Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1rkRnJ-00CnLJ-H9
	for pgsql-hackers@arkaria.postgresql.org; Wed, 13 Mar 2024 16:49:34 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.94.2)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1rkRnH-008BAY-T8
	for pgsql-hackers@arkaria.postgresql.org; Wed, 13 Mar 2024 16:49:32 +0000
Received: from makus.postgresql.org ([2001:4800:3e1:1::229])
	by malur.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <pgsql@j-davis.com>)
	id 1rkRnH-008BAQ-F7
	for pgsql-hackers@lists.postgresql.org; Wed, 13 Mar 2024 16:49:32 +0000
Received: from mail-oa1-x2b.google.com ([2001:4860:4864:20::2b])
	by makus.postgresql.org with esmtps  (TLS1.3) tls
 TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
	(Exim 4.94.2)
	(envelope-from <pgsql@j-davis.com>)
	id 1rkRnD-004Jmw-RS
	for pgsql-hackers@postgresql.org; Wed, 13 Mar 2024 16:49:30 +0000
Received: by mail-oa1-x2b.google.com with SMTP id
 586e51a60fabf-22187576d54so75924fac.1
        for <pgsql-hackers@postgresql.org>;
 Wed, 13 Mar 2024 09:49:28 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=j-davis-com.20230601.gappssmtp.com; s=20230601; t=1710348568;
 x=1710953368; darn=postgresql.org;
        h=mime-version:user-agent:content-transfer-encoding:references
         :in-reply-to:date:to:from:subject:message-id:from:to:cc:subject:date
         :message-id:reply-to;
        bh=9RCo5/SgTTfNefP/8jMbLqwpgBUdpHJJhIcRtFEwxRU=;
        b=Y6ePIn52yKtog4lqsOOvLCT4Mvw9Y8CKGRZJS42+YA+0c2VyYz+ejZJpDIbpeQcX4q
         a3ySTTcCp0drUd6Qoht8tvpio3icgPuBFLBEPwSbxQVQTEhGrKNmAXsgUy3Sg2Hzyd4G
         ZHIqeiiRkU6SWSDGk3skNAntkKnNNXf4mGEhvkEFpcHDs2YDFIMmU/sLxNuwZFBleKsf
         ZKPgBWNJSDu9etbx14eXHBWG8gEj002AitPeB7SDTlxmfAM4MK7Q0F7xF47l6snUSKKI
         OIHAxr9JW0wRfPNM8QOCnJRsLR7xtyq6VN3lgRA03evftpuch96dg79xvOhmvTkmJFUp
         Ui4g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
        d=1e100.net; s=20230601; t=1710348568; x=1710953368;
        h=mime-version:user-agent:content-transfer-encoding:references
         :in-reply-to:date:to:from:subject:message-id:x-gm-message-state:from
         :to:cc:subject:date:message-id:reply-to;
        bh=9RCo5/SgTTfNefP/8jMbLqwpgBUdpHJJhIcRtFEwxRU=;
        b=jjQNK7QCyNJadwYrrM0AyD5Yq9yjG2iGR0aUVCgwryZBI+d6Y27lAm+DcKZMxqCnrb
         ODrU/SQoItQfq8rqPrrUiPC56zfmm5/z05MW85+klbLZsmiPS/sOnx7vQNiUQJFGRKfS
         0cDNJsLvND6BDI7RAlsXZzi/+ynHB8K12o93+ctpcNkHNROOqzpJHdaS2axY8Iul0b9o
         LbQ7Xu0Jdq1MWxqaur3o2XHtiIxrKzgz5LebGVseqewSxmqug6/3C4AVmPS4BzMuTYiE
         mEGOfr6CL1M8oBX5HouLDtu58FYq4il9W5G9b34vOchoSxYVpyZaMnodiySB6NgeRkXT
         vNkQ==
X-Forwarded-Encrypted: i=1;
 AJvYcCW7D0EZY36Ew3AkqNDF/hvjcbR1UIJFMoWOPFF6QuOhcT+ijlbQAU8qPAW4zp/A6AbyS2pAYlNXEiUg7nkcfBFYdPpXqkGL3+kKDH86
X-Gm-Message-State: AOJu0YyibATS0x4xnE36bgxP2iyijg4sbJtbRpbg5S4HSVD0IXeN+nvT
	8SHkGK6I0E0G+jMhjcJy3+1q0dj23FwXxW1OGCGSJVilm0WpkXdZWaxWdJscbA==
X-Google-Smtp-Source: 
 AGHT+IGSbKPPSpyZupd6e7U05pda/lfrYl8T8BALyO6LV3+16ZCoTbQ4fkb+3PTc8QcP5KblL82yrA==
X-Received: by 2002:a05:6870:46aa:b0:21e:528f:54e9 with SMTP id
 a42-20020a05687046aa00b0021e528f54e9mr13768113oap.18.1710348568162;
        Wed, 13 Mar 2024 09:49:28 -0700 (PDT)
Received: from jeff-laptop.lan (c-76-102-242-158.hsd1.ca.comcast.net.
 [76.102.242.158])
        by smtp.gmail.com with ESMTPSA id
 p1-20020a63c141000000b005dc389409c1sm7873232pgi.93.2024.03.13.09.49.27
        (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
        Wed, 13 Mar 2024 09:49:27 -0700 (PDT)
Message-ID: <031d60d1dcb869da4effe5e56411f8bdd01dd3a0.camel@j-davis.com>
Subject: Re: un-revert the MAINTAIN privilege and the pg_maintain predefined
 role
From: Jeff Davis <pgsql@j-davis.com>
To: Nathan Bossart <nathandbossart@gmail.com>, pgsql-hackers@postgresql.org
Date: Wed, 13 Mar 2024 09:49:26 -0700
In-Reply-To: <20240312210541.GA2400644@nathanxps13>
References: <20240305161235.GA3478007@nathanxps13>
	 <20240307165000.GA388645@nathanxps13>
	 <20240312210541.GA2400644@nathanxps13>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4-0ubuntu2 
MIME-Version: 1.0
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Archived-At: 
 <https://www.postgresql.org/message-id/031d60d1dcb869da4effe5e56411f8bdd01dd3a0.camel%40j-davis.com>
Precedence: bulk

On Tue, 2024-03-12 at 16:05 -0500, Nathan Bossart wrote:
> It's easy enough to resolve this inconsistency by sending
> down the parent OID when recursing to a TOAST table and using that
> for the
> privilege checks.=C2=A0 AFAICT this avoids any kind of cache lookup
> hazards
> because we hold a session lock on the main relation in this case.=C2=A0
> I've
> done this in the attached v2.

Looks good to me. Thank you for expanding on the comment, as well.

Regards,
	Jeff Davis