Message-ID: <2e2f9ae2-50fc-1a03-394c-ed4288a8cae2@enterprisedb.com>
Date: Thu, 10 Mar 2022 20:05:02 +0100
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:91.0)
 Gecko/20100101 Thunderbird/91.6.2
Subject: Re: role self-revocation
Content-Language: en-US
To: Robert Haas <robertmhaas@gmail.com>
Cc: "David G. Johnston" <david.g.johnston@gmail.com>,
 Stephen Frost <sfrost@snowman.net>,
 Joshua Brindle <joshua.brindle@crunchydata.com>,
 Mark Dilger <mark.dilger@enterprisedb.com>,
 Andrew Dunstan <andrew@dunslane.net>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
References: <CAGB+Vh4Qb4+5zrJ2pJio6rxy2+hnt2zhTmonxgzfF3wY4H6WRw@mail.gmail.com>
 <CA+Tgmob_rJtHdjMOqiOcGtk0vU6XXjOqQ0LSvVpUJjvdY341rw@mail.gmail.com>
 <20220228190923.GJ10577@tamriel.snowman.net>
 <CA+TgmobNfJvG6keNU6YcykJnntDm_-BxN_5JDacakusr5E0hEg@mail.gmail.com>
 <CAKFQuwb3=Zdp2-mEPWbTmktt3NLRNdprGi7=DqfG-pxpTQo43w@mail.gmail.com>
 <CA+TgmoY9SLMEpCcVFw9gs-9_ihK+3T7P0_4zkMDfXk8DfvheYA@mail.gmail.com>
 <CAKFQuwbmx9bSu6iob-k88APFZtzvPVmXFjAjdR0u3MqR3TWzzg@mail.gmail.com>
 <CA+TgmobHD6zVgRnNrz-7=Wm6W-76Q4Qrrif4zmhk522G5ay9Fw@mail.gmail.com>
 <0c095133-7dc7-7a11-b773-0318807380db@enterprisedb.com>
 <CA+Tgmobbnro+Z-uFZCGr_y6wq8gANo8EaYSvcZK2kekDdtFaZA@mail.gmail.com>
From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
In-Reply-To: <CA+Tgmobbnro+Z-uFZCGr_y6wq8gANo8EaYSvcZK2kekDdtFaZA@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/2e2f9ae2-50fc-1a03-394c-ed4288a8cae2%40enterprisedb.com>
Precedence: bulk

On 09.03.22 14:02, Robert Haas wrote:
> On Wed, Mar 9, 2022 at 7:55 AM Peter Eisentraut
> <peter.eisentraut@enterprisedb.com> wrote:
>> Do we have subtractive permissions today?
> 
> Not in the GRANT/REVOKE sense, I think, but you can put a user in a
> group and then mention that group in pg_hba.conf. And that line might
> be "reject" or whatever.

Well, you can always build an external system that looks at roles and 
does nonsensical things with it.  But the privilege system itself seems 
to be additive only.  Personally, I agree with the argument that there 
should not be any subtractive permissions.  The mental model where 
permissions are sort of keys to doors or boxes just doesn't work for that.