Message-ID: <12e2f0cb-08ff-c65f-d31e-76cea1af70ec@joeconway.com>
Date: Fri, 1 Jul 2022 06:17:32 -0400
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
 Thunderbird/91.9.1
Subject: Re: replacing role-level NOINHERIT with a grant-level option
Content-Language: en-US
To: Nathan Bossart <nathandbossart@gmail.com>,
 Robert Haas <robertmhaas@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, "Bossart, Nathan" <bossartn@amazon.com>,
 Stephen Frost <sfrost@snowman.net>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
References: <730520.1644168290@sss.pgh.pa.us>
 <CA+TgmoYeNB1PxMO-TYv4_Ky7XR3-3Le+fpL87T7QMR=OWc7U1Q@mail.gmail.com>
 <80af9ba7-ec24-9134-8fd9-00bf13f5c494@joeconway.com>
 <CA+Tgmoax3J2D1RoqSqBRuLVifMjinZ5SPvR+rBqBT89u57zOJQ@mail.gmail.com>
 <1066202.1654190251@sss.pgh.pa.us>
 <CA+TgmoYmJtLA1aFF2dpGLuqWMuWwrf2SEoT-Ueqd4XCzLL61sA@mail.gmail.com>
 <20220629231939.GA362451@nathanxps13>
 <CA+Tgmobuqgr3XKujMwgsEZUxBHJA8jZSH2tVp7PC1cifePANtw@mail.gmail.com>
 <20220630232931.GA367181@nathanxps13>
 <CA+TgmoZWWqB66t4K6Mqv6TDttO1YJRJhOJO77B5H9Z8f28yc8Q@mail.gmail.com>
 <20220701025830.GA369935@nathanxps13>
From: Joe Conway <mail@joeconway.com>
In-Reply-To: <20220701025830.GA369935@nathanxps13>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: 
 <https://www.postgresql.org/message-id/12e2f0cb-08ff-c65f-d31e-76cea1af70ec%40joeconway.com>
Precedence: bulk

On 6/30/22 22:58, Nathan Bossart wrote:
> On Thu, Jun 30, 2022 at 10:21:53PM -0400, Robert Haas wrote:
>> On Thu, Jun 30, 2022 at 7:29 PM Nathan Bossart <nathandbossart@gmail.com> wrote:
>>> IIUC you are suggesting that we'd leave rolinherit in pg_authid alone, but
>>> we'd add the ability to specify a grant-level option that would always take
>>> precedence.  The default (WITH INHERIT DEFAULT) would cause things to work
>>> exactly as they do today (i.e., use rolinherit).  Does this sound right?
>> 
>> Yeah, that could be an alternative to the patch I proposed previously.
>> What do you (and others) think of that idea?
> 
> I like it.  If rolinherit is left in place, existing pg_dumpall scripts
> will continue to work, and folks can continue to use the role-level option
> exactly as they do today.  However, we'd be adding the ability to use a
> grant-level option if desired, and it would be relatively easy to reason
> about (i.e., the grant-level option always takes precedence over the
> role-level option).  Also, AFAICT this strategy still provides the full set
> of behavior that would be possible if only the grant-level option existed.

Would this allow for an explicit REVOKE to override a default INHERIT 
along a specific path?

-- 
Joe Conway
RDS Open Source Databases
Amazon Web Services: https://aws.amazon.com