Re: Granting SET and ALTER SYSTE privileges for GUCs

> On Dec 16, 2021, at 7:43 AM, Joshua Brindle <joshua.brindle@crunchydata.com> wrote:
> 
> Ah, I understand now. Would it be possible to pass the
> SettingAclRelationId if it exists or InvalidOid if not?

SettingAclRelationId is always defined, so we can always pass that value.  But the settingId itself may sometimes be InvalidOid.

> That way if a
> MAC implementation cares about a particular GUC it'll ensure it's in
> pg_setting_acl.

A much cleaner solution would be to create new ObjectAccessTypes with a corresponding new Invoke macro and Run function.  Those could take setting names, not Oids, and include additional information about whether the operation is SET, RESET or ALTER SYSTEM, what the new value is (if any), what kind of setting it is (bool, int, ...), etc.  I don't think such a patch would even be all that hard to write.

What do you think?

—
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company