Date: Thu, 15 Dec 2022 11:12:46 -0800
From: Nathan Bossart <nathandbossart@gmail.com>
To: Jeff Davis <pgsql@j-davis.com>
Cc: Michael Paquier <michael@paquier.xyz>,
	Alvaro Herrera <alvherre@alvh.no-ip.org>,
	Pavel Luzanov <p.luzanov@postgrespro.ru>,
	pgsql-hackers@postgresql.org
Subject: Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX
Message-ID: <20221215191246.GA252861@nathanxps13>
References: <20221214171336.GB689106@nathanxps13>
 <20221214180534.jglo7jclow3x73bd@alvherre.pgsql>
 <20221214181659.GB773264@nathanxps13>
 <efd049fb7407c5eb0cc3212e7ea43bebf48eab0f.camel@j-davis.com>
 <20221214232939.GA828727@nathanxps13>
 <Y5pmaksAYyJbSU77@paquier.xyz>
 <20221215002705.GA889413@nathanxps13>
 <8f63ff5b9188004c8e439ac16e92adf3266169b9.camel@j-davis.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <8f63ff5b9188004c8e439ac16e92adf3266169b9.camel@j-davis.com>
Archived-At: 
 <https://www.postgresql.org/message-id/20221215191246.GA252861%40nathanxps13>
Precedence: bulk

On Thu, Dec 15, 2022 at 10:42:15AM -0800, Jeff Davis wrote:
> Right now, targetting the toast table directly requires the USAGE
> privilege on the toast schema, and you have to look up the name first,
> right? As it is, that's not a great UI.
> 
> How about if we add a VACUUM option like TOAST_ONLY (or combine it with
> the PROCESS_TOAST option)? Then, you're always looking at the parent
> table first so there's no deadlock, do the permission checks on the
> parent, and then expand to the toast table with no check. This can be a
> follow-up patch; for now, the idea of skipping the privilege checks
> when expanding looks like an improvement.

I originally suggested an option to allow specifying whether to process the
main relation, but we ended up only adding PROCESS_TOAST [0].  FWIW I still
think that such an option would be useful for the reasons you describe.

[0] https://postgr.es/m/BA8951E9-1524-48C5-94AF-73B1F0D7857F%40amazon.com

-- 
Nathan Bossart
Amazon Web Services: https://aws.amazon.com