MIME-Version: 1.0
References: <CAFCRh-8+PGGTuqg=rSKA533D0dqYAgq69UzSqMm67VEW02nZyQ@mail.gmail.com>
 <CAKFQuwYK2Vdnbdaxh9QF_0PYpztg51nc-iqYeiKDfpzek7hTdQ@mail.gmail.com>
 <CAFCRh-8ttK7AexZtZq-vcj+u5e2F93HEs63jrkEH0pq6Gf1TWw@mail.gmail.com>
 <c42d9931-1ec3-4f41-8b4c-a30f5f79e77d@technowledgy.de> <CAKFQuwZL96kB2mR4SG0=Hig21mwv5AhkxjZRGCYoqeYzPBv6Tw@mail.gmail.com>
 <4308abb3-269e-4cee-a48f-c95d49ede6c2@postgrespro.ru> <CAFCRh-_ZVP4emEKSGYJoM2hP657z1ZTq=UVkb7xZCYdByawFKQ@mail.gmail.com>
In-Reply-To: <CAFCRh-_ZVP4emEKSGYJoM2hP657z1ZTq=UVkb7xZCYdByawFKQ@mail.gmail.com>
From: Dominique Devienne <ddevienne@gmail.com>
Date: Thu, 12 Sep 2024 15:45:01 +0200
Message-ID: <CAFCRh-8d9+GZSXzK=UhJKOq+BTVt9eG0E4Zu6dALo-OaOpunYQ@mail.gmail.com>
Subject: Re: Backward compat issue with v16 around ROLEs
To: Pavel Luzanov <p.luzanov@postgrespro.ru>
Cc: "David G. Johnston" <david.g.johnston@gmail.com>, Wolfgang Walther <walther@technowledgy.de>, 
	pgsql-general@lists.postgresql.org
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAFCRh-8d9%2BGZSXzK%3DUhJKOq%2BBTVt9eG0E4Zu6dALo-OaOpunYQ%40mail.gmail.com>
Precedence: bulk

On Thu, Sep 12, 2024 at 2:40=E2=80=AFPM Dominique Devienne <ddevienne@gmail=
.com> wrote:
> Basically the above explain why we have that
> dd_user (INHERIT)
>  `->  member-of dd_admin (NOINHERIT)
>     `-> member-of dd_owner (INHERIT).
>
> In pre-v16, once again, this was fine.
> Because v16+ adds that dd_owner member-of dd_user (ADMIN)
> edge, things break down.

Another way to look at it is this:

=3D=3D=3D v14 =3D=3D=3D
ddevienne=3D> create role dd_child;
CREATE ROLE
ddevienne=3D> select pg_has_role(current_role, 'dd_child', 'MEMBER');
 pg_has_role
-------------
 f
(1 row)

=3D=3D=3D v16 =3D=3D=3D
ddevienne=3D> create role dd_child;
CREATE ROLE
ddevienne=3D> select pg_has_role(current_role, 'dd_child', 'MEMBER');
 pg_has_role
-------------
 t
(1 row)

Any existing ROLE graph which had "back-edges" (GRANTs) from a ROLE
back to the ROLE that created it, valid in pre-v16, becomes invalid in v16+=
.
And there's no work-around. Tough luck, take a hike...

And our security model and its implementation basically requires such
back-edges.

My contention is that if this is an ADMIN-only edge, it shouldn't be
deemed circular.
Kind of the same way you break cycles in FKs by making one side DEFERRED,
ADMIN edges should be "weaker" than SET ones, and break cycles.

Maybe I'm the only one in the world using PostgreSQL in that situation?
Somehow I doubt that. Most people and organization are slow to upgrade,
and v16 is new enough that it wasn't exposed to enough real world usage yet=
.
So this is issue is only get bigger as time passes IMHO.

Thanks, --DD