pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Joe Conway <mail@joeconway.com>
Cc: Nathan Bossart <nathandbossart@gmail.com>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Joshua Brindle <joshua.brindle@crunchydata.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: use has_privs_of_role() for pg_hba.conf
Date: Sat, 08 Oct 2022 11:14:06 -0400
Message-ID: <3574712.1665242046@sss.pgh.pa.us> (raw)
In-Reply-To: <87994809-5b2c-08f0-0ab3-3c76c49afada@joeconway.com>
References: <CAGB+Vh5epaDEu7aRokcuc_a7yG0B49u9ebpdViJHpyFN-exJtQ@mail.gmail.com>
	<20220404142551.GB663209@nathanxps13>
	<Yz6NRrfd7n2AXoHh@paquier.xyz>
	<491dba16-55df-d5fd-1ae7-01b5140987f0@joeconway.com>
	<20221006174343.GA444656@nathanxps13>
	<Yz+Jt9537vjfO733@paquier.xyz>
	<20221007032711.GA499771@nathanxps13>
	<Yz/Ii6dr1CSu4Bnv@paquier.xyz>
	<20221007194430.GA550749@nathanxps13>
	<3347532.1665173939@sss.pgh.pa.us>
	<20221007215836.GB814385@nathanxps13>
	<87994809-5b2c-08f0-0ab3-3c76c49afada@joeconway.com>

Joe Conway <mail@joeconway.com> writes:
> Thanks -- looks good to me. If there are no other comments or concerns, 
> I will commit/push by the end of the weekend.

Robert seems to think that this patch might be completely misguided,
so I'm not sure we have real consensus.  I think he may have a point.

An angle that he didn't bring up is that we've had proposals, and
even I think a patch, for inventing database-local privileges.
If that were to become a thing, it would interact very badly with
this idea, because it would often not be clear which set of privileges
to consider.  As long as HBA checks consider membership, and we don't
invent database-local role membership, there's no problem.

			regards, tom lane





view thread (25+ messages)  latest in thread

Message-ID: <3574712.1665242046@sss.pgh.pa.us>
Permalink:  ../3574712.1665242046@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/3574712.1665242046@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, mail@joeconway.com, nathandbossart@gmail.com, michael@paquier.xyz, joshua.brindle@crunchydata.com
  Subject: Re: use has_privs_of_role() for pg_hba.conf
  In-Reply-To: <3574712.1665242046@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox