Horton

Re: BUG #17062: Assert failed in RemoveRoleFromObjectPolicy() on DROP OWNED policy applied to duplicate role

Tom Lane <tgl@sss.pgh.pa.us>

View thread View on postgr.es
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: exclusion@gmail.com, pgsql-bugs@lists.postgresql.org
Date: 2021-06-17T21:51:18Z
Lists: pgsql-bugs 
I wrote:
> So the proximate problem is RemoveRoleFromObjectPolicy's unfounded
> assumption that there are no duplicate OIDs in a pg_policy.polroles
> entry.  But that function has got some other serious problems too:

While I'm whining ... that function's permissions checks seem
completely out of line too.  How is it that, if I have the right
to drop some role, I lose that right if the role is mentioned in
a policy of some relation I don't own?  It feels like this function
was written by copy-and-pasting a whole bunch of irrelevant logic.

			regards, tom lane

Commits

  1. Remove unnecessary failure cases in RemoveRoleFromObjectPolicy().

  2. Fix misbehavior of DROP OWNED BY with duplicate polroles entries.