Subject: Re: v16 roles, SET FALSE, INHERIT FALSE, ADMIN FALSE

From: Christophe Pettus <[email-masked]>
Date: Mon, 8 Jul 2024 13:29:55 -0700

> On Jul 8, 2024, at 13:25, Laurenz Albe <[email-masked]> wrote:
> I didn't test it, but doesn't that allow the member rule to drop objects owned
> be the role it is a member of?

No, apparently not.

---

From: Christophe Pettus <[email-masked]>
Date: Mon, 8 Jul 2024 13:36:11 -0700

> On Jul 8, 2024, at 13:29, Christophe Pettus <[email-masked]> wrote:
> 
> 
> 

Just from a quick check, it looks like you need INHERIT to inherit the ability to drop objects.  The documentation strongly implies this, although it doesn't quite come out and say it.

---

From: Tom Lane <[email-masked]>
Date: Mon, 08 Jul 2024 16:39:27 -0400

> No, apparently not.

IIUC, you need at least one of SET TRUE and INHERIT TRUE to be able to
access the privileges of the role you are nominally a member of.  This
extends to ownership checks as well as grantable privileges.

			regards, tom lane