Date: Fri, 9 Dec 2022 10:40:55 -0800
From: Nathan Bossart <nathandbossart@gmail.com>
To: Michael Paquier <michael@paquier.xyz>
Cc: Tom Lane <tgl@sss.pgh.pa.us>, Isaac Morland <isaac.morland@gmail.com>,
	Justin Pryzby <pryzby@telsasoft.com>,
	Pavel Luzanov <p.luzanov@postgrespro.ru>,
	pgsql-hackers@postgresql.org
Subject: Re: add \dpS to psql
Message-ID: <20221209184055.GA59417@nathanxps13>
References: <20221206193606.GB3078082@nathanxps13>
 <661148f4-c7f1-dec1-2bc8-29f3bd58e242@postgrespro.ru>
 <20221208023929.GB27893@telsasoft.com>
 <20221208041900.GB216874@nathanxps13>
 <39743.1670473532@sss.pgh.pa.us>
 <CAMsGm5drUvuH789D98Wo_bZggNhUn1LsBYuheJUbKaBsErtY9w@mail.gmail.com>
 <20221208050754.GA221222@nathanxps13>
 <45224.1670476523@sss.pgh.pa.us>
 <20221208171503.GA2113@nathanxps13>
 <Y5K7MxuH7Bi+zU5V@paquier.xyz>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <Y5K7MxuH7Bi+zU5V@paquier.xyz>
Archived-At: 
 <https://www.postgresql.org/message-id/20221209184055.GA59417%40nathanxps13>
Precedence: bulk

On Fri, Dec 09, 2022 at 01:36:03PM +0900, Michael Paquier wrote:
> On Thu, Dec 08, 2022 at 09:15:03AM -0800, Nathan Bossart wrote:
>> The main idea behind this work is breaking out privileges into more
>> granular pieces.  If I want to create a role that only runs VACUUM on some
>> tables on the weekend, why ѕhould I have to also give it the ability to
>> ANALYZE, REFRESH, CLUSTER, and REINDEX?  IMHO we should really let the user
>> decide what set of privileges makes sense for their use-case.  I'm unsure
>> the grouping all these privileges together serves much purpose besides
>> preserving ACL bits.
> 
> Hmm.  I'd like to think that we should keep a frugal mind here.  More
> bits are now available, but it does not strike me as a good idea to
> force their usage more than necessary, so grouping all these no-quite
> DDL commands into the same bag does not sound that bad to me.

Okay, it seems I am outnumbered.  I will work on updating the patch to add
an ACL_MAINTAIN bit and a pg_maintain_all_tables predefined role.

-- 
Nathan Bossart
Amazon Web Services: https://aws.amazon.com