From: Tom Lane <tgl@sss.pgh.pa.us>
To: Joe Conway <mail@joeconway.com>
cc: Nathan Bossart <nathandbossart@gmail.com>,
        Michael Paquier <michael@paquier.xyz>,
        Joshua Brindle <joshua.brindle@crunchydata.com>,
        PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: use has_privs_of_role() for pg_hba.conf
In-reply-to: <87994809-5b2c-08f0-0ab3-3c76c49afada@joeconway.com>
References: 
 <CAGB+Vh5epaDEu7aRokcuc_a7yG0B49u9ebpdViJHpyFN-exJtQ@mail.gmail.com>
 <20220404142551.GB663209@nathanxps13> <Yz6NRrfd7n2AXoHh@paquier.xyz>
 <491dba16-55df-d5fd-1ae7-01b5140987f0@joeconway.com>
 <20221006174343.GA444656@nathanxps13> <Yz+Jt9537vjfO733@paquier.xyz>
 <20221007032711.GA499771@nathanxps13> <Yz/Ii6dr1CSu4Bnv@paquier.xyz>
 <20221007194430.GA550749@nathanxps13> <3347532.1665173939@sss.pgh.pa.us>
 <20221007215836.GB814385@nathanxps13>
 <87994809-5b2c-08f0-0ab3-3c76c49afada@joeconway.com>
Comments: In-reply-to Joe Conway <mail@joeconway.com>
	message dated "Sat, 08 Oct 2022 10:38:00 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <3574711.1665242046.1@sss.pgh.pa.us>
Date: Sat, 08 Oct 2022 11:14:06 -0400
Message-ID: <3574712.1665242046@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/3574712.1665242046%40sss.pgh.pa.us>
Precedence: bulk

Joe Conway <mail@joeconway.com> writes:
> Thanks -- looks good to me. If there are no other comments or concerns, 
> I will commit/push by the end of the weekend.

Robert seems to think that this patch might be completely misguided,
so I'm not sure we have real consensus.  I think he may have a point.

An angle that he didn't bring up is that we've had proposals, and
even I think a patch, for inventing database-local privileges.
If that were to become a thing, it would interact very badly with
this idea, because it would often not be clear which set of privileges
to consider.  As long as HBA checks consider membership, and we don't
invent database-local role membership, there's no problem.

			regards, tom lane