From: Stephen Frost <sfrost@snowman.net>
To: Frank van Vugt <ftm.van.vugt@foxi.nl>
Cc: pgsql-general@postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
Cc: Adrian Klaver <adrian.klaver@aklaver.com>
Subject: Re: intentional or oversight? pg_dump -c does not restore default priviliges on schema public
Date: Mon, 13 Feb 2017 09:10:42 -0500
Message-ID: <20170213141042.GJ9812@tamriel.snowman.net> (raw)
In-Reply-To: <23252987.YLsmlhlehZ@techfox>
References: <3534542.o3cNaKiDID@techfox>
<20170211220617.GG9812@tamriel.snowman.net>
<3026.1486855735@sss.pgh.pa.us>
<23252987.YLsmlhlehZ@techfox>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-general>
Frank,
* Frank van Vugt (ftm.van.vugt@foxi.nl) wrote:
> Op zaterdag 11 februari 2017 15:28:55 schreef Tom Lane:
> > I'm inclined to argue that it was a mistake to include any non-pinned
> > objects in pg_init_privs.
> <cut>
> > We might need to fix pg_dump too, but I think these entries in
> > pg_init_privs should simply not be there.
>
> Thanks for picking this up, I'll probably see this subject pop up on hackers
> and/or committers at some point ;)
We should be able to get it addressed shortly.
> Allow me to emphasize that this issue basically means that for v9.6 after
> restoring a dump created with the '-c' option one ends up in a situation that
> might be quite confusing for users that didn't have to pay much attention yet
> to handling priviliges... i.e. trying even a plain select on table_a in the
> public schema as a non-system user returns something like:
> ERROR: relation "table_a" does not exist
Yes, it's unfortunate that many users aren't really familiar with
schema-level privileges.
For your specific case, if you drop/recreate the public schema in the
system that you're dumping the data from, and then set the ACLs to what
you want, they should be dumped out, even with a pg_dump -c. It's only
when you're using -c with the initdb-time public schema, and initdb-time
ACLs, that the issue arises.
Thanks!
Stephen
Attachments:
[application/pgp-signature] signature.asc (818B, ../20170213141042.GJ9812@tamriel.snowman.net/2-signature.asc)
download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: sfrost@snowman.net, ftm.van.vugt@foxi.nl, tgl@sss.pgh.pa.us, adrian.klaver@aklaver.com
Subject: Re: intentional or oversight? pg_dump -c does not restore default priviliges on schema public
In-Reply-To: <20170213141042.GJ9812@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox