Re: predefined role(s) for VACUUM and ANALYZE

Nathan Bossart <nathandbossart@gmail.com> writes:

> diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c
> index 3b5ea3c137..bd967eaa78 100644
> --- a/src/backend/catalog/aclchk.c
> +++ b/src/backend/catalog/aclchk.c
> @@ -4202,6 +4202,26 @@ pg_class_aclmask_ext(Oid table_oid, Oid roleid, AclMode mask,
>  		has_privs_of_role(roleid, ROLE_PG_WRITE_ALL_DATA))
>  		result |= (mask & (ACL_INSERT | ACL_UPDