Date: Wed, 14 Dec 2022 16:11:40 -0600
From: Justin Pryzby <pryzby@telsasoft.com>
To: Pavel Luzanov <p.luzanov@postgrespro.ru>
Cc: Jeff Davis <pgsql@j-davis.com>,
	Nathan Bossart <nathandbossart@gmail.com>,
	pgsql-hackers@postgresql.org
Subject: Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX
Message-ID: <20221214221140.GA1153@telsasoft.com>
References: <20221208183707.GA55474@nathanxps13>
 <210dc2cc663934f8b463e4effa9af86225e46ce4.camel@j-davis.com>
 <20221210204109.GA197392@nathanxps13>
 <20221212200427.GA448418@nathanxps13>
 <20221212210136.GA449764@nathanxps13>
 <b19eaf6601d142f96ff4c3c3591f430cd81befbd.camel@j-davis.com>
 <20221214032332.GA671806@nathanxps13>
 <b572d238-0de2-9cad-5f34-4741dc627834@postgrespro.ru>
 <f746293762ae262e321f89153d653173ba759636.camel@j-davis.com>
 <8f7172da-2b58-3bd0-97ae-5126e2a7970c@postgrespro.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <8f7172da-2b58-3bd0-97ae-5126e2a7970c@postgrespro.ru>
User-Agent: Mutt/1.9.4 (2018-02-28)
Archived-At: 
 <https://www.postgresql.org/message-id/20221214221140.GA1153%40telsasoft.com>
Precedence: bulk

On Thu, Dec 15, 2022 at 01:02:39AM +0300, Pavel Luzanov wrote:
> On 14.12.2022 22:46, Jeff Davis wrote:
> > The behavior is that MAINTAIN
> > privileges on the partitioned table does not imply MAINTAIN privileges
> > on the partitions. I believe that's fine and it's consistent with other
> > privileges on partitioned tables, such as SELECT and INSERT.
> 
> Sorry, I may have missed something, but here's what I see:
> 
> postgres@postgres(16.0)=# create table p (id int) partition by list (id);
> postgres@postgres(16.0)=# create table p1 partition of p for values in (1);
> postgres@postgres(16.0)=# create table p2 partition of p for values in (2);
> 
> postgres@postgres(16.0)=# grant select, insert, maintain on p to alice ;
> 
> postgres@postgres(16.0)=# \c - alice
> You are now connected to database "postgres" as user "alice".
> 
> alice@postgres(16.0)=> insert into p values (1);
> INSERT 0 1
> alice@postgres(16.0)=> select * from p;
>  id
> ----
>   1
> (1 row)
> 
> alice@postgres(16.0)=> vacuum p;
> WARNING:  permission denied to vacuum "p1", skipping it
> WARNING:  permission denied to vacuum "p2", skipping it
> VACUUM

Yeah, but:

regression=> insert into p1 values (1);
ERROR:  permission denied for table p1
regression=> select * from p1;
ERROR:  permission denied for table p1