From: Tom Lane <tgl@sss.pgh.pa.us>
To: Christophe Pettus <xof@thebuild.com>
cc: Laurenz Albe <laurenz.albe@cybertec.at>,
        pgsql-general <pgsql-general@postgresql.org>
Subject: Re: v16 roles, SET FALSE, INHERIT FALSE, ADMIN FALSE
In-reply-to: <AAE6E234-1D5B-4FFA-85F6-473F9ED48A22@thebuild.com>
References: <69A2A7BD-F8CA-4067-B229-B5F9FC6A884F@thebuild.com> <78790ab5cdece730a2029310184f9bb9cfcc0fa6.camel@cybertec.at> <AAE6E234-1D5B-4FFA-85F6-473F9ED48A22@thebuild.com>
Comments: In-reply-to Christophe Pettus <xof@thebuild.com>
	message dated "Mon, 08 Jul 2024 13:29:55 -0700"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <1204974.1720471167.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Mon, 08 Jul 2024 16:39:27 -0400
Message-ID: <1204975.1720471167@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/1204975.1720471167%40sss.pgh.pa.us>
Precedence: bulk

Christophe Pettus <xof@thebuild.com> writes:
>> On Jul 8, 2024, at 13:25, Laurenz Albe <laurenz.albe@cybertec.at> wrote=
:
>> I didn't test it, but doesn't that allow the member rule to drop object=
s owned
>> be the role it is a member of?

> No, apparently not.

IIUC, you need at least one of SET TRUE and INHERIT TRUE to be able to
access the privileges of the role you are nominally a member of.  This
extends to ownership checks as well as grantable privileges.

			regards, tom lane