MIME-Version: 1.0
References: <A9A63660-310A-4F87-B01D-998E3A3A086A@Chaos1.DE>
In-Reply-To: <A9A63660-310A-4F87-B01D-998E3A3A086A@Chaos1.DE>
From: Steve Midgley <science@misuse.org>
Date: Tue, 25 Jun 2024 10:28:11 -0700
Message-ID: 
 <CAJexoSKVniyo9pkvZpwVEF13AaMzeqF_WA_NdK3YdjRWednPhg@mail.gmail.com>
Subject: Re: struggling with GRANT while upgrading from 13 to 16
To: Axel Rau <Axel.Rau@chaos1.de>
Cc: pgsql-sql@lists.postgresql.org
Content-Type: multipart/alternative; boundary="000000000000905b6a061bba3914"
Archived-At: 
 <https://www.postgresql.org/message-id/CAJexoSKVniyo9pkvZpwVEF13AaMzeqF_WA_NdK3YdjRWednPhg%40mail.gmail.com>
Precedence: bulk

--000000000000905b6a061bba3914
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Tue, Jun 25, 2024 at 10:05=E2=80=AFAM Axel Rau <Axel.Rau@chaos1.de> wrot=
e:

> Hi all,
>
> I=E2=80=99m getting
>
> ERROR:  permission denied to grant privileges as role "axel"
> DETAIL:  The grantor must have the ADMIN option on role "daemons".
> ERROR:  permission denied to grant privileges as role "axel"
> DETAIL:  The grantor must have the ADMIN option on role "daemons".
> ERROR:  permission denied to grant privileges as role "axel"
> DETAIL:  The grantor must have the ADMIN option on role "xtrole".
> ERROR:  permission denied to grant privileges as role "axel"
> DETAIL:  The grantor must have the ADMIN option on role "xtrole".
>
> while trying load a dump from 13 into 16 server.
>
> Correcting this on 13 seems impossible as new syntax/options are required=
.
>
> What would be the upgrade path to fix this?
> What would be the SQL phrase to do it ?
>

Is there a reason you can't grant axel those other roles as admin? Such as:

GRANT daemons TO axel WITH ADMIN OPTION;
GRANT xtrole TO axel WITH ADMIN OPTION;

I may be missing something really basic, but if you do that on v16 before
running the load, would that fix it? Maybe there are security implications
for your setup that make this unthinkable, but if that's true, having
daemons and xtrole connected to these tables / data might be a problem more
generally?

Steve

--000000000000905b6a061bba3914
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><br></div><br><div class=
=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, Jun 25, 2024=
 at 10:05=E2=80=AFAM Axel Rau &lt;<a href=3D"mailto:Axel.Rau@chaos1.de">Axe=
l.Rau@chaos1.de</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" s=
tyle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);pad=
ding-left:1ex">Hi all,<br>
<br>
I=E2=80=99m getting<br>
<br>
ERROR:=C2=A0 permission denied to grant privileges as role &quot;axel&quot;=
<br>
DETAIL:=C2=A0 The grantor must have the ADMIN option on role &quot;daemons&=
quot;.<br>
ERROR:=C2=A0 permission denied to grant privileges as role &quot;axel&quot;=
<br>
DETAIL:=C2=A0 The grantor must have the ADMIN option on role &quot;daemons&=
quot;.<br>
ERROR:=C2=A0 permission denied to grant privileges as role &quot;axel&quot;=
<br>
DETAIL:=C2=A0 The grantor must have the ADMIN option on role &quot;xtrole&q=
uot;.<br>
ERROR:=C2=A0 permission denied to grant privileges as role &quot;axel&quot;=
<br>
DETAIL:=C2=A0 The grantor must have the ADMIN option on role &quot;xtrole&q=
uot;.<br>
<br>
while trying load a dump from 13 into 16 server.<br>
<br>
Correcting this on 13 seems impossible as new syntax/options are required.<=
br>
<br>
What would be the upgrade path to fix this?<br>
What would be the SQL phrase to do it ?<br></blockquote><div><br></div><div=
>Is there a reason you can&#39;t grant axel those other roles as admin? Suc=
h as:<br><div><br></div><div>GRANT daemons TO axel WITH ADMIN OPTION;<br></=
div>GRANT xtrole TO axel WITH ADMIN OPTION;=C2=A0</div><div><br></div><div>=
I may be missing something really basic, but if you do that on v16 before r=
unning the load, would that fix it? Maybe there are security implications f=
or your setup that make this unthinkable, but if that&#39;s true, having da=
emons and xtrole connected to these tables / data might be a problem more g=
enerally?</div><div><br></div><div>Steve</div></div></div></div>

--000000000000905b6a061bba3914--