Message-ID: <3c86885b0facc66eede94113123c1c3be39837fe.camel@j-davis.com>
Subject: Re: Non-superuser subscription owners
From: Jeff Davis <pgsql@j-davis.com>
To: Amit Kapila <amit.kapila16@gmail.com>
Cc: Mark Dilger <mark.dilger@enterprisedb.com>, Andrew Dunstan
 <andrew@dunslane.net>, PostgreSQL-development
 <pgsql-hackers@postgresql.org>,  Robert Haas <robertmhaas@gmail.com>
Date: Sat, 08 Jan 2022 09:14:59 -0800
In-Reply-To: <CAA4eK1LjheLm0UrKgqiEf+62-FcLYBnt+Ww2n-5L9ao=_2gDqg@mail.gmail.com>
References: <9DFC88D3-1300-4DE8-ACBC-4CEF84399A53@enterprisedb.com>
	 <c1c334a2-5d85-687f-f0dc-0ac8c422ca1a@dunslane.net>
	 <CD02D159-7260-4247-888F-2CFA7AD3798D@enterprisedb.com>
	 <6BB4451E-7B1B-474C-BD1F-DB7531E720C6@enterprisedb.com>
	 <aa28945f9f348307c8ac833a937b5fca732668b8.camel@j-davis.com>
	 <6A2B0FF6-CC86-48CE-B0D3-5401AA5CFEA9@enterprisedb.com>
	 <b6f6ed921b6e219875801857204b14bbc8782e5e.camel@j-davis.com>
	 <CF56AC0D-7495-4E8D-A48F-FF38BD8074EB@enterprisedb.com>
	 <CAA4eK1KHE_xmxk==CqTcTzceC_n00tRWBLm3DGUWhaaPTguz3A@mail.gmail.com>
	 <1BB0A553-3FE9-4A91-A975-6F9D8C157FBD@enterprisedb.com>
	 <CAA4eK1LBjtqHH2h4TO7FHG=FJRfygfkeEb7AFj-dh6rqg3xqUA@mail.gmail.com>
	 <CC5DAC9C-F767-4256-BFEF-32D5A566D254@enterprisedb.com>
	 <7C62876F-5D19-4B5C-96AC-5590B10A49B2@enterprisedb.com>
	 <66f55a6b9ff7bdd6bfd0d05e8fd8351690e69e23.camel@j-davis.com>
	 <92BEDE2A-8043-4F50-9BD8-46977A9A2972@enterprisedb.com>
	 <CAA4eK1L3-qAtLO4sNGaNhzcyRi_Ufmh2YPPnUjkROBK0tN=x=g@mail.gmail.com>
	 <fbe510fe68873607e9d2e1e0fc699acb9a50bbec.camel@j-davis.com>
	 <CAA4eK1LjheLm0UrKgqiEf+62-FcLYBnt+Ww2n-5L9ao=_2gDqg@mail.gmail.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Archived-At: <https://www.postgresql.org/message-id/3c86885b0facc66eede94113123c1c3be39837fe.camel%40j-davis.com>
Precedence: bulk

On Sat, 2022-01-08 at 15:35 +0530, Amit Kapila wrote:
> On Sat, Jan 8, 2022 at 1:01 PM Jeff Davis <pgsql@j-davis.com> wrote:
> > 
> > On Sat, 2022-01-08 at 12:27 +0530, Amit Kapila wrote:
> > > For Update/Delete, we do read the table first via
> > > FindReplTupleInLocalRel(), so is there a need to check ACL_SELECT
> > > before that?
> > 
> > If it's logically an update/delete, then I think ACL_UPDATE/DELETE
> > is
> > the right one to check. Do you have a different opinion?
> > 
> 
> But shouldn't we do it the first time before accessing the table?

I'm not sure I follow the reasoning. Are you saying that, to logically
replay a simple DELETE, the subscription owner should have SELECT
privileges on the destination table?

Is there a way that a subscription owner could somehow exploit a DELETE
privilege to see the contents of a table on which they have no SELECT
privileges? Or is it purely an internal read, which is necessary for
any ordinary local DELETE/UPDATE anyway?

Regards,
	Jeff Davis