Message-ID: <e25c84fafae4eb08d8a6e83207678096bac102d6.camel@j-davis.com>
Subject: Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX
From: Jeff Davis <pgsql@j-davis.com>
To: Nathan Bossart <nathandbossart@gmail.com>
Cc: Ted Yu <yuzhihong@gmail.com>, Pavel Luzanov <p.luzanov@postgrespro.ru>, 
	Justin Pryzby <pryzby@telsasoft.com>, pgsql-hackers@postgresql.org
Date: Fri, 13 Jan 2023 13:30:28 -0800
In-Reply-To: <20230113203334.GA2206335@nathanxps13>
References: <20221214221140.GA1153@telsasoft.com>
	 <cf56dc1a36e5c15e19c4be634038029096d96dab.camel@j-davis.com>
	 <b41c0577-8e16-c0fc-0d98-f17155047354@postgrespro.ru>
	 <295e86c7aeafb8e2623f8eccdc846855bf2c7e0c.camel@j-davis.com>
	 <20221217060408.GA1256247@nathanxps13>
	 <CALte62zW+s+V3fDUxP2ZYk2f=DZsyZO-Aa_bbiA39=wrz=UHuQ@mail.gmail.com>
	 <20221218233018.GA1476904@nathanxps13>
	 <20230103234549.GA289060@nathanxps13>
	 <20230109225157.GA1288965@nathanxps13>
	 <7d2a8b72e23c8236281c6e00ae790327f965a8e5.camel@j-davis.com>
	 <20230113203334.GA2206335@nathanxps13>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4-0ubuntu1 
MIME-Version: 1.0
Archived-At: <https://www.postgresql.org/message-id/e25c84fafae4eb08d8a6e83207678096bac102d6.camel%40j-davis.com>
Precedence: bulk

On Fri, 2023-01-13 at 12:33 -0800, Nathan Bossart wrote:
> That would fix the problem in the original complaint, but it wouldn't
> allow
> for vacuuming toast tables directly if you only have MAINTAIN
> privileges on
> the main relation.=C2=A0 If you can vacuum the toast table indirectly via
> the
> main relation, shouldn't it be possible to vacuum it directly?

Perhaps, but that's barely supported today: you have to awkwardly find
the internal toast table name yourself, and you need the admin to grant
you USAGE on the pg_toast schema. I don't think we're obligated to also
support this hackery for non-owners with a new MAINTAIN privilege.

If we care about that use case, let's do it right and have forms of
VACUUM/CLUSTER/REINDEX that check permissions on the main table, skip
the work on the main table, and descend directly to the toast tables.
That doesn't seem hard, but it's a separate patch.

Right now, we should simply fix the problem.

--=20
Jeff Davis
PostgreSQL Contributor Team - AWS