MIME-Version: 1.0
In-Reply-To: <CAFCRh-_3+E3-pmdH+i5jUE-8Z1jJWxxdP3EcFjTbHVWM+oEweg@mail.gmail.com>
References: <CAFCRh-_3+E3-pmdH+i5jUE-8Z1jJWxxdP3EcFjTbHVWM+oEweg@mail.gmail.com>
From: "David G. Johnston" <david.g.johnston@gmail.com>
Date: Thu, 20 Feb 2025 08:55:21 -0700
Message-ID: <CAKFQuwb-pHsxJF22fAp2Vb1jwbQxTVxXhuLzjaocsB5LEUEb5w@mail.gmail.com>
Subject: Re: DROP ROLE as SUPERUSER
To: Dominique Devienne <ddevienne@gmail.com>
Cc: "pgsql-general@lists.postgresql.org" <pgsql-general@lists.postgresql.org>
Content-Type: multipart/alternative; boundary="000000000000d5304d062e94e66d"
Archived-At: <https://www.postgresql.org/message-id/CAKFQuwb-pHsxJF22fAp2Vb1jwbQxTVxXhuLzjaocsB5LEUEb5w%40mail.gmail.com>
Precedence: bulk

--000000000000d5304d062e94e66d
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, February 20, 2025, Dominique Devienne <ddevienne@gmail.com>
wrote:

> Hi. Today I was surprised that REVOKE ALL ON DATABASE FROM ROLE silently
> did nothing, even with CASCADE, when I was running it as SUPERUSER,
> preventing DROP'ing the ROLE. I had to manually SET ROLE to the GRANTOR, =
do
> the REVOKE, which DID something this time, and then I could DROP the role=
.
>
> That's hardly convenient :). And I was helping someone else who couldn't
> figure out how to drop that role. Isn't there a better way?
>
> I thought SUPERUSER was more powerful that than. Why isn't it?
>

This has nothing to do with power/permissions.  It is about not specifying
=E2=80=9Cgranted by=E2=80=9D in your SQL command and thus failing to fully =
and correctly
specify the single permission you want to revoke.

David J.

--000000000000d5304d062e94e66d
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Thursday, February 20, 2025, Dominique Devienne &lt;<a href=3D"mailto:dd=
evienne@gmail.com">ddevienne@gmail.com</a>&gt; wrote:<br><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex"><div dir=3D"ltr">Hi. Today I was surprised that REVOKE ALL ON=
 DATABASE FROM ROLE silently did nothing, even with CASCADE, when I was run=
ning it as SUPERUSER, preventing DROP&#39;ing the ROLE. I had to manually S=
ET ROLE to the GRANTOR, do the REVOKE, which DID something this time, and t=
hen I could DROP the role.<div><br></div><div>That&#39;s hardly convenient =
:). And I was helping someone else who couldn&#39;t figure out how to drop =
that role. Isn&#39;t there a better way?</div><div><br></div><div>I thought=
 SUPERUSER was more powerful that than. Why isn&#39;t it?</div></div></bloc=
kquote><div><br></div><div>This has nothing to do with power/permissions.=
=C2=A0 It is about not specifying =E2=80=9Cgranted by=E2=80=9D in your SQL =
command and thus failing to fully and correctly specify the single permissi=
on you want to revoke.</div><div><br></div><div>David J.</div><div><br></di=
v>

--000000000000d5304d062e94e66d--