public inbox for [email protected]  

help / color / mirror / Atom feed

From: Bruce Momjian <[email protected]>
To: Noah Misch <[email protected]>
Cc: PostgreSQL-development <[email protected]>
Cc: Robert Haas <[email protected]>
Subject: Re: PG 16 draft release notes ready
Date: Wed, 9 Aug 2023 20:35:21 -0400
Message-ID: <[email protected]> (raw)
In-Reply-To: <[email protected]>
References: <[email protected]>
	<[email protected]>

On Sat, Aug  5, 2023 at 04:08:47PM -0700, Noah Misch wrote:
> > Author: Robert Haas <[email protected]>
> > 2022-08-25 [e3ce2de09] Allow grant-level control of role inheritance behavior.
> > -->
> > 
> > <listitem>
> > <para>
> > Allow GRANT to control role inheritance behavior (Robert Haas)
> > </para>
> > 
> > <para>
> > By default, role inheritance is controlled by the inheritance status of the member role.  The new GRANT clauses WITH INHERIT and WITH ADMIN can now override this.
> > </para>
> > </listitem>
> > 
> > <!--
> > Author: Robert Haas <[email protected]>
> > 2023-01-10 [e5b8a4c09] Add new GUC createrole_self_grant.
> > Author: Daniel Gustafsson <[email protected]>
> > 2023-02-22 [e00bc6c92] doc: Add default value of createrole_self_grant
> > -->
> > 
> > <listitem>
> > <para>
> > Allow roles that create other roles to automatically inherit the new role's rights or SET ROLE to the new role (Robert Haas, Shi Yu)
> > </para>
> > 
> > <para>
> > This is controlled by server variable createrole_self_grant.
> > </para>
> > </listitem>
> 
> Similarly, v16 radically changes the CREATE ROLE ... WITH INHERIT clause.  The
> clause used to "change the behavior of already-existing grants."  Let's merge
> these two and move the combination to the incompatibilities section.

I need help with this.  I don't understand how they can be combined, and
I don't understand the incompatibility text in commit e3ce2de09d:

    If a GRANT does not specify WITH INHERIT, the behavior based on
    whether the member role is marked INHERIT or NOINHERIT. This means
    that if all roles are marked INHERIT or NOINHERIT before any role
    grants are performed, the behavior is identical to what we had before;
    otherwise, it's different, because ALTER ROLE [NO]INHERIT now only
    changes the default behavior of future grants, and has no effect on
    existing ones.

-- 
  Bruce Momjian  <[email protected]>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Only you can decide what is important to you.

view thread (63+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected]
  Subject: Re: PG 16 draft release notes ready
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox