Message-ID: <cf56dc1a36e5c15e19c4be634038029096d96dab.camel@j-davis.com>
Subject: Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX
From: Jeff Davis <pgsql@j-davis.com>
To: Justin Pryzby <pryzby@telsasoft.com>, Pavel Luzanov
	 <p.luzanov@postgrespro.ru>
Cc: Nathan Bossart <nathandbossart@gmail.com>, pgsql-hackers@postgresql.org
Date: Wed, 14 Dec 2022 16:18:05 -0800
In-Reply-To: <20221214221140.GA1153@telsasoft.com>
References: <20221208183707.GA55474@nathanxps13>
	 <210dc2cc663934f8b463e4effa9af86225e46ce4.camel@j-davis.com>
	 <20221210204109.GA197392@nathanxps13> <20221212200427.GA448418@nathanxps13>
	 <20221212210136.GA449764@nathanxps13>
	 <b19eaf6601d142f96ff4c3c3591f430cd81befbd.camel@j-davis.com>
	 <20221214032332.GA671806@nathanxps13>
	 <b572d238-0de2-9cad-5f34-4741dc627834@postgrespro.ru>
	 <f746293762ae262e321f89153d653173ba759636.camel@j-davis.com>
	 <8f7172da-2b58-3bd0-97ae-5126e2a7970c@postgrespro.ru>
	 <20221214221140.GA1153@telsasoft.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4-0ubuntu1 
MIME-Version: 1.0
Archived-At: 
 <https://www.postgresql.org/message-id/cf56dc1a36e5c15e19c4be634038029096d96dab.camel%40j-davis.com>
Precedence: bulk

On Wed, 2022-12-14 at 16:11 -0600, Justin Pryzby wrote:
> Yeah, but:
>=20
> regression=3D> insert into p1 values (1);
> ERROR:=C2=A0 permission denied for table p1
> regression=3D> select * from p1;
> ERROR:=C2=A0 permission denied for table p1

Right, that's what I had in mind: a user is only granted operations on
the partitioned table, not the partitions.

It happens that an INSERT or SELECT on the partitioned table flows
through to the partitions, whereas the VACUUM ends up skipping them, so
I guess the analogy could be interpreted either way. Hmmm...

Thinking about it another way: logical partitioning is about making the
table logically one table, but physically many tables. That would imply
that the privileges should apply per-partition. But then that doesn't
make a lot of sense, because what maintenance can you do on the
partitioned table (which itself has no data)?

There's definitely a problem with this patch and partitioning, because
REINDEX affects the partitions, CLUSTER is a no-op, and VACUUM/ANALYZE
skip them.


--=20
Jeff Davis
PostgreSQL Contributor Team - AWS