public inbox for [email protected]  

help / color / mirror / Atom feed

From: Adrian Klaver <[email protected]>
To: Dominique Devienne <[email protected]>
Cc: [email protected]
Subject: Re: SET LOCAL ROLE inside SECURITY INVOKER (LANGUAGE plpgsql) function
Date: Wed, 30 Jul 2025 12:42:39 -0700
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <CAFCRh--AXoYUj8-WDuWpUcWXC0UNAL9gjbTp=1hU-NJhRyR0vQ@mail.gmail.com>
	<[email protected]>
	<CAFCRh-9AzsOBd6cPFsgmbw=Mf3nN5tHj9YYQQHZG0XqxDSMK=Q@mail.gmail.com>
	<[email protected]>

On 7/30/25 09:21, Adrian Klaver wrote:
> On 7/30/25 08:47, Dominique Devienne wrote:
>> On Wed, Jul 30, 2025 at 5:23 PM Adrian Klaver 
>> <[email protected]> wrote:
>>> On 7/30/25 04:37, Dominique Devienne wrote:
>>>> Are there special consideration I'm unaware of, regarding SET ROLE
>>>> inside routines?
>>
>>> What is the ROLE that defined the function?
>>
>> A 3rd role. But does it matter? Given that this is in SECURITY INVOKER 
>> function?
> 
> My mistake, a BC(Before Coffee) issue.
> 
> 
>> The function and the table belong to yet another role.
>> And when we enter the function, we're yet another one (obviously with
>> USAGE+EXECUTE, since could call it).
>> But once we SET LOCAL ROLE, the effective permissions used should be
>> for :OWNER1 and the inherited :SOWNER.
> 
> Could this be a search_path and/or naming issue, where the table 
> SchemaMapping appears in more then one schema or different name case?
> 

If the above is not the issue, then a simple test case:

grant db_user to app_user with set true, inherit true;

-- As db_user

create table fnc_set_role_test(id integer, fld1 varchar);
insert into fnc_set_role_test values (1, 'test');

CREATE OR REPLACE FUNCTION public.role_set()
  RETURNS void
  LANGUAGE plpgsql
AS $function$

BEGIN
     EXECUTE format('SET LOCAL ROLE %I', 'db_user');
     raise notice 'CURRENT_USER = %, can DELETE = %', CURRENT_USER,
     has_table_privilege('fnc_set_role_test', 'DELETE');
     DELETE FROM fnc_set_role_test;
END;
$function$
;

-- As app_user
\c - app_user

select * from fnc_set_role_test ;

select role_set();
NOTICE:  CURRENT_USER = db_user, can DELETE = t
  role_set
----------

(1 row)

  select * from fnc_set_role_test ;
  id | fld1
----+------
(0 rows)


My suspicion is that there is a missing piece in your chain of roles.


-- 
Adrian Klaver
[email protected]

view thread (11+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: SET LOCAL ROLE inside SECURITY INVOKER (LANGUAGE plpgsql) function
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox