Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1qXPIs-006DDv-Py
	for pgsql-hackers@arkaria.postgresql.org; Sat, 19 Aug 2023 16:59:58 +0000
Received: from localhost ([127.0.0.1] helo=malur.postgresql.org)
	by malur.postgresql.org with esmtp (Exim 4.94.2)
	(envelope-from <pgsql-hackers-owner+archive@lists.postgresql.org>)
	id 1qXPIq-001SBN-Os
	for pgsql-hackers@arkaria.postgresql.org; Sat, 19 Aug 2023 16:59:56 +0000
Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29])
	by malur.postgresql.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <bruce@momjian.us>)
	id 1qXPIq-001SBF-8O
	for pgsql-hackers@lists.postgresql.org; Sat, 19 Aug 2023 16:59:56 +0000
Received: from momjian.us ([72.94.173.45])
	by magus.postgresql.org with esmtps  (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
	(Exim 4.94.2)
	(envelope-from <bruce@momjian.us>)
	id 1qXPIl-0015G5-T0
	for pgsql-hackers@postgresql.org; Sat, 19 Aug 2023 16:59:55 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=momjian.us;
	s=2023062407; h=In-Reply-To:Content-Transfer-Encoding:Content-Type:
	MIME-Version:References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To:
	Content-ID:Content-Description;
	bh=Lgv5m17CnD4qvTDyOPvx3xX7EPNYZ8TYSJQ2E206PZs=; b=mrQ2yqPpOgeg7zvJu+MH9tX9KQ
	IMSTcaQtUf8xHD3VY8e+lv/9D/h/8qnhG0O7udZ3X4n1VN6ku5WTfDcffrLcX2PFn8tsuA0dPj1ED
	01eyUpKpPR/qi6jqT11ne6x21kXXRb67/Ix5NHtWpyMI9LY7sUYNrDVi7T3GcwSeAwyasOyPiD8zd
	lj6z1Dx20oJaw78HI+C7zNtVNb6ym3LZiqxLGIldZSAYqGwEOfPpBM2VZLvlrZU7xVGyUf4cJ5hdn
	fAqtdXZDcNzgpp7g7JrGSoR4DIony/xmm9zVn9OuZHcu9Ki1uLbQsmX2xs/d7kiOl5r8FN1D3L/Wu
	s/YbJcFw==;
Received: from bruce by momjian.us with local (Exim 4.96)
	(envelope-from <bruce@momjian.us>)
	id 1qXPIh-000DnY-1Y;
	Sat, 19 Aug 2023 12:59:47 -0400
Date: Sat, 19 Aug 2023 12:59:47 -0400
From: Bruce Momjian <bruce@momjian.us>
To: Pavel Luzanov <p.luzanov@postgrespro.ru>
Cc: Noah Misch <noah@leadboat.com>,
	PostgreSQL-development <pgsql-hackers@postgresql.org>,
	Robert Haas <robertmhaas@gmail.com>
Subject: Re: PG 16 draft release notes ready
Message-ID: <ZOD1Axx4p2lz0KmT@momjian.us>
References: <ZGaPa7M3gc2THeDJ@momjian.us>
 <20230805230847.GA1370050@rfd.leadboat.com>
 <ZNQwyRTGft8myjJR@momjian.us>
 <ZN2Hval7UFxl4MA6@momjian.us>
 <707faa3c-1e7b-d209-fec8-a2a6c9ee182f@postgrespro.ru>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <707faa3c-1e7b-d209-fec8-a2a6c9ee182f@postgrespro.ru>
List-Id: <pgsql-hackers.lists.postgresql.org>
List-Help: <https://lists.postgresql.org/manage/>
List-Subscribe: <https://lists.postgresql.org/manage/>
List-Post: <mailto:pgsql-hackers@lists.postgresql.org>
List-Owner: <mailto:pgsql-hackers-owner@lists.postgresql.org>
List-Archive: <https://www.postgresql.org/list/pgsql-hackers>
Archived-At: <https://www.postgresql.org/message-id/ZOD1Axx4p2lz0KmT%40momjian.us>
Precedence: bulk

