From: Stephen Frost <sfrost@snowman.net>
To: Georgios Kokolatos <gkokolatos@protonmail.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: New default role- 'pg_read_all_data'
Date: Fri, 28 Aug 2020 08:43:03 -0400
Message-ID: <20200828124303.GW29590@tamriel.snowman.net> (raw)
In-Reply-To: <159861699631.18329.14711450552365728705.pgcf@coridan.postgresql.org>
References: <20200828003023.GU29590@tamriel.snowman.net>
<CABUevEy9QAnx5h_BmSk4j6K9AfS9=co15RUFda0kknMHO9NJOg@mail.gmail.com>
<159861699631.18329.14711450552365728705.pgcf@coridan.postgresql.org>
Greetings,
* Georgios Kokolatos (gkokolatos@protonmail.com) wrote:
> The patch seems to be implementing a useful and requested feature.
> The patch applies cleanly and passes the basic regress tests. Also the commitfest bot is happy.
>
> A first pass at the code, has not revealed any worthwhile comments.
> Please allow me for a second and more thorough pass. The commitfest has hardly started after all.
Great, thanks!
> Also allow me a series of genuine questions:
>
> What would the behaviour be with REVOKE?
> In a sequence similar to:
> GRANT ALL ON ...
GRANT ALL would be independently GRANT'ing rights to some role and
therefore unrelated.
> REVOKE pg_read_all_data FROM ...
This would simply REVOKE that role from the user. Privileges
independently GRANT'd directly to the user wouldn't be affected. Nor
would other role membership.
> What privileges would the user be left with? Would it be possible to end up in the same privilege only with a GRANT command?
I'm not sure what's being asked here.
> Does the above scenario even make sense?
I definitely believe it makes sense for a given role/user to be a member
of pg_read_all_data and to be a member of other roles, or to have other
privileges GRANT'd directly to them.
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, gkokolatos@protonmail.com, pgsql-hackers@lists.postgresql.org
Subject: Re: New default role- 'pg_read_all_data'
In-Reply-To: <20200828124303.GW29590@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox