public inbox for [email protected]  

help / color / mirror / Atom feed

From: Jeff Davis <[email protected]>
To: Nathan Bossart <[email protected]>
Cc: Ted Yu <[email protected]>
Cc: Pavel Luzanov <[email protected]>
Cc: Justin Pryzby <[email protected]>
Cc: [email protected]
Subject: Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX
Date: Fri, 13 Jan 2023 13:30:28 -0800
Message-ID: <[email protected]> (raw)
In-Reply-To: <20230113203334.GA2206335@nathanxps13>
References: <[email protected]>
	<[email protected]>
	<[email protected]>
	<[email protected]>
	<20221217060408.GA1256247@nathanxps13>
	<CALte62zW+s+V3fDUxP2ZYk2f=DZsyZO-Aa_bbiA39=wrz=UHuQ@mail.gmail.com>
	<20221218233018.GA1476904@nathanxps13>
	<20230103234549.GA289060@nathanxps13>
	<20230109225157.GA1288965@nathanxps13>
	<[email protected]>
	<20230113203334.GA2206335@nathanxps13>

On Fri, 2023-01-13 at 12:33 -0800, Nathan Bossart wrote:
> That would fix the problem in the original complaint, but it wouldn't
> allow
> for vacuuming toast tables directly if you only have MAINTAIN
> privileges on
> the main relation.  If you can vacuum the toast table indirectly via
> the
> main relation, shouldn't it be possible to vacuum it directly?

Perhaps, but that's barely supported today: you have to awkwardly find
the internal toast table name yourself, and you need the admin to grant
you USAGE on the pg_toast schema. I don't think we're obligated to also
support this hackery for non-owners with a new MAINTAIN privilege.

If we care about that use case, let's do it right and have forms of
VACUUM/CLUSTER/REINDEX that check permissions on the main table, skip
the work on the main table, and descend directly to the toast tables.
That doesn't seem hard, but it's a separate patch.

Right now, we should simply fix the problem.

-- 
Jeff Davis
PostgreSQL Contributor Team - AWS

view thread (18+ messages)  latest in thread

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: [email protected]
  Cc: [email protected], [email protected], [email protected], [email protected], [email protected]
  Subject: Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX
  In-Reply-To: <[email protected]>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox