pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feeddocs: set role permission checking, do I read this wrong?
4+ messages / 2 participants
[nested] [flat]
* docs: set role permission checking, do I read this wrong?
@ 2023-10-18 07:05 Daniel Westermann <daniel.westermann@dbi-services.com>
2023-10-18 07:26 ` Re: docs: set role permission checking, do I read this wrong? David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Daniel Westermann @ 2023-10-18 07:05 UTC (permalink / raw)
To: pgsql-docs@lists.postgresql.org
Hi,
when reading the documentation about "set role" there is this:
https://www.postgresql.org/docs/16/sql-set-role.html
"After |SET ROLE|, permissions checking for SQL commands is carried out
as though the named role were the one that had logged in originally."
Given this:
postgres=# select session_user, current_user;
session_user | current_user
--------------+--------------
postgres | postgres
(1 row)
postgres=# set role a;
SET
postgres=> create table t(a int);
ERROR: permission denied for schema public
LINE 1: create table t(a int);
^
Isn't it the other way around and permission checking is done as "a", or
do I read this wrong?
Best regards
Daniel
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: docs: set role permission checking, do I read this wrong?
2023-10-18 07:05 docs: set role permission checking, do I read this wrong? Daniel Westermann <daniel.westermann@dbi-services.com>
@ 2023-10-18 07:26 ` David G. Johnston <david.g.johnston@gmail.com>
2023-10-18 07:56 ` Re: docs: set role permission checking, do I read this wrong? Daniel Westermann <daniel.westermann@dbi-services.com>
0 siblings, 1 reply; 4+ messages in thread
From: David G. Johnston @ 2023-10-18 07:26 UTC (permalink / raw)
To: Daniel Westermann <daniel.westermann@dbi-services.com>; +Cc: pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On Wednesday, October 18, 2023, Daniel Westermann <
daniel.westermann@dbi-services.com> wrote:
>
> "After |SET ROLE|, permissions checking for SQL commands is carried out as
> though the named role were the one that had logged in originally."
>
> Isn't it the other way around and permission checking is done as "a", or
> do I read this wrong?
>
It is saying “a” is the current_user:
When you set role to (named role) a the system behaves as if (named role) a
had logged in originally (even though, in that example, postgres is the
role that originally logged in)
David J.
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: docs: set role permission checking, do I read this wrong?
2023-10-18 07:05 docs: set role permission checking, do I read this wrong? Daniel Westermann <daniel.westermann@dbi-services.com>
2023-10-18 07:26 ` Re: docs: set role permission checking, do I read this wrong? David G. Johnston <david.g.johnston@gmail.com>
@ 2023-10-18 07:56 ` Daniel Westermann <daniel.westermann@dbi-services.com>
2023-10-18 12:35 ` Re: docs: set role permission checking, do I read this wrong? David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 1 reply; 4+ messages in thread
From: Daniel Westermann @ 2023-10-18 07:56 UTC (permalink / raw)
To: David G. Johnston <david.g.johnston@gmail.com>; +Cc: pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On 10/18/23 09:26, David G. Johnston wrote:
> On Wednesday, October 18, 2023, Daniel Westermann
> <daniel.westermann@dbi-services.com> wrote:
>
>
> "After |SET ROLE|, permissions checking for SQL commands is
> carried out as though the named role were the one that had logged
> in originally."
>
> Isn't it the other way around and permission checking is done as
> "a", or do I read this wrong?
>
>
> It is saying “a” is the current_user:
>
> When you set role to (named role) a the system behaves as if (named
> role) a had logged in originally (even though, in that example,
> postgres is the role that originally logged in)
>
> David J.
>
Thank you, this is what I see in the small example. Maybe it is my
English, but this sentence sounds confusing.
Regards
Daniel
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: docs: set role permission checking, do I read this wrong?
2023-10-18 07:05 docs: set role permission checking, do I read this wrong? Daniel Westermann <daniel.westermann@dbi-services.com>
2023-10-18 07:26 ` Re: docs: set role permission checking, do I read this wrong? David G. Johnston <david.g.johnston@gmail.com>
2023-10-18 07:56 ` Re: docs: set role permission checking, do I read this wrong? Daniel Westermann <daniel.westermann@dbi-services.com>
@ 2023-10-18 12:35 ` David G. Johnston <david.g.johnston@gmail.com>
0 siblings, 0 replies; 4+ messages in thread
From: David G. Johnston @ 2023-10-18 12:35 UTC (permalink / raw)
To: Daniel Westermann <daniel.westermann@dbi-services.com>; +Cc: pgsql-docs@lists.postgresql.org <pgsql-docs@lists.postgresql.org>
On Wednesday, October 18, 2023, Daniel Westermann <
daniel.westermann@dbi-services.com> wrote:
>
> Thank you, this is what I see in the small example. Maybe it is my
> English, but this sentence sounds confusing.
>
How would you document that behavior? The sentence is correct; that doesn’t
mean it can’t be improved.
David J.
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2023-10-18 12:35 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2023-10-18 07:05 docs: set role permission checking, do I read this wrong? Daniel Westermann <daniel.westermann@dbi-services.com>
2023-10-18 07:26 ` David G. Johnston <david.g.johnston@gmail.com>
2023-10-18 07:56 ` Daniel Westermann <daniel.westermann@dbi-services.com>
2023-10-18 12:35 ` David G. Johnston <david.g.johnston@gmail.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox