On 06.12.2022 22:36, Nathan Bossart wrote:
> As discussed elsewhere [0], \dp doesn't show privileges on system objects,
> and this behavior is not mentioned in the docs. I've attached a small
> patch that adds support for the S modifier (i.e., \dpS) and the adjusts the
> docs.
>
> Thoughts?
>
> [0] https://postgr.es/m/a2382acd-e465-85b2-9d8e-f9ed1a5a66e9%40postgrespro.ru
A few words in support of this patch, since I was the initiator of the
discussion.
Before VACUUM, ANALYZE privileges, there was no such question.
Why check privileges on system catalog objects? But now it doesn't.
It is now possible to grant privileges on system tables,
so it should be possible to see privileges with psql commands.
However, the \dp command does not support the S modifier, which is
inconsistent.
Furthermore. The VACUUM privilege allows you to also execute VACUUM FULL.
VACUUM and VACUUM FULL are commands with similar names, but work
completely differently.
It may be worth clarifying on this page:
https://www.postgresql.org/docs/devel/ddl-priv.html
Something like: Allows VACUUM on a relation, including VACUUM FULL.
But that's not all.
There is a very similar command to VACUUM FULL with a different name -
CLUSTER.
The VACUUM privilege does not apply to the CLUSTER command. This is
probably correct.
However, the documentation for the CLUSTER command does not say
who can perform this command. I think it would be correct to add a sentence
to the Notes section
(https://www.postgresql.org/docs/devel/sql-cluster.html)
similar to the one in the VACUUM documentation:
"To cluster a table, one must ordinarily be the table's owner or a
superuser."
Ready to participate, if it seems reasonable.
--
Pavel Luzanov
Postgres Professional: https://postgrespro.com