Date: Fri, 28 Aug 2020 08:43:03 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Georgios Kokolatos <gkokolatos@protonmail.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: New default role- 'pg_read_all_data'
Message-ID: <20200828124303.GW29590@tamriel.snowman.net>
References: <20200828003023.GU29590@tamriel.snowman.net>
 <CABUevEy9QAnx5h_BmSk4j6K9AfS9=co15RUFda0kknMHO9NJOg@mail.gmail.com>
 <159861699631.18329.14711450552365728705.pgcf@coridan.postgresql.org>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="Tup4jP+1GgnXOlJy"
Content-Disposition: inline
In-Reply-To: 
 <159861699631.18329.14711450552365728705.pgcf@coridan.postgresql.org>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--Tup4jP+1GgnXOlJy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Georgios Kokolatos (gkokolatos@protonmail.com) wrote:
> The patch seems to be implementing a useful and requested feature.
> The patch applies cleanly and passes the basic regress tests. Also the co=
mmitfest bot is happy.
>=20
> A first pass at the code, has not revealed any worthwhile comments.
> Please allow me for a second and more thorough pass. The commitfest has h=
ardly started after all.

Great, thanks!

> Also allow me a series of genuine questions:=20
>=20
> What would the behaviour be with REVOKE?
> In a sequence similar to:
> GRANT ALL ON ...

GRANT ALL would be independently GRANT'ing rights to some role and
therefore unrelated.

> REVOKE pg_read_all_data FROM ...

This would simply REVOKE that role from the user.  Privileges
independently GRANT'd directly to the user wouldn't be affected.  Nor
would other role membership.

> What privileges would the user be left with? Would it be possible to end =
up in the same privilege only with a GRANT command?

I'm not sure what's being asked here.

> Does the above scenario even make sense?

I definitely believe it makes sense for a given role/user to be a member
of pg_read_all_data and to be a member of other roles, or to have other
privileges GRANT'd directly to them.

Thanks,

Stephen

--Tup4jP+1GgnXOlJy
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJfSPvXAAoJEO1sijiDR2RVXzgP/3s32d7pcWWNUP65gVQZtrzl
NW6WrFbX2opl8BDjFUEbm98Jl2vKJT0/rP6hsef7/qJCUKnUB7x36DV/3fewvAWS
99xTr2LRZVicWIceqn5LaagMQD4cyxJF5fE1XJP9eeVMPm7nyeLmWISGakovPJg8
++WeahzMqhlpVLe1mAtsGVVyD5rTNioiVfP4T3QNe3cXutWSV5X7ZIuLcYJZrmP1
fQ1Xlz7OaDpLQyk2Kvbo3zv1kjzP2GPt8YLczQZ5uk/bMzdEfSCwExf8ppjx2cLU
gGBaOrv841SJ3OLVoGSEp8lZgNf1p2dH/ioTRV1Gy6hrQH/IjqNoFsvXo0BhyJ2W
3ewTMwsk4U4YkNmQX76UK36snSpAnBSrefmz8ZH3mLg9T2eEMXM6O4SfvjESMReY
9+LUYj+PzrHv2BcBKKxTn7Fgqq3cnKoRoSIGdEm36rof4BFX3FpgjJYJsECLFiXw
ou5wbmVK/URRar6as+9X8x1vXK2xSJMGiML9A9G+eMfuOPox9o/c3uN9Pi7YSA4D
LNokASbMhI2+D1lnx4Va1bgG0Zn3+VO3gY89vw+vMlnuhvaJ3i+y3osyze3E1clv
OJMo6Nj2VRZt7C+hS2+Q9BqTGLh50pG3H26pvzoR/GOY1qqfULVMQFCqRlfLblPJ
+xzuVAcbJbvtJHRQewyX
=ZTnr
-----END PGP SIGNATURE-----

--Tup4jP+1GgnXOlJy--