MIME-Version: 1.0
References: <20221207223924.GA4182184@nathanxps13>
 <20221208022559.GA27893@telsasoft.com>
 <20221208041313.GA216874@nathanxps13>
 <b4d634cf-d893-f0f1-74ce-07675317575c@dunslane.net>
 <20221208181324.GA4385@nathanxps13>
In-Reply-To: <20221208181324.GA4385@nathanxps13>
From: Robert Haas <robertmhaas@gmail.com>
Date: Thu, 8 Dec 2022 16:08:40 -0500
Message-ID: 
 <CA+TgmoaWhAjTP3a9xjA2P=xkF-RV9UOYT11JVWgQq5A8AB9ZrA@mail.gmail.com>
Subject: Re: fix and document CLUSTER privileges
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Andrew Dunstan <andrew@dunslane.net>,
 Justin Pryzby <pryzby@telsasoft.com>,
	pgsql-hackers@postgresql.org
Content-Type: text/plain; charset="UTF-8"
Archived-At: 
 <https://www.postgresql.org/message-id/CA%2BTgmoaWhAjTP3a9xjA2P%3DxkF-RV9UOYT11JVWgQq5A8AB9ZrA%40mail.gmail.com>
Precedence: bulk

On Thu, Dec 8, 2022 at 1:13 PM Nathan Bossart <nathandbossart@gmail.com> wrote:
> On Thu, Dec 08, 2022 at 07:20:28AM -0500, Andrew Dunstan wrote:
> > We should probably talk about what the privileges should be, though. I
> > think there's a case to be made that CLUSTER should be governed by the
> > VACUUM privileges, given how VACUUM FULL is now implemented.
>
> Currently, CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX (minus REINDEX
> SCHEMA|DATABASE|SYSTEM) require ownership of the relation or superuser.  In
> fact, all three use the same RangeVarCallbackOwnsTable() callback function.
> My current thinking is that this is good enough.  I don't sense any strong
> demand for allowing database owners to run these commands on all non-shared
> relations, and there's ongoing work to break out the privileges to GRANT
> and predefined roles.

+1.

I don't see why being the database owner should give you the right to
run a random subset of commands on any table in the database. Tables
have their own system for access privileges; we should use that, or
extend it as required.

-- 
Robert Haas
EDB: http://www.enterprisedb.com