MIME-Version: 1.0
References: <CA+bysH_or91tt7r0gKLJtw5Wp+DEYwnaRJoTvLfKO33dcdQ_rQ@mail.gmail.com>
 <f277a82d40a56c574b6c371c413be8ea8cbb46ac.camel@tpg.com.au>
In-Reply-To: <f277a82d40a56c574b6c371c413be8ea8cbb46ac.camel@tpg.com.au>
Sender: calvinguo@gmail.com
From: Calvin Guo <newoakllc2023@gmail.com>
Date: Mon, 24 Nov 2025 20:18:18 +0800
Message-ID: <CA+bysH8yz-iB0Th5wsTUvzM-6Ap-y-kt6si9c_DF9zH_MrODRg@mail.gmail.com>
Subject: Re: set role command
To: rob stone <floriparob@tpg.com.au>
Cc: pgsql-general@lists.postgresql.org
Content-Type: multipart/alternative; boundary="0000000000002362e4064456296b"
Archived-At: <https://www.postgresql.org/message-id/CA%2BbysH8yz-iB0Th5wsTUvzM-6Ap-y-kt6si9c_DF9zH_MrODRg%40mail.gmail.com>
Precedence: bulk

--0000000000002362e4064456296b
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

No, that's not the case. right now: usera can totally do: reset role, and
then behave like userb.
this behavior should not be allowed.
userb can impernate usera, once the impersonation is done, it becomes
usera, and it should NOT be able to impersonate userb. but right now, reset
role will allow it.

On Mon, Nov 24, 2025 at 8:06=E2=80=AFPM rob stone <floriparob@tpg.com.au> w=
rote:

> On Mon, 2025-11-24 at 16:15 +0800, Calvin Guo wrote:
> > I feel that set role logic is kindof misleading.
> >
> > I am a superuser, admin,
> > I do:
> > set role usera
> > Now I am under the security context of usera, so I think running any
> > sql is safe as long as it's allowed by usera.
> >
> > Which is not the case!
> > as usera can do:
> > set role userb; other sql,
> > or
> > reset role; orther sql,
> > it turns out it's not safe at all, the sql can easily get access
> > right of the super user. it can impernate userb though they do not
> > have any relationship whatso ever.
> >
> > I really feel, once you "set role usera", you should behave like
> > usera, you should NOT have the power say: hi, I can assume my super
> > user power whenever I want. As this make the "set role usera" pretty
> > much useless.
> >
> > It's unsafe!
>
>
> Hello,
>
> firstly you have to create a role usera and in doing so give it the
> privileges you want usera to have. You can also restrict its privileges
> by specifying the NO* range of options.
>
> So, if you are logged in as userb, say, doing "set role usera" simply
> switches you out of userb into usera, and you behave as usera in that
> session.
>
> HTH,
> Rob
>
>
>
>

--0000000000002362e4064456296b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">No, that&#39;s not the case. right now: usera can totally =
do: reset role, and then behave like userb.<div>this behavior should not be=
 allowed.=C2=A0</div><div>userb can impernate usera, once the impersonation=
 is done, it becomes usera, and it should NOT be able to impersonate userb.=
 but right now, reset role will allow it.</div></div><br><div class=3D"gmai=
l_quote gmail_quote_container"><div dir=3D"ltr" class=3D"gmail_attr">On Mon=
, Nov 24, 2025 at 8:06=E2=80=AFPM rob stone &lt;<a href=3D"mailto:floriparo=
b@tpg.com.au">floriparob@tpg.com.au</a>&gt; wrote:<br></div><blockquote cla=
ss=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid =
rgb(204,204,204);padding-left:1ex">On Mon, 2025-11-24 at 16:15 +0800, Calvi=
n Guo wrote:<br>
&gt; I feel that set role logic is kindof misleading.<br>
&gt; <br>
&gt; I am a superuser, admin,<br>
&gt; I do:<br>
&gt; set role usera<br>
&gt; Now I am under the security context of usera, so I think running any<b=
r>
&gt; sql is safe as long as it&#39;s allowed by usera.<br>
&gt; <br>
&gt; Which is not the case!<br>
&gt; as usera can do:<br>
&gt; set role userb; other sql,<br>
&gt; or=C2=A0<br>
&gt; reset role; orther sql,<br>
&gt; it turns out it&#39;s not safe at all, the sql can easily get access<b=
r>
&gt; right of the super user. it can impernate userb though they do not<br>
&gt; have any relationship whatso ever.<br>
&gt; <br>
&gt; I really feel, once you &quot;set role usera&quot;, you should behave =
like<br>
&gt; usera, you should NOT have the power say: hi, I can assume my super<br=
>
&gt; user power whenever I want. As this make the &quot;set role usera&quot=
; pretty<br>
&gt; much useless.<br>
&gt; <br>
&gt; It&#39;s unsafe!<br>
<br>
<br>
Hello,<br>
<br>
firstly you have to create a role usera and in doing so give it the<br>
privileges you want usera to have. You can also restrict its privileges<br>
by specifying the NO* range of options.<br>
<br>
So, if you are logged in as userb, say, doing &quot;set role usera&quot; si=
mply<br>
switches you out of userb into usera, and you behave as usera in that<br>
session.<br>
<br>
HTH,<br>
Rob<br>
<br>
<br>
<br>
</blockquote></div>

--0000000000002362e4064456296b--