On Thu, Aug 17, 2023 at 08:37:28AM +0300, Pavel Luzanov wrote:
> On 17.08.2023 05:36, Bruce Momjian wrote:
> > On Wed, Aug  9, 2023 at 08:35:21PM -0400, Bruce Momjian wrote:
> > > On Sat, Aug  5, 2023 at 04:08:47PM -0700, Noah Misch wrote:
> > > > > Author: Robert Haas <rhaas@postgresql.org>
> > > > > 2022-08-25 [e3ce2de09] Allow grant-level control of role inheritance behavior.
> > > > > -->
> > > > > 
> > > > > <listitem>
> > > > > <para>
> > > > > Allow GRANT to control role inheritance behavior (Robert Haas)
> > > > > </para>
> > > > > 
> > > > > <para>
> > > > > By default, role inheritance is controlled by the inheritance status of the member role.  The new GRANT clauses WITH INHERIT and WITH ADMIN can now override this.
> > > > > </para>
> > > > > </listitem>
> > > > > 
> > > > > <!--
> > > > > Author: Robert Haas <rhaas@postgresql.org>
> > > > > 2023-01-10 [e5b8a4c09] Add new GUC createrole_self_grant.
> > > > > Author: Daniel Gustafsson <dgustafsson@postgresql.org>
> > > > > 2023-02-22 [e00bc6c92] doc: Add default value of createrole_self_grant
> > > > > -->
> > > > > 
> > > > > <listitem>
> > > > > <para>
> > > > > Allow roles that create other roles to automatically inherit the new role's rights or SET ROLE to the new role (Robert Haas, Shi Yu)
> > > > > </para>
> > > > > 
> > > > > <para>
> > > > > This is controlled by server variable createrole_self_grant.
> > > > > </para>
> > > > > </listitem>
> > > > Similarly, v16 radically changes the CREATE ROLE ... WITH INHERIT clause.  The
> > > > clause used to "change the behavior of already-existing grants."  Let's merge
> > > > these two and move the combination to the incompatibilities section.
> > > I need help with this.  I don't understand how they can be combined, and
> > > I don't understand the incompatibility text in commit e3ce2de09d:
> > > 
> > >      If a GRANT does not specify WITH INHERIT, the behavior based on
> > >      whether the member role is marked INHERIT or NOINHERIT. This means
> > >      that if all roles are marked INHERIT or NOINHERIT before any role
> > >      grants are performed, the behavior is identical to what we had before;
> > >      otherwise, it's different, because ALTER ROLE [NO]INHERIT now only
> > >      changes the default behavior of future grants, and has no effect on
> > >      existing ones.
> > I am waiting for an answer to this question, or can I assume the release
> > notes are acceptable?
> 
> I can try to explain how I understand it myself.
> 
> In v15 and early, inheritance of granted to role privileges depends on
> INHERIT attribute of a role:
> 
> create user alice;
> grant pg_read_all_settings to alice;
> 
> By default privileges inherited:
> \c - alice
> show data_directory;
>        data_directory
> -----------------------------
>  /var/lib/postgresql/15/main
> (1 row)
> 
> After disabling the INHERIT attribute, privileges are not inherited:
> 
> \c - postgres
> alter role alice noinherit;
> 
> \c - alice
> show data_directory;
> ERROR:  must be superuser or have privileges of pg_read_all_settings to
> examine "data_directory"
> 
> In v16 changing INHERIT attribute on alice role doesn't change inheritance
> behavior of already granted roles.
> If we repeat the example, Alice still inherits pg_read_all_settings
> privileges after disabling the INHERIT attribute for the role.
> 
> Information for making decisions about role inheritance has been moved from
> the role attribute to GRANT role TO role [WITH INHERIT|NOINHERIT] command
> and can be viewed by the new \drg command:
> 
> \drg
>                     List of role grants
>  Role name |      Member of       |   Options    | Grantor
> -----------+----------------------+--------------+----------
>  alice     | pg_read_all_settings | INHERIT, SET | postgres
> (1 row)
> 
> Changing the INHERIT attribute for a role now will affect (as the default
> value) only future GRANT commands without an INHERIT clause.

I was able to create this simple example to illustrate it:

	CREATE ROLE a1;
	CREATE ROLE a2;
	CREATE ROLE a3;
	CREATE ROLE a4;
	CREATE ROLE b INHERIT;

	GRANT a1 TO b WITH INHERIT TRUE;
	GRANT a2 TO b WITH INHERIT FALSE;

	GRANT a3 TO b;
	ALTER USER b NOINHERIT;
	GRANT a4 TO b;

	\drg
	               List of role grants
	 Role name | Member of |   Options    | Grantor
	-----------+-----------+--------------+----------
	 b         | a1        | INHERIT, SET | postgres
	 b         | a2        | SET          | postgres
	 b         | a3        | INHERIT, SET | postgres
	 b         | a4        | SET          | postgres

I will work on the relase notes adjustments for this and reply in a few
days.

-- 
  Bruce Momjian  <bruce@momjian.us>        https://momjian.us
  EDB                                      https://enterprisedb.com

  Only you can decide what is important to you.