Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kBi89-0002wv-Pv for pgsql-hackers@arkaria.postgresql.org; Fri, 28 Aug 2020 17:25:37 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kBi87-00059L-If for pgsql-hackers@arkaria.postgresql.org; Fri, 28 Aug 2020 17:25:35 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kBi87-00059E-Bd for pgsql-hackers@lists.postgresql.org; Fri, 28 Aug 2020 17:25:35 +0000 Received: from tamriel.snowman.net ([96.255.250.162]) by makus.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kBi85-0002rl-0q for pgsql-hackers@lists.postgresql.org; Fri, 28 Aug 2020 17:25:34 +0000 Received: by tamriel.snowman.net (Postfix, from userid 1000) id 4419F5F79F; Fri, 28 Aug 2020 13:25:32 -0400 (EDT) Date: Fri, 28 Aug 2020 13:25:32 -0400 From: Stephen Frost To: Gilles Darold Cc: pgsql-hackers@lists.postgresql.org Subject: Re: New default role- 'pg_read_all_data' Message-ID: <20200828172532.GD29590@tamriel.snowman.net> References: <20200828003023.GU29590@tamriel.snowman.net> <20200828123847.GV29590@tamriel.snowman.net> <20200828132645.GZ29590@tamriel.snowman.net> <6a78c0d5-d010-f2b5-198f-b35eb152f3c4@darold.net> <20200828145219.GA29590@tamriel.snowman.net> <1091e05d-66fa-b56c-9b60-dc1bde6cf9dc@darold.net> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="/nSHXsTPpeki2hUB" Content-Disposition: inline In-Reply-To: <1091e05d-66fa-b56c-9b60-dc1bde6cf9dc@darold.net> User-Agent: Mutt/1.5.24 (2015-08-30) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --/nSHXsTPpeki2hUB Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Greetings, * Gilles Darold (gilles@darold.net) wrote: > Le 28/08/2020 =E0 16:52, Stephen Frost a =E9crit=A0: > >Using an FDW will often also require having a user mapping and there's > >no way for that to be accomplished through only GRANT'ing a default > >role, so I don't think we should mix this specific role with the FDW > >permissions system. >=20 > I'm fine with that, perhaps it should be mentioned in the documentation t= hat > foreign tables are not covered by this role. We could say it doesn't GRANT CONNECT rights on databases, or EXECUTE on functions too, but that doesn't seem like a terribly good approach for the documentation to take- instead we document specifically what IS included, which seems sufficiently clear to me. Thanks, Stephen --/nSHXsTPpeki2hUB Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCgAGBQJfST4LAAoJEO1sijiDR2RVDFAP/31nhidSiQmtH1FGp5nvKwA9 Q1J1dEQRz2Bw3YZVh68dcKjrOXCY2Ta1ddFMUXVkTcVtfrqJv8uKgcvzpEg39Q7A SjBtnyLcgeRptGXHwdIFwF+Meyh4lT9Ly9CCbQiqPHxkIgtthZhfXLUJYbV9fmzw g/S3bv/Dsuk/IaEnvqIMNyDSBVo9DKh2NwenwW1oQeSRIjfwx32KGcut52zX+2By Sfqh64D6N3FYcPhvfoHy9flPSCUmFIZJe7swJPAVzWmcIvrVup7V6NNxzGU1k2Hn MVXH7xEA4cnmRTE9eVs264+TuoZMlaK5c5IQTDdM2S+2336l77oHEeWrll/v0SZ1 WHeD0dLoKxD1YwqCHaaL3WyXkFNpeWtLUyyqE3Vv5TO0GBR4rX7m8HZC5Tk9j6cP c4Cm0FyK9B8ZwFgnL53MN9Jxso0/8Z4gJfMIjVudi+aWKvgUvtXaFnQW3ZTuHzBq jzSYTRtvE18tsRyi8sqcAOltyKwJh6TTrNr0V+QfGE59qTt574kutKuiJawGxaIX PCR8TMXT1Af66jw8XG/RM5AeqdXeyPBSA8S/88BD86rIueXE81U+sF3X2dpEBWs3 KAhh7yfI5b/0n0mcu5xhQJkvSTVsZls1CDbeeLqKPL9edSLNFmT2AyE5r1ifrnjD PDl2puOvzFCgWnMFUg98 =jkKU -----END PGP SIGNATURE----- --/nSHXsTPpeki2hUB--