Re: let's disallow ALTER ROLE bootstrap_superuser NOSUPERUSER

Tom Lane <tgl@sss.pgh.pa.us>

From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Nathan Bossart <nathandbossart@gmail.com>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Date: 2022-07-26T18:59:24Z
Lists: pgsql-hackers
Robert Haas <robertmhaas@gmail.com> writes:
> Reaction to this patch seems tentatively positive so far, so I have
> committed it. Maybe someone will still show up to complain ... but I
> think it's a good change, so I hope not.

I had not actually read the patch, but now that I have, it's got
a basic typing error:

+       bool    should_be_super = BoolGetDatum(boolVal(dissuper->arg));
+
+       if (!should_be_super && roleid == BOOTSTRAP_SUPERUSERID)
+           ereport(ERROR,

The result of BoolGetDatum is not bool, it's Datum.  This is
probably harmless, but it's still a typing violation.
You want something like

	bool    should_be_super = boolVal(dissuper->arg);
	...
	new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(should_be_super);

			regards, tom lane



Commits

  1. Fix brain fade in e530be2c5ce77475d56ccf8f4e0c4872b666ad5f.

  2. Do not allow removal of superuser privileges from bootstrap user.