Feedback-ID: i0fe9450f:Fastmail
Date: Tue, 20 Jun 2023 14:26:42 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Jeff Davis <pgsql@j-davis.com>, Ted Yu <yuzhihong@gmail.com>,
	Pavel Luzanov <p.luzanov@postgrespro.ru>,
	Justin Pryzby <pryzby@telsasoft.com>, pgsql-hackers@postgresql.org
Subject: Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX
Message-ID: <ZJE4kgKgDM55qC24@paquier.xyz>
References: <20230113231339.GA2422750@nathanxps13>
 <20230613211246.GA219055@nathanxps13>
 <ZIj4v1CwqlDVJZfB@paquier.xyz>
 <20230613235442.GA222795@nathanxps13>
 <20230614181711.GA488295@nathanxps13>
 <ZIpfack6qJUHaw+g@paquier.xyz>
 <20230615041044.GA736001@nathanxps13>
 <20230615235700.GA877311@nathanxps13>
 <20230616052025.GA1026700@nathanxps13>
 <20230619215534.GA442477@nathanxps13>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="6l+fx4qU4wKUB4wX"
Content-Disposition: inline
In-Reply-To: <20230619215534.GA442477@nathanxps13>
Archived-At: <https://www.postgresql.org/message-id/ZJE4kgKgDM55qC24%40paquier.xyz>
Precedence: bulk


--6l+fx4qU4wKUB4wX
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Mon, Jun 19, 2023 at 02:55:34PM -0700, Nathan Bossart wrote:
> In v4 of the patch set, I moved the skip_privs flag refactoring to 0001. =
 I
> intend to commit this tomorrow unless there is additional feedback.

Fine by me.  0001 looks OK seen from here.

> These object_ownercheck() calls were removed because they were redundant,
> as owners have all privileges by default.  Privileges can be revoked from
> the owner, so an extra ownership check would effectively bypass the
> relation's ACL in that case.  I looked around and didn't see any other
> examples of a combined ownership and ACL check like we were doing for
> MAINTAIN.  The only thing that gives me pause is that the docs call out
> ownership as sufficient for some maintenance commands.  With these patche=
s,
> that's only true as long as no one revokes privileges from the owner.  IMO
> we should update the docs and leave out the ownership checks since MAINTA=
IN
> is now a grantable privilege like any other.  WDYT?

TBH, I have a mixed feeling about this line of reasoning because
MAINTAIN is much broader and less specific than TRUNCATE, for
instance, being spawned across so much more operations.  As you say,
owners of a relation have the MAINTAIN right by default, but they
would not be able to run any maintenance operations if somebody has
revoked their MAINTAIN right to do so, even if they are the owners of
the so-said relation.  Perhaps that's OK in the long run, still I have
mixed feeling about whether that's the best decision we can take here,=20
especially because MAINTAIN impacts VACUUM, ANALYZE, CLUSTER, REFRESH
MATVIEW, REINDEX and LOCK.  Some users may find that surprising as they
used to have more control over these operations as owners of the
relations worked on.
--
Michael

--6l+fx4qU4wKUB4wX
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmSROJIACgkQnvQgOdby
QH3sUBAApigFM7iFxKMgWR+0RYxUaaJkzB+5a3qtEWnDIGhYgGgS0I8dR9VwkUNP
ehJIesOiUYwegHOVTPW7xHSMwVY6iB09/9MBGEsCM7Hg8N+tYdTOJ0jpR4ZyoaFU
i77QEQU/erJ5yc016RS1KBDWf2hsXz94mhWFwtv2Rvp3Tbt+RU0VJkd8L8IgAOWq
Wxbw+CU2tMbidrT4rvKuJEDdPw8zG1O4S1hXwPVvc4iCbGs8A9iyyMsz2BEafhse
EKDUBBrLjT1gTxqOS/CmnX1hCLbMasO2zogsfCgmy2cgUaxeMboUdgwlb7Sq1/K0
UQkmkJBncMt7ejqnQdTJEyVr2SdoV/V3rQJ1SG6/XSxHiaAKz8odclVELFi4Q2jh
O3jtOLYDwdAVhC7uawTdwfkR5yzUGjmHW5vV80dRqIy7EAMvcP8s0WRhaK85IhqL
HPgAJl+1mW6VITXdkEBwGyhnYtFJ+Dkkl9mQIIFcJNQ2CyKF04Kj60W3D25uDokb
Ot31DknkFx6Agr1fxZ5F0jecD20DvASeeXacreEdwKPttBUh0g55WoLt/H+Z4hdo
AJB86VmAc17WljKDfKvwKgmBGc4Ngwrtpk7tPaeWOFaeT3WKjKUeETnmM1WY99O2
Xkn0sUp/0HtOAtEa2gUA4OLnfoFQFLPNPwDkEVNb5EWF2hZftYE=
=j+JR
-----END PGP SIGNATURE-----

--6l+fx4qU4wKUB4wX--