_role() is used, though.
>
> For example:
> A role X is a "MEMBER" of another role Y if there is a chain of GRANTs
> from X to Y via zero or more intermediate roles. This allows X to
> execute "SET ROLE Y".
> Additionally X has "USAGE" of Y if X and all the intermediate roles (but
> *not* necessarily Y) are marked INHERIT. In this case X automatically
> has the privileges of Y, without the need to "SET ROLE Y".
I've been whacking this around for the better part of the afternoon and
came up with the attached. I think it is correct, and better than my
previous proposal, but possibly need more polish. Comments welcome.
> * A role's attributes are not inherited by its members - SUPERUSER,
> CREATEROLE, etc. The CREATE ROLE docs refer to these things as both
> "attributes" and "privileges", which is a bit unhelpful. It would be
> better to refer to them only as "attributes" everywhere, so it is clear
> that "attributes" are never inherited whereas "privileges" can be inherited.
Sounds reasonable but probably a separate patch.
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
[text/x-patch] set-role-docs-00.diff (3.2K, ../../c02a61b1-3daf-672c-f750-4198bb312445@joeconway.com/2-set-role-docs-00.diff)
download | inline diff:
diff --git a/doc/src/sgml/ref/set_role.sgml b/doc/src/sgml/ref/set_role.sgml
index 0ef6eb9..d219a1e 100644
*** a/doc/src/sgml/ref/set_role.sgml
--- b/doc/src/sgml/ref/set_role.sgml
*************** RESET ROLE
*** 42,48 ****
<para>
The specified <replaceable class="parameter">role_name</replaceable>
! must be a role that the current session user is a member of.
(If the session user is a superuser, any role can be selected.)
</para>
--- 42,48 ----
<para>
The specified <replaceable class="parameter">role_name</replaceable>
! must be a role that the current session user is a <literal>MEMBER</literal> of.
(If the session user is a superuser, any role can be selected.)
</para>
*************** RESET ROLE
*** 63,78 ****
<title>Notes</title>
<para>
! Using this command, it is possible to either add privileges or restrict
! one's privileges. If the session user role has the <literal>INHERITS</literal>
! attribute, then it automatically has all the privileges of every role that
! it could <command>SET ROLE</command> to; in this case <command>SET ROLE</command>
! effectively drops all the privileges assigned directly to the session user
! and to the other roles it is a member of, leaving only the privileges
! available to the named role. On the other hand, if the session user role
! has the <literal>NOINHERITS</literal> attribute, <command>SET ROLE</command> drops the
! privileges assigned directly to the session user and instead acquires the
! privileges available to the named role.
</para>
<para>
--- 63,94 ----
<title>Notes</title>
<para>
! Role "X" is a <literal>MEMBER</literal> of role "Y" if there is a chain of
! grants between them. Additionally, role "X" has <literal>USAGE</literal>
! of "Y", if "X", and all intermediate roles (but not necessarily "Y" itself),
! are marked with the <literal>INHERIT</literal> attribute (which is the default).
! See the <link linkend="functions-info"><function>pg_has_role()</function>
! </link> for more information.
! </para>
!
! <para>
! Every role automatically has all the privileges it has been granted directly,
! as well as that of every role with which it has <literal>USAGE</literal>.
! However role attributes (as defined by <command>CREATE ROLE</command> or
! <command>ALTER ROLE</command>) are not directly acquired from other roles.
! Role attributes may only be gained via the <command>SET ROLE</command> command.
! </para>
!
! <para>
! The <command>SET ROLE</command> command drops all privileges assigned directly
! to the session user and instead acquires the privileges available to the target
! role, including any roles for which the target has <literal>USAGE</literal>.
! The net effect is that the <command>SET ROLE</command> command may either add
! privileges or restrict privileges. When the session role has
! <literal>USAGE</literal> on the target role, the remaining privileges will be
! equal to, or a subset of, the original privileges. On the other hand,
! when the session role does not have <literal>USAGE</literal> on the target
! role, the privileges may be completely different, and possibly expanded.
</para>
<para>
[application/pgp-signature] signature.asc (832B, ../../c02a61b1-3daf-672c-f750-4198bb312445@joeconway.com/3-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
* RE: SET ROLE documentation not entirely correct
@ 2019-05-01 15:07 Steven Winfield <Steven.Winfield@cantabcapital.com>
parent: Joe Conway <mail@joeconway.com>
1 sibling, 0 replies; 23+ messages in thread
From: Steven Winfield @ 2019-05-01 15:07 UTC (permalink / raw)
To: Joe Conway <mail@joeconway.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
> I've been whacking this around for the better part of the afternoon and
> came up with the attached. I think it is correct, and better than my
> previous proposal, but possibly need more polish. Comments welcome.
FWIW it looks good to me!
Steve.
This email is confidential. If you are not the intended recipient, please advise us immediately and delete this message.
The registered name of Cantab- part of GAM Systematic is Cantab Capital Partners LLP.
See - http://www.gam.com/en/Legal/Email+disclosures+EU for further information on confidentiality, the risks of non-secure electronic communication, and certain disclosures which we are required to make in accordance with applicable legislation and regulations.
If you cannot access this link, please notify us by reply message and we will send the contents to you.
GAM Holding AG and its subsidiaries (Cantab – GAM Systematic) will collect and use information about you in the course of your interactions with us.
Full details about the data types we collect and what we use this for and your related rights is set out in our online privacy policy at https://www.gam.com/en/legal/privacy-policy.
Please familiarise yourself with this policy and check it from time to time for updates as it supplements this notice.
^ permalink raw reply [nested|flat] 23+ messages in thread
* Re: SET ROLE documentation not entirely correct
@ 2019-08-01 18:48 Joe Conway <mail@joeconway.com>
parent: Joe Conway <mail@joeconway.com>
1 sibling, 0 replies; 23+ messages in thread
From: Joe Conway @ 2019-08-01 18:48 UTC (permalink / raw)
To: Steven Winfield <Steven.Winfield@cantabcapital.com>; pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On 4/27/19 4:02 PM, Joe Conway wrote:
> On 4/25/19 11:25 AM, Steven Winfield wrote:
>> Again, that's much clearer than what is currently there. It might help
>> if some of the language/definitions from pg_has_role() is used, though.
>>
>> For example:
>> A role X is a "MEMBER" of another role Y if there is a chain of GRANTs
>> from X to Y via zero or more intermediate roles. This allows X to
>> execute "SET ROLE Y".
>> Additionally X has "USAGE" of Y if X and all the intermediate roles (but
>> *not* necessarily Y) are marked INHERIT. In this case X automatically
>> has the privileges of Y, without the need to "SET ROLE Y".
>
> I've been whacking this around for the better part of the afternoon and
> came up with the attached. I think it is correct, and better than my
> previous proposal, but possibly need more polish. Comments welcome.
I've been sitting on this change a while and want to get it pushed.
Steven Winfield seemed happy with it -- any other comments before I
commit? Also this seems like it ought to be back-patched, but any
thoughts on that?
Thanks,
Joe
--
Crunchy Data - http://crunchydata.com
PostgreSQL Support for Secure Enterprises
Consulting, Training, & Open Source Development
Attachments:
[text/x-patch] set-role-docs-00.diff (3.2K, ../../95864cbc-4548-2cc5-86de-2a41641ee9d1@joeconway.com/2-set-role-docs-00.diff)
download | inline diff:
diff --git a/doc/src/sgml/ref/set_role.sgml b/doc/src/sgml/ref/set_role.sgml
index 0ef6eb9..d219a1e 100644
*** a/doc/src/sgml/ref/set_role.sgml
--- b/doc/src/sgml/ref/set_role.sgml
*************** RESET ROLE
*** 42,48 ****
<para>
The specified <replaceable class="parameter">role_name</replaceable>
! must be a role that the current session user is a member of.
(If the session user is a superuser, any role can be selected.)
</para>
--- 42,48 ----
<para>
The specified <replaceable class="parameter">role_name</replaceable>
! must be a role that the current session user is a <literal>MEMBER</literal> of.
(If the session user is a superuser, any role can be selected.)
