Message-ID: <5591d661ea8189f5c057f6b48095f742e0d772f9.camel@j-davis.com>
Subject: Re: Avoid orphaned objects dependencies, take 3
From: Jeff Davis <pgsql@j-davis.com>
To: Bertrand Drouvot <bertranddrouvot.pg@gmail.com>
Cc: Heikki Linnakangas <hlinnaka@iki.fi>, Robert Haas
 <robertmhaas@gmail.com>,  Roman Eskin <r.eskin@arenadata.io>, Michael
 Paquier <michael@paquier.xyz>, Alexander Lakhin <exclusion@gmail.com>,
 pgsql-hackers@lists.postgresql.org, Tom Lane <tgl@sss.pgh.pa.us>
Date: Thu, 18 Jun 2026 16:21:33 -0700
In-Reply-To: <ajI0Tz9dIJvLGHNY@bdtpg>
References: <02e28438bd448ff4ee8f6fd78e6b74e657172d73.camel@j-davis.com>
	 <aiLKkTC6QBt8i35P@bdtpg>
	 <71eb9a8835a28165939da567a9d649fe6d21bfa7.camel@j-davis.com>
	 <aie26jMSoEMrHLaI@bdtpg>
	 <0fc145b9b5cf3f59207cf4ca60270448a2891c46.camel@j-davis.com>
	 <ailZCCmS0bGlNBfe@bdtpg> <ail/6I6mcitovsUo@bdtpg>
	 <a9eba27eeceebe751490951f0cf631906d4ffd75.camel@j-davis.com>
	 <ajEg7PrJYWnmB6zk@bdtpg>
	 <ac52a6aa6be9ccf5cf43c44d009b6e2aa7e2c93d.camel@j-davis.com>
	 <ajI0Tz9dIJvLGHNY@bdtpg>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.52.3-0ubuntu1.1 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/5591d661ea8189f5c057f6b48095f742e0d772f9.camel%40j-davis.com>
Precedence: bulk

On Wed, 2026-06-17 at 05:44 +0000, Bertrand Drouvot wrote:
> > IIUC, this is necessary for correctness. If an ACL failure doesn't
> > cause a transaction abort, then there's a danger that we cause the
> > transaction to fail that should have succeeded.
>=20
> Exactly, because we'd recheck an "harmless" failed ACL check and then
> produce
> an error.
>=20
> > So the ACL tracking needs to be precise: we can't track an ACL
> > check
> > unless a failure always causes transaction abort; and we must track
> > an
> > ACL check if it would cause a transaction abort. Right?
>=20
> I would say: we just need to track (and recheck) ACL checks that
> succeeded.

IIUC, we cannot have false positives (tracking ACL checks that wouldn't
have caused an abort) nor can we have false negatives (missing an ACL
check that could cause an abort).

It's hard for me to convince myself that we got all the cases right;
and if we have, that they won't be broken in the future.

For instance, I just realized that something else I'm working on is
related:

https://www.postgresql.org/message-id/5c629d2455946ad2fde3c184f64ea2c323ef2=
133.camel@j-davis.com

It does an ACL check inside a subtransaction, where the parent
transaction is a DDL statement. It happens to be a DROP statement, so
it's not recording new dependencies, so I don't think it breaks your
tracking mechanism, but it's too close for comfort.

We could keep the transaction ID in the tracking record, and ignore
entries from an aborted subxact. But it's getting fairly complex and
delicate.

Thoughts?

Regards,
	Jeff Davis