Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1sQvj4-00CNcv-HF for pgsql-general@arkaria.postgresql.org; Mon, 08 Jul 2024 21:16:46 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1sQvj1-009TYf-At for pgsql-general@arkaria.postgresql.org; Mon, 08 Jul 2024 21:16:43 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1sQvj0-009TYU-W4 for pgsql-general@lists.postgresql.org; Mon, 08 Jul 2024 21:16:43 +0000 Received: from sss.pgh.pa.us ([68.162.161.243]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1sQviu-0015ye-Ba for pgsql-general@postgresql.org; Mon, 08 Jul 2024 21:16:41 +0000 Received: from sss1.sss.pgh.pa.us (localhost [127.0.0.1]) by sss.pgh.pa.us (8.15.2/8.15.2) with ESMTP id 468LGSnX1214993; Mon, 8 Jul 2024 17:16:28 -0400 From: Tom Lane To: Pavel Luzanov cc: Christophe Pettus , pgsql-general Subject: Re: v16 roles, SET FALSE, INHERIT FALSE, ADMIN FALSE In-reply-to: <2e3e4ddb-52b5-49b2-b363-00e3f12a83a0@postgrespro.ru> References: <69A2A7BD-F8CA-4067-B229-B5F9FC6A884F@thebuild.com> <2e3e4ddb-52b5-49b2-b363-00e3f12a83a0@postgrespro.ru> Comments: In-reply-to Pavel Luzanov message dated "Tue, 09 Jul 2024 00:00:35 +0300" MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <1214991.1720473388.1@sss.pgh.pa.us> Content-Transfer-Encoding: quoted-printable Date: Mon, 08 Jul 2024 17:16:28 -0400 Message-ID: <1214992.1720473388@sss.pgh.pa.us> List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk Pavel Luzanov writes: > On 08.07.2024 22:22, Christophe Pettus wrote: >> This is more curiosity than anything else. In the v16 role system, is = there actually any reason to grant membership in a role to a different rol= e, but with SET FALSE, INHERIT FALSE, and ADMIN FALSE? Does the role gran= ted membership gain any ability it didn't have before in that case? > Looks like there is one ability. > Authentication in pg_hba.conf "USER" field via +role syntax. Hmm, if that check doesn't require INHERIT TRUE I'd say it's a bug. regards, tom lane