From: Tom Lane <tgl@sss.pgh.pa.us>
To: shen@oneshen.com
Cc: pgsql-docs@lists.postgresql.org
Subject: Re: CREATEROLE Inheritance
Date: Tue, 18 Jul 2023 14:27:06 -0400
Message-ID: <74948.1689704826@sss.pgh.pa.us> (raw)
In-Reply-To: <168968649532.632.17678694767510635173@wrigleys.postgresql.org>
References: <168968649532.632.17678694767510635173@wrigleys.postgresql.org>
PG Doc comments form <noreply@postgresql.org> writes:
> I have checked this for CREATEROLE and this role attribute is definitely
> inheritable.
Does not look like that to me:
regression=# create user alice createrole;
CREATE ROLE
regression=# create user bob;
CREATE ROLE
regression=# \c - alice
You are now connected to database "regression" as user "alice".
regression=> create user charlie; -- should succeed
CREATE ROLE
regression=> \c - bob
You are now connected to database "regression" as user "bob".
regression=> create user delta; -- should fail
ERROR: permission denied to create role
DETAIL: Only roles with the CREATEROLE attribute may create roles.
regression=> \c - postgres
You are now connected to database "regression" as user "postgres".
regression=# grant alice to bob;
GRANT ROLE
regression=# \c - bob
You are now connected to database "regression" as user "bob".
regression=> create user delta; -- still fails
ERROR: permission denied to create role
DETAIL: Only roles with the CREATEROLE attribute may create roles.
regression=> set role alice;
SET
regression=> create user delta; -- now it works
CREATE ROLE
(Those DETAIL messages are fairly new, but the behavior is the same
in older branches.) The point is precisely that bob can't make
use of alice's CREATEROLE bit without having done SET ROLE.
It's not too clear to me what you did that led you to conclude
otherwise, but going through additional layers like an IDE could
well be confusing matters.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: tgl@sss.pgh.pa.us, shen@oneshen.com, pgsql-docs@lists.postgresql.org
Subject: Re: CREATEROLE Inheritance
In-Reply-To: <74948.1689704826@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox