Horton

Re: fixing CREATEROLE

Wolfgang Walther <walther@technowledgy.de>

View thread View on postgr.es
From: walther@technowledgy.de
To: Mark Dilger <mark.dilger@enterprisedb.com>
Cc: "David G. Johnston" <david.g.johnston@gmail.com>, Robert Haas <robertmhaas@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Date: 2022-11-29T07:05:46Z
Lists: pgsql-hackers 
Mark Dilger:
>> Isn't this just GRANT .. WITH SET FALSE, INHERIT FALSE, ADMIN TRUE? That should allow role administration, without actually granting membership in that role, yet, right?
> 
> Can you clarify what you mean here?  Are you inventing a new syntax?
> 
> +GRANT bob TO alice WITH SET FALSE, INHERIT FALSE, ADMIN TRUE;
> +ERROR:  syntax error at or near "SET"
> +LINE 1: GRANT bob TO alice WITH SET FALSE, INHERIT FALSE, ADMIN TRUE...

This is valid syntax on latest master.

Best,

Wolfgang

Commits

  1. Add new GUC createrole_self_grant.

  2. Restrict the privileges of CREATEROLE users.

  3. Pass down current user ID to AddRoleMems and DelRoleMems.

  4. Refactor permissions-checking for role grants.

  5. Improve documentation of the CREATEROLE attibute.

  6. Make role grant system more consistent with other privileges.