Message-ID: <a3559b3c11330e59a4757b97d741c4cd6005d659.camel@cybertec.at>
Subject: Re: Strange permission effect depending on DEFERRABILITY
From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Achilleas Mantzios - cloud <a.mantzios@cloud.gatewaynet.com>, 
 "pgsql-general@lists.postgresql.org"
	 <pgsql-general@lists.postgresql.org>
Date: Mon, 09 Sep 2024 23:09:12 +0200
In-Reply-To: <89e33a53-909c-6a02-bfc6-2578ba974e16@cloud.gatewaynet.com>
References: <89e33a53-909c-6a02-bfc6-2578ba974e16@cloud.gatewaynet.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.52.4 (3.52.4-1.fc40) 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/a3559b3c11330e59a4757b97d741c4cd6005d659.camel%40cybertec.at>
Precedence: bulk

On Mon, 2024-09-09 at 16:14 +0300, Achilleas Mantzios - cloud wrote:
> The below runs on PostgreSQL 16.4
>=20
> We are trying to implement a certain operation based on a security define=
r
> function : mariner_update_availability_date
>=20
> This is supposed to update a table : mariner , which has several other tr=
iggers :=C2=A0
>=20
>   [...]
> =C2=A0=C2=A0zzzmariner_dmq_tg AFTER INSERT OR DELETE OR UPDATE ON mariner=
 DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION export_dmq()
>=20
> As you noticed the last trigger is a CONSTRAINT DEFERRABLE trigger.
> This function mariner_update_availability_date is supposed to be run by a=
 user :
> cbt_results_import stripped of any privileges to the rest of the system. =
Here is
> what we get : when we SET the constraint of the last trigger to IMMEDIATE=
, the
> function runs on behalf of its owner (postgres) who has all needed privil=
eges
> (as superuser) to run the update on mariner table and also run the trigge=
rs .
> However, when we run with this CONSTRAINT as DEFERRED then it seems to NO=
T run
> the last deferrable trigger as postgres.=20

I have proposed a patch that fixes exactly that case:
https://commitfest.postgresql.org/49/4888/

So far, the feedback seems to be that it is not considered a bug.
But that doesn't mean that we cannot change the behavior.

Yours,
Laurenz Albe