Message-ID: <93e0bf53-41ae-4718-a1c5-cec36283bbc7@dbi-services.com>
Date: Wed, 18 Oct 2023 09:05:18 +0200
User-Agent: Mozilla Thunderbird
Content-Language: en-US
From: Daniel Westermann <daniel.westermann@dbi-services.com>
Subject: docs: set role permission checking, do I read this wrong?
To: pgsql-docs@lists.postgresql.org
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?WEczRXg2bi9rbGhiaFVlVEVzMDM1QUpDZldjM3owMlY2ZHpONzRsVFdNR011?=
 =?utf-8?B?SkZjbkRkTVhFRXRCaFdwczM1ZHpYK2JweDNJbU8yNkd6YVAwdzdmSFhpWTlo?=
 =?utf-8?B?MWYxekk4dDNyREx6SzFuZS9Rc01DTFQrOGJGTVl0Qk03WXphZjFma0dDYnlD?=
 =?utf-8?B?NWJyd2J5czFVNHh5RmtkS2hwY1VOZlhBVDVzZWFKYTJOc1g0UVlZWHE4L1Ur?=
 =?utf-8?B?ODlMU1RXQzVkSWRrZXMyQ0xMSzl0VEVsakdpYzVMRjV2QysvNjVQVHhEc0l0?=
 =?utf-8?B?SEc3MWpTRlljbGF4ek9PMXhmd2FWd1hGYy94bERWSUJ0UFpFNG90b28xNnVU?=
 =?utf-8?B?QWVCUE96dlRYajdUMGhyRDVtcFpha3g3R1pZMHJZdnEvd0kwdXdodi83OUJT?=
 =?utf-8?B?Y1ZKandmRktZM0V0dTNNSTFqZWVtRHlITVRESWFFTThGMkdvODF5OFJGODZn?=
 =?utf-8?B?NFVpUjRCYmpzQkR4bEsxQkw0blNCM0JIZkRXZWN3YUgwMFQxMFBrODdLblJs?=
 =?utf-8?B?d1k4WGw2TjZ6ZXNZVG9LSzFqL094b1RySmZHcHU4ZEx6cjNUZnZNRW9DRkpY?=
 =?utf-8?B?ZHhFTm1IRGtYcXZtRlFCYjdOSG45Y3RXbjVsKzlSNjRJcXBQS2FlNStueU5u?=
 =?utf-8?B?Y1ZSeEEwQ3RSRVVycmc0U0N0WVRGUFdrcFAyUG4xcjlZdG9qaTkzdUxBZlpv?=
 =?utf-8?B?Y2hMcDBaRmt1RkwvSExtcmtJRk11dmRZdUI3bjlpTkRKdi9TMUY3VXlDSzhM?=
 =?utf-8?B?REVESVRrRHhTVWpHNWdYYzB5cHhQME45V2tpVU94Q0dERmFzYXQydU9kS3h5?=
 =?utf-8?B?d1JGMkZrWTk1Z3BrLzdwZytySjcrTEpMMzV2OThJZ1BhcUZxK2VSUy9laUpP?=
 =?utf-8?B?V1VlSVFYcVM4bEpqTFhsRzM3bnVOeVBTN2NBb1EzNUt2MXR5RG1vbGZSYkZG?=
 =?utf-8?B?Q1JZYXN0cUJxZWpDYmg4RzI5QzdWZlBBSWdJekNyemcyc21IVnc4SURHZEhp?=
 =?utf-8?B?UzJaN2tNd0hsNGd0WlM0bCtNR0pva25OZ2g3eWhlc2lRRVJZcno0am92YXIw?=
 =?utf-8?B?a3FKOHpWeldtRDlpU25RYlpqaFVRdXc2aG5rR2Fpbk5vYWZqUlRrTDFyVTgr?=
 =?utf-8?B?cTcvZURlUFd4aldmeDdKQzI4ek91WVJnTWVJWDBjUTVaZStmZ3M4Z1h0VnJG?=
 =?utf-8?B?bjZhYUw0UzZ5NUpBV3BxV1dXTmFkVGxaMnNtOUhlb1dJY3lxbExBMmdJTVU3?=
 =?utf-8?B?a2Y0eCtTTDFkUTRWUHVxTk9lUWlTTksxdEVkamtzTWlCaE5YYi9wR1FUNGFJ?=
 =?utf-8?B?T2xrSXc0cUxoZFhvL2phWTVYMUVBY1FSVXZtVWxieFpOTG9ReGY0Y1p3MXVC?=
 =?utf-8?B?OHRxTldRbTM3alo1d1VNQU9KYy91NExMSHExY0E0MUdycVVtVHpGRTdURlhq?=
 =?utf-8?B?NUlnQm9Vd1JTeUtqamF0VnVPS01Ja2ZrMndiSWNyV0Rid2NTY0pxK3JtZWtp?=
 =?utf-8?B?b1kyUklOOE43MThOaHhtUklGOVByR3J2ckhOUk82bU5oL3hNNFJqU3k0WFcw?=
 =?utf-8?B?T3FCcW1TVjZMV1Z6N3ZsM3VXWDAzV3gwZldyQ3JuQ3hIa3BZc3g2NHI3YkRG?=
 =?utf-8?B?M0dqeE56VGt2Mmo0TktwN1FSTnNWZHJ2M0NYOCsyTktDTU5iT1pkSjcwajJm?=
 =?utf-8?B?Z2xtSXdUWU5ac20yTjdLRmh0SzA0UFErSXZBZHIxOUVWTEgwZTI1R3lWTjdL?=
 =?utf-8?B?WE9SQWFiZ1dsbDdReUJKM0hjaFoxNFVHek96NjUwemhmaFBHTGJLMmhLMzJG?=
 =?utf-8?B?cnM5VGV0YWoxYVhEajVqUzRWNE44VXJtbE9VNUJBb3BmeUlkbkc2MTN1aDJR?=
 =?utf-8?B?UlQzeTFsTU9qYkZobklQVUFsVUhoa0k3UGpFYjBGNXRha2U3UlB2SXhEWTcy?=
 =?utf-8?B?YVRwd0FzZWFJcmE2bHF5QzhvdWNSZng5bmNpekwyOVNWZVhZQlpRdWtSaFM1?=
 =?utf-8?B?aTZ4c2dPZlBHNDFxblNhcjhIT0xRNy96K0RSTXBvcVQwVWR0TlJQa01wTTZB?=
 =?utf-8?B?ZVZMUTlzcXhPV2I2eEFEeHc5QnRiNFRPVVBITjdDdjNFc1dZU2ppaXlBb2t4?=
 =?utf-8?B?NHVzQ2FMU1VBc2F6UjNvY0Zka2hNTjR0SVkydXRtcW1FRUhGNW9DQjlCbjFz?=
 =?utf-8?B?aXA0Yzh5dlhGeUdIellEaG5XeHJjSUx0bEZtOXNTUTRRZmRNVmVJSC9veXpF?=
 =?utf-8?Q?pqgrbIv2WXPcN0jogUvj9BF790BTUAFB0dipZto3hc=3D?=
X-OriginatorOrg: dbi-services.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 
 369aeabb-1e61-4cda-7c50-08dbcfa89708
X-MS-Exchange-CrossTenant-AuthSource: GV0P278MB0419.CHEP278.PROD.OUTLOOK.COM
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Oct 2023 07:05:19.9666
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: b9c70613-b1ea-47b7-9fdd-e6f3a67ce75c
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 
 chuSAgaRvvVP7qTwqo6xgmYz3yNR73r0DaQic5poO82wYwFaMyhh75QX/kAFtAbLaPPfP4utgaXV7JJzLp49gtjHHw8DOR679ng8KXPAeXxfGLxbrWauWSdq6TAXYFqR
X-MS-Exchange-Transport-CrossTenantHeadersStamped: GV0P278MB0129
List-Id: <pgsql-docs.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-docs@lists.postgresql.org>
List-Owner: <mailto:pgsql-docs-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-docs>
Archived-At: 
 <https://www.postgresql.org/message-id/93e0bf53-41ae-4718-a1c5-cec36283bbc7%40dbi-services.com>
Precedence: bulk

Hi,

when reading the documentation about "set role" there is this:
https://www.postgresql.org/docs/16/sql-set-role.html

"After |SET ROLE|, permissions checking for SQL commands is carried out 
as though the named role were the one that had logged in originally."

Given this:

postgres=# select session_user, current_user;
  session_user | current_user
--------------+--------------
  postgres     | postgres
(1 row)

postgres=# set role a;
SET
postgres=> create table t(a int);
ERROR:  permission denied for schema public
LINE 1: create table t(a int);
                      ^
Isn't it the other way around and permission checking is done as "a", or 
do I read this wrong?

Best regards
Daniel