Re: role self-revocation

Поиск
Список
Период
Сортировка
От David G. Johnston
Тема Re: role self-revocation
Дата
Msg-id CAKFQuwYexf4QnaqFwa1aibb95=Ms2wP4KPh4rx5NTM5_zWh2Ng@mail.gmail.com
обсуждение исходный текст
Ответ на Re: role self-revocation  (Tom Lane <tgl@sss.pgh.pa.us>)
Список pgsql-hackers
On Mon, Mar 7, 2022 at 9:04 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
Just looking at it now, without having done any historical research,
I wonder why it is that we don't attach significance to WITH ADMIN
OPTION being granted to the role itself.  It seems like the second
part of that sentence is effectively saying that a role DOES have
admin option on itself, contradicting the first part.

 
WITH ADMIN OPTION is inheritable which is really bad if the group has WITH ADMIN OPTION on itself.  The session_user exception temporarily grants WITH ADMIN OPTION to the group but it is done in such a way so that it is not inheritable.

There is no possible way to even assign WITH ADMIN OPTION on a role to itself since pg_auth_members doesn't record a self-relationship and admin_option only exists there.

David J.

P.S. Feature request; modify \du+ to show which "Member of" roles a given role has the WITH ADMIN OPTION privilege on.

В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tomas Vondra
Дата:
Сообщение: Re: logical decoding and replication of sequences
Следующее
От: Greg Stark
Дата:
Сообщение: Re: [PATCH] minor reloption regression tests improvement