</para>
*************** RESET ROLE
*** 63,78 ****
<title>Notes</title>
<para>
! Using this command, it is possible to either add privileges or restrict
! one's privileges. If the session user role has the <literal>INHERITS</literal>
! attribute, then it automatically has all the privileges of every role that
! it could <command>SET ROLE</command> to; in this case <command>SET ROLE</command>
! effectively drops all the privileges assigned directly to the session user
! and to the other roles it is a member of, leaving only the privileges
! available to the named role. On the other hand, if the session user role
! has the <literal>NOINHERITS</literal> attribute, <command>SET ROLE</command> drops the
! privileges assigned directly to the session user and instead acquires the
! privileges available to the named role.
</para>
<para>
--- 63,94 ----
<title>Notes</title>
<para>
! Role "X" is a <literal>MEMBER</literal> of role "Y" if there is a chain of
! grants between them. Additionally, role "X" has <literal>USAGE</literal>
! of "Y", if "X", and all intermediate roles (but not necessarily "Y" itself),
! are marked with the <literal>INHERIT</literal> attribute (which is the default).
! See the <link linkend="functions-info"><function>pg_has_role()</function>
! </link> for more information.
! </para>
!
! <para>
! Every role automatically has all the privileges it has been granted directly,
! as well as that of every role with which it has <literal>USAGE</literal>.
! However role attributes (as defined by <command>CREATE ROLE</command> or
! <command>ALTER ROLE</command>) are not directly acquired from other roles.
! Role attributes may only be gained via the <command>SET ROLE</command> command.
! </para>
!
! <para>
! The <command>SET ROLE</command> command drops all privileges assigned directly
! to the session user and instead acquires the privileges available to the target
! role, including any roles for which the target has <literal>USAGE</literal>.
! The net effect is that the <command>SET ROLE</command> command may either add
! privileges or restrict privileges. When the session role has
! <literal>USAGE</literal> on the target role, the remaining privileges will be
! equal to, or a subset of, the original privileges. On the other hand,
! when the session role does not have <literal>USAGE</literal> on the target
! role, the privileges may be completely different, and possibly expanded.
</para>
<para>
[application/pgp-signature] signature.asc (832B, ../../95864cbc-4548-2cc5-86de-2a41641ee9d1@joeconway.com/3-signature.asc)
download
^ permalink raw reply [nested|flat] 23+ messages in thread
end of thread, other threads:[~2019-08-01 18:48 UTC | newest]
Thread overview: 23+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2019-04-23 15:52 SET ROLE documentation not entirely correct PG Doc comments form <noreply@postgresql.org>
2019-04-24 19:23 ` Joe Conway <mail@joeconway.com>
2019-04-25 15:25 ` Steven Winfield <Steven.Winfield@cantabcapital.com>
2019-04-25 15:46 ` Joe Conway <mail@joeconway.com>
2019-04-25 16:39 ` Steven Winfield <Steven.Winfield@cantabcapital.com>
2019-04-25 17:08 ` Joe Conway <mail@joeconway.com>
2019-04-25 17:13 ` Joe Conway <mail@joeconway.com>
2019-04-25 18:33 ` Tom Lane <tgl@sss.pgh.pa.us>
2019-04-25 19:06 ` Stephen Frost <sfrost@snowman.net>
2019-04-25 19:20 ` Joe Conway <mail@joeconway.com>
2019-04-25 20:52 ` Jonathan S. Katz <jkatz@postgresql.org>
2019-04-25 21:22 ` Jonathan S. Katz <jkatz@postgresql.org>
2019-04-25 21:26 ` Joe Conway <mail@joeconway.com>
2019-04-25 21:59 ` Jonathan S. Katz <jkatz@postgresql.org>
2019-04-25 22:54 ` Joe Conway <mail@joeconway.com>
2019-04-26 19:04 ` Jonathan S. Katz <jkatz@postgresql.org>
2019-04-26 19:14 ` Jonathan S. Katz <jkatz@postgresql.org>
2019-04-27 15:14 ` Joe Conway <mail@joeconway.com>
2019-04-25 21:58 ` Jonathan S. Katz <jkatz@postgresql.org>
2019-04-27 15:38 ` Joe Conway <mail@joeconway.com>
2019-04-27 20:02 ` Joe Conway <mail@joeconway.com>
2019-05-01 15:07 ` Steven Winfield <Steven.Winfield@cantabcapital.com>
2019-08-01 18:48 ` Joe Conway <mail@joeconway.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox