From: Nathan Bossart <nathandbossart@gmail.com>
To: Fujii Masao <masao.fujii@oss.nttdata.com>
Cc: PostgreSQL Developers <pgsql-hackers@lists.postgresql.org>
Subject: Re: pg_maintain and USAGE privilege on schema
Date: Wed, 10 Jul 2024 09:04:24 -0500
Message-ID: <Zo6U6I4b82th7QqT@nathan> (raw)
In-Reply-To: <e4462067-96ac-4c52-8402-d8de54c4e5d2@oss.nttdata.com>
References: <56596b81-088f-4c0c-9a88-b5f27a7a62e9@oss.nttdata.com>
<ZotLWGf1O86n9XRx@nathan>
<e4462067-96ac-4c52-8402-d8de54c4e5d2@oss.nttdata.com>
On Wed, Jul 10, 2024 at 05:13:58PM +0900, Fujii Masao wrote:
> However, unlike the database owner, pg_maintain by definition should
> have *all* the rights needed for maintenance tasks, including MAINTAIN
> rights on tables and USAGE rights on schemas? ISTM that both
> pg_read_all_data and pg_write_all_data roles are defined similarly,
> with USAGE rights on all schemas. So, granting USAGE rights to
> pg_maintain, but not the database owner, doesn't seem so odd to me.
It doesn't seem so odd to me, either. But there are other things that
could prevent a role with privileges of pg_maintain from being able to
VACUUM a table. For example, the role might not have LOGIN, or it might
not have CONNECT on the database. I think the argument for giving
pg_maintain roles implicit USAGE on all schemas for only maintenance
commands is that we already do that in some cases (e.g., a database-wide
VACUUM).
> I'd like hear more opinions about this.
+1
--
nathan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: nathandbossart@gmail.com, masao.fujii@oss.nttdata.com, pgsql-hackers@lists.postgresql.org
Subject: Re: pg_maintain and USAGE privilege on schema
In-Reply-To: <Zo6U6I4b82th7QqT@nathan>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox