Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oH4JC-0000Ir-C8 for pgsql-hackers@arkaria.postgresql.org; Thu, 28 Jul 2022 14:16:14 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1oH4JB-0007dh-AS for pgsql-hackers@arkaria.postgresql.org; Thu, 28 Jul 2022 14:16:13 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1oH4JB-0007dX-0y for pgsql-hackers@lists.postgresql.org; Thu, 28 Jul 2022 14:16:13 +0000 Received: from mail-pl1-x62c.google.com ([2607:f8b0:4864:20::62c]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1oH4J8-0004Qi-La for pgsql-hackers@postgresql.org; Thu, 28 Jul 2022 14:16:11 +0000 Received: by mail-pl1-x62c.google.com with SMTP id t2so1935864ply.2 for ; Thu, 28 Jul 2022 07:16:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb.com; s=google; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-transfer-encoding:content-language; bh=EJqCGD21dKhgMkuFIw0DTF8JthwXrwIzMUPvFab96UE=; b=H49dgybkYsl6LL4jxqST3oj/uk6iZz8OyGZX7182W2j6PRlK6nIF/eA/LlNapZTvV+ i0B9zxR1tkEEnacvRSbJUzMpWVJuUhTqP71YjlO1VOwAB9tiz9pEe0PHKzygevELFD7l ID03r89sstgLgoXSVPJG74FARSaIIwe0YCVz6iELQqVGDnQ/7PxWOCMMpODTzNKnZpLa pdL5kYWi5zOzBtfYsa3/Q/rL5u1wQa8DWL5hM4gQqRmF8+Jjmf2FBKwPNKJhgDWQJ/TM B8Y2pY5sfdNo29nENKdGZKmTfn8QIlkMRfUMPFozXKpY9YFdFb2T7oRfZdRP9lJpE3yb crNA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding :content-language; bh=EJqCGD21dKhgMkuFIw0DTF8JthwXrwIzMUPvFab96UE=; b=GNMWNDPXtGMkIMP2/5HFv7JlH7CpnGnT/JErsgmQ3CZ6pJNruaOcpn3LdSi6Zm3yUx un+/eh4VYu2XM4ziOj0SWUIShhmbnDu0/JFsbGMxoPzCyIlu/m5u5BfoQFbidlEzDXdg rE/ybWEQU6l5+WdYhSVcQHic2DXGENPLGTGRTjMO9iYWR+uGeOCQbRE38fepqpwBHrqA lndDkJ6dBlWGSA4vPJhxbAfh2oW8/sfQLM8RKD1frYglk8KvNtiT8a1vqzdWqv9tazlb L+4qVk1zO+/7PiedDopLcRLBgYIRW5eFqiWHXgpGwBrKuUxERZ4O//tESrvRcZRHvW/X Xgqg== X-Gm-Message-State: AJIora8Ew4hJ/xs9eqB7e9aM+QocQD0T+JkMZ+EgubH3pdb0jwmWIri1 9O28wiuPgddsqNiJyAALBaupKXkyWliC/BmBYHYlKitPEXIz7Y1ArCDQgVDCCGlTFeGg809EmjG 7xWIleMEjFlcKLsvIm2QTa6oQCaZ1Fc1VohvjcbuIfPwgpme/8kJVBRSN1XhuVqPnrXl1OXgDET oH/8unFA8Q0NcS3DGMaCpZfM6rFAi3uqSJ/EMyWrmHsBcUx5UfjR11wmi9MPtKHIXj9YXdLfNpR fLJ/pz/ZCcnt+RQfEF7E24qcfEKv8r4yKowaw== X-Google-Smtp-Source: AGRyM1v+OxQSFOHvS0a+tOXijLLr0z3RVxlshzeo26Z6BtoRolYt2NkwJNGYs9vt4qfbg+hh3KhalA== X-Received: by 2002:a17:90a:714b:b0:1f2:21e9:b089 with SMTP id g11-20020a17090a714b00b001f221e9b089mr10636099pjs.241.1659017768760; Thu, 28 Jul 2022 07:16:08 -0700 (PDT) Received: from localhost.localdomain ([114.143.109.178]) by smtp.gmail.com with ESMTPSA id 32-20020a631160000000b0041b34595becsm1014316pgr.50.2022.07.28.07.16.05 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 28 Jul 2022 07:16:07 -0700 (PDT) Subject: Re: replacing role-level NOINHERIT with a grant-level option To: Robert Haas Cc: Nathan Bossart , Joe Conway , Tom Lane , "Bossart, Nathan" , Stephen Frost , PostgreSQL-development References: <20220701025830.GA369935@nathanxps13> <442d7887-645d-0e31-e971-7a8dc8952d2f@joeconway.com> <20220701211225.GA418166@nathanxps13> <20220702221635.GB1044460@nathanxps13> <20220703171742.GB1048244@nathanxps13> <8210e573-c861-fe45-302b-56d7352aae48@enterprisedb.com> From: tushar Message-ID: Date: Thu, 28 Jul 2022 19:45:58 +0530 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.14.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Content-Language: en-US X-CLOUD-SEC-AV-Info: enterprisedb,google_mail,monitor X-CLOUD-SEC-AV-Sent: true X-Gm-Spam: 0 X-Gm-Phishy: 0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On 7/19/22 12:56 AM, Robert Haas wrote: > Another good catch. Here is v5 with a fix for that problem. Here is one scenario in which I have NOT granted (inherit false) explicitly but still revoke command is changing the current state postgres=# create group foo; CREATE ROLE postgres=# create user bar in group foo; CREATE ROLE postgres=# revoke inherit option for foo from bar; REVOKE ROLE [edb@centos7tushar bin]$ ./pg_dumpall > /tmp/a11 [edb@centos7tushar bin]$ cat /tmp/a11 |grep 'inherit false' -i GRANT foo TO bar WITH INHERIT FALSE GRANTED BY edb; I think this revoke command should be ignored and inherit option should remain 'TRUE' as it was before? -- regards,tushar EnterpriseDB https://www.enterprisedb.com/ The Enterprise PostgreSQL Company