From: Tom Lane <tgl@sss.pgh.pa.us>
To: Nathan Bossart <nathandbossart@gmail.com>
cc: Isaac Morland <isaac.morland@gmail.com>,
        Justin Pryzby <pryzby@telsasoft.com>,
        Pavel Luzanov <p.luzanov@postgrespro.ru>, pgsql-hackers@postgresql.org
Subject: Re: add \dpS to psql
In-reply-to: <20221208050754.GA221222@nathanxps13>
References: <20221206193606.GB3078082@nathanxps13>
 <661148f4-c7f1-dec1-2bc8-29f3bd58e242@postgrespro.ru>
 <20221208023929.GB27893@telsasoft.com> <20221208041900.GB216874@nathanxps13>
 <39743.1670473532@sss.pgh.pa.us>
 <CAMsGm5drUvuH789D98Wo_bZggNhUn1LsBYuheJUbKaBsErtY9w@mail.gmail.com>
 <20221208050754.GA221222@nathanxps13>
Comments: In-reply-to Nathan Bossart <nathandbossart@gmail.com>
	message dated "Wed, 07 Dec 2022 21:07:54 -0800"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <45223.1670476523.1@sss.pgh.pa.us>
Date: Thu, 08 Dec 2022 00:15:23 -0500
Message-ID: <45224.1670476523@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/45224.1670476523%40sss.pgh.pa.us>
Precedence: bulk

Nathan Bossart <nathandbossart@gmail.com> writes:
> On Wed, Dec 07, 2022 at 11:48:20PM -0500, Isaac Morland wrote:
>> My previous analysis
>> shows that there is no vast hidden demand for new privilege bits. If we
>> implement MAINTAIN to control access to VACUUM, ANALYZE, REFRESH, CLUSTER,
>> and REINDEX, we will cover everything that I can find that has seriously
>> discussed on this list, and still leave 3 unused bits for future expansion.

> If we added CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX as individual
> privilege bits, we'd still have 13 remaining for future use.

I think the appropriate question is not "have we still got bits left?".
It should be more like "under what plausible scenario would it be useful
to grant somebody CLUSTER but not VACUUM privileges on a table?".

I'm really thinking that MAINTAIN is the right level of granularity
here.  Or maybe it's worth segregating exclusive-lock from
not-exclusive-lock maintenance.  But I really fail to see how it's
useful to distinguish CLUSTER from REINDEX, say.

			regards, tom lane