Content-Type: multipart/alternative;
 boundary="------------rnMi669CUgeyG0BBY504IBC0"
Date: Mon, 24 Nov 2025 17:30:14 -0500
MIME-Version: 1.0
Subject: Re: set role command
In-Reply-To: 
 <CA+bysH_or91tt7r0gKLJtw5Wp+DEYwnaRJoTvLfKO33dcdQ_rQ@mail.gmail.com>
Content-Transfer-Encoding: 7bit
From: pg254kl@georgiou.vip
To: Calvin Guo <newoakllc2023@gmail.com>,"pgsql-generallists.postgresql.org"
 <pgsql-general@lists.postgresql.org>
Message-ID: <176402341688.7.8547269556353940402.1025478372@georgiou.vip>
References: 
 <CA+bysH_or91tt7r0gKLJtw5Wp+DEYwnaRJoTvLfKO33dcdQ_rQ@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/176402341688.7.8547269556353940402.1025478372%40georgiou.vip>
Precedence: bulk

This is a multi-part message in MIME format.
--------------rnMi669CUgeyG0BBY504IBC0
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Just because you did set role does not mean you lost your superuser 
privileges, it's correct behavior.

If you want to impersonate in a permissions sandbox it's easy:

create role usera_sandbox in group usera;
\c - usera_sandbox

-- 
regards,
Kiriakos Georgiou


On 11/24/25 3:15 AM, Calvin Guo - newoakllc2023 at gmail.com wrote:
> I feel that set role logic is kindof misleading.
>
> I am a superuser, admin,
> I do:
> set role usera
> Now I am under the security context of usera, so I think running any 
> sql is safe as long as it's allowed by usera.
>
> Which is not the case!
> as usera can do:
> set role userb; other sql,
> or
> reset role; orther sql,
> it turns out it's not safe at all, the sql can easily get access right 
> of the super user. it can impernate userb though they do not have any 
> relationship whatso ever.
>
> I really feel, once you "set role usera", you should behave like 
> usera, you should NOT have the power say: hi, I can assume my super 
> user power whenever I want. As this make the "set role usera" pretty 
> much useless.
>
> It's unsafe!

--------------rnMi669CUgeyG0BBY504IBC0
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Just because you did <font face="monospace" size="4">set role</font>
      does not mean you lost your superuser privileges, it's correct
      behavior.</p>
    <p>If you want to impersonate in a permissions sandbox it's easy:<br>
      <br>
      <font face="monospace"><font size="4">create role usera_sandbox in
          group usera;<br>
          \c - usera_sandbox</font><br>
      </font>  </p>
    <pre class="moz-signature" cols="72">-- 
regards,
Kiriakos Georgiou</pre>
    <p><br>
    </p>
    <div class="moz-cite-prefix">On 11/24/25 3:15 AM, Calvin Guo -
      newoakllc2023 at gmail.com wrote:<br>
    </div>
    <blockquote type="cite"
cite="mid:CA+bysH_or91tt7r0gKLJtw5Wp+DEYwnaRJoTvLfKO33dcdQ_rQ@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      <div dir="ltr">I feel that set role logic is kindof misleading.
        <div><br>
        </div>
        <div>I am a superuser, admin,</div>
        <div>I do:</div>
        <div>set role usera</div>
        <div>Now I am under the security context of usera, so I think
          running any sql is safe as long as it's allowed by usera.</div>
        <div><br>
        </div>
        <div>Which is not the case!</div>
        <div>as usera can do:</div>
        <div>set role userb; other sql,</div>
        <div>or </div>
        <div>reset role; orther sql,</div>
        <div>it turns out it's not safe at all, the sql can easily get
          access right of the super user. it can impernate userb though
          they do not have any relationship whatso ever.</div>
        <div><br>
        </div>
        <div>I really feel, once you "set role usera", you should behave
          like usera, you should NOT have the power say: hi, I can
          assume my super user power whenever I want. As this make the
          "set role usera" pretty much useless.</div>
        <div><br>
        </div>
        <div>It's unsafe!</div>
      </div>
    </blockquote>
    <pre class="moz-signature" cols="72">
</pre>
  </body>
</html>

--------------rnMi669CUgeyG0BBY504IBC0--