MIME-Version: 1.0
In-Reply-To: <CAKFQuwb-pHsxJF22fAp2Vb1jwbQxTVxXhuLzjaocsB5LEUEb5w@mail.gmail.com>
References: <CAFCRh-_3+E3-pmdH+i5jUE-8Z1jJWxxdP3EcFjTbHVWM+oEweg@mail.gmail.com>
 <CAKFQuwb-pHsxJF22fAp2Vb1jwbQxTVxXhuLzjaocsB5LEUEb5w@mail.gmail.com>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Thu, 20 Feb 2025 08:56:47 -0700
Message-ID: <CAKFQuwZgEfQ1pJVPAwLM0MrFCpjhMKhxDxWbbqBOQgWG+DPStw@mail.gmail.com>
Subject: Re: DROP ROLE as SUPERUSER
To: Dominique Devienne <ddevienne@gmail.com>
Cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000e2eeaf062e94eb69"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwZgEfQ1pJVPAwLM0MrFCpjhMKhxDxWbbqBOQgWG%2BDPStw%40mail.gmail.com>
Precedence: bulk

--000000000000e2eeaf062e94eb69
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, February 20, 2025, David G. Johnston <
david.g.johnston@gmail.com> wrote:

> On Thursday, February 20, 2025, Dominique Devienne <ddevienne@gmail.com>
> wrote:
>
>> Hi. Today I was surprised that REVOKE ALL ON DATABASE FROM ROLE silently
>> did nothing, even with CASCADE, when I was running it as SUPERUSER,
>> preventing DROP'ing the ROLE. I had to manually SET ROLE to the GRANTOR,=
 do
>> the REVOKE, which DID something this time, and then I could DROP the rol=
e.
>>
>> That's hardly convenient :). And I was helping someone else who couldn't
>> figure out how to drop that role. Isn't there a better way?
>>
>> I thought SUPERUSER was more powerful that than. Why isn't it?
>>
>
> This has nothing to do with power/permissions.  It is about not specifyin=
g
> =E2=80=9Cgranted by=E2=80=9D in your SQL command and thus failing to full=
y and correctly
> specify the single permission you want to revoke.
>

Well, not =E2=80=9Csingle permission=E2=80=9D but the ALL only applies to t=
he permission
types, not actually everything for all grantors.

David J.

--000000000000e2eeaf062e94eb69
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, February 20, 2025, David G. Johnston &lt;<a href=3D"mailto:dav=
id.g.johnston@gmail.com">david.g.johnston@gmail.com</a>&gt; wrote:<br><bloc=
kquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #cc=
c solid;padding-left:1ex">On Thursday, February 20, 2025, Dominique Devienn=
e &lt;<a href=3D"mailto:ddevienne@gmail.com" target=3D"_blank">ddevienne@gm=
ail.com</a>&gt; wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin=
:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr">H=
i. Today I was surprised that REVOKE ALL ON DATABASE FROM ROLE silently did=
 nothing, even with CASCADE, when I was running it as SUPERUSER, preventing=
 DROP&#39;ing the ROLE. I had to manually SET ROLE to the GRANTOR, do the R=
EVOKE, which DID something this time, and then I could DROP the role.<div><=
br></div><div>That&#39;s hardly convenient :). And I was helping someone el=
se who couldn&#39;t figure out how to drop that role. Isn&#39;t there a bet=
ter way?</div><div><br></div><div>I thought SUPERUSER was more powerful tha=
t than. Why isn&#39;t it?</div></div></blockquote><div><br></div><div>This =
has nothing to do with power/permissions.=C2=A0 It is about not specifying =
=E2=80=9Cgranted by=E2=80=9D in your SQL command and thus failing to fully =
and correctly specify the single permission you want to revoke.</div></bloc=
kquote><div><br></div><div>Well, not =E2=80=9Csingle permission=E2=80=9D bu=
t the ALL only applies to the permission types, not actually everything for=
 all grantors.</div><div><br></div><div>David J.=C2=A0</div>

--000000000000e2eeaf062e94eb69--