Message-ID: <7b0e2774cdcc8f522ac82f64a8d7266f353a5094.camel@j-davis.com>
Subject: Re: Clarification on Role Access Rights to Table Indexes
From: Jeff Davis <pgsql@j-davis.com>
To: Nathan Bossart <nathandbossart@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>
Cc: Ayush Vatsa <ayushvatsa1810@gmail.com>, Robert Haas
 <robertmhaas@gmail.com>,  "David G. Johnston" <david.g.johnston@gmail.com>,
 PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Date: Wed, 08 Oct 2025 20:28:01 -0700
In-Reply-To: <8af53c6e8992aa706e63aafe60a3bcf100b524d1.camel@j-davis.com>
References: 
	<CACX+KaO4R9QDxbPSxSB0jNXFsqA6Jf=UPS+tyUvT_YvuP_grVA@mail.gmail.com>
	 <Z8yxsm9ZWVkHlPbV@nathan>
	 <CACX+KaP+6U9jf=GT4wpR7TvRvSMtTAhz=vP2Zr+ZdUFVZzqNsA@mail.gmail.com>
	 <Z8y9RTT-vU6oVI_Y@nathan> <149429.1741472260@sss.pgh.pa.us>
	 <Z8zwVmGzXyDdkAXj@nathan> <279947.1741535285@sss.pgh.pa.us>
	 <Z88CB-vDehJ9rW8u@nathan> <aNQVIVKarUipPcnW@nathan>
	 <3432170.1758730414@sss.pgh.pa.us> <aNQhuRQfD3PlpeuT@nathan>
	 <8af53c6e8992aa706e63aafe60a3bcf100b524d1.camel@j-davis.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.52.3-0ubuntu1 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/7b0e2774cdcc8f522ac82f64a8d7266f353a5094.camel%40j-davis.com>
Precedence: bulk

On Wed, 2025-10-08 at 20:06 -0700, Jeff Davis wrote:
> On Wed, 2025-09-24 at 11:52 -0500, Nathan Bossart wrote:
> > On Wed, Sep 24, 2025 at 12:13:34PM -0400, Tom Lane wrote:
> > > Nathan Bossart <nathandbossart@gmail.com> writes:
> > > > * RangeVarCallbackForReindexIndex() was checking privileges on
> > > > the table
> > > > before locking it, so I reversed it in 0002.
> > >=20
> > > Don't we do that intentionally, to make sure someone can't cause
> > > DOS
> > > on a table they have no privileges on?
> >=20
> > Ah, right.=C2=A0 I switched it back in v4.
>=20
> v4-0001 looks good to me.

Actually, now I'm unsure. v4-0001 is taking a lock on the table before
checking privileges, whereas v4-0002 is going to some effort to avoid
that. Is that because the latter is taking a ShareLock?

Regards,
	Jeff Davis