From: tushar <tushar.ahuja@enterprisedb.com>
To: Nathan Bossart <nathandbossart@gmail.com>
To: Robert Haas <robertmhaas@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: CREATEROLE users vs. role properties
Date: Thu, 19 Jan 2023 16:45:22 +0530
Message-ID: <0d55df3d-da0e-7960-8bc7-a43355a81c6f@enterprisedb.com> (raw)
In-Reply-To: <482146ee-e73e-5378-6595-b06e044acc43@enterprisedb.com>
References: <CA+TgmoYwTFTQR0+qe+_asEvv2wqQL+0JCyexgVy2Ct31+rCb7w@mail.gmail.com>
<CA+TgmobX=LHg_J5aT=0pi9gJy=JdtrUVGAu0zhr-i5v5nNbJDg@mail.gmail.com>
<20230118231749.GA3790025@nathanxps13>
<482146ee-e73e-5378-6595-b06e044acc43@enterprisedb.com>
On 1/19/23 3:05 PM, tushar wrote:
> which was working previously without patch.
My bad, I was testing against PG v15 but this issue is not
reproducible on master (without patch).
As you mentioned- "This implements the standard idea that you can't give
permissions
you don't have (but you can give the ones you do have)" but here the
role is having
createrole privilege that he cannot pass on to another user? Is this
expected?
postgres=# create role fff with createrole;
CREATE ROLE
postgres=# create role xxx;
CREATE ROLE
postgres=# set role fff;
SET
postgres=> alter role xxx with createrole;
ERROR: permission denied
postgres=>
--
regards,tushar
EnterpriseDB https://www.enterprisedb.com/
The Enterprise PostgreSQL Company
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tushar.ahuja@enterprisedb.com, nathandbossart@gmail.com, robertmhaas@gmail.com
Subject: Re: CREATEROLE users vs. role properties
In-Reply-To: <0d55df3d-da0e-7960-8bc7-a43355a81c6f@enterprisedb.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox