public inbox for [email protected]
help / color / mirror / Atom feedFrom: Dominique Devienne <[email protected]>
To: Tom Lane <[email protected]>
Cc: David G. Johnston <[email protected]>
Cc: [email protected] <[email protected]>
Subject: Re: DROP ROLE as SUPERUSER
Date: Fri, 21 Feb 2025 11:56:07 +0100
Message-ID: <CAFCRh-9fRoVj6WhekQ2+E3riS6TC4HWHJJ4w8cJp=wFf3Q0NAw@mail.gmail.com> (raw)
In-Reply-To: <[email protected]>
References: <CAFCRh-_3+E3-pmdH+i5jUE-8Z1jJWxxdP3EcFjTbHVWM+oEweg@mail.gmail.com>
<CAKFQuwb-pHsxJF22fAp2Vb1jwbQxTVxXhuLzjaocsB5LEUEb5w@mail.gmail.com>
<[email protected]>
<CAKFQuwa4iiw9zei549ROy1VaWTWT5dM1Ubw9aH7TdmbQS2iiGw@mail.gmail.com>
<[email protected]>
On Thu, Feb 20, 2025 at 5:52 PM Tom Lane <[email protected]> wrote:
> So grants and revokes are still being done as the object owner by
> default.
>
> Now I'm unclear on exactly what was happening in Dominique's case.
> Was the problematic permission granted by somebody other than the
> database's owner?
>
Here's my exact situation (with some renames).
The DB Owner (Acme-DBA:...) is not the one that made the GRANT
that prevented role foobar from being DROP'd.
REVOKE as SUPERUSER was silently doing nothing,
until I SET ROLE "SCH1:9XabXbNRbVABafYYGiP7nY" before doing it.
ROLE foobar doesn't OWN anything, so David's REASSIGN or
DROP OWNED as not relevant here.
The point I'm trying to make, is that "hunting down" grantor(s) to connect
to DB(s) to be able to "force drop" a ROLE is a PITA. And I really wish
there
was an easier way to drop a role in that situation. --DD
D:\>ppg ... -d acmedb10 --impersonate foobar cluster --databases
Connected OK (postgresql://postgres@.../acmedb10)
Warning: Impersonating user: foobar
========================================
| Privs | dbname | owner |
========================================
| c- | acmedb10 | "Acme-DBA:004k1n" |
| c- | postgres | postgres |
========================================
(where c = CONNECT privilege; and C = CREATE privilege)
Can CONNECT to 2 databases (out of 4; 4 matching)
D:\>ppg ... -d acmedb10 database --acls
Connected OK (postgresql://postgres@.../acmedb10)
|-----------------------------------|-----------------------------------|-----------|-----------|
| Grantor | Grantee |
Privilege | Grantable |
|-----------------------------------|-----------------------------------|-----------|-----------|
...
| "SCH1:9XabXbNRbVABafYYGiP7nY" | foobar |
CONNECT | NO |
|-----------------------------------|-----------------------------------|-----------|-----------|
6 ACLs to 3 Grantees from 2 Grantors
view thread (8+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected]
Subject: Re: DROP ROLE as SUPERUSER
In-Reply-To: <CAFCRh-9fRoVj6WhekQ2+E3riS6TC4HWHJJ4w8cJp=wFf3Q0NAw@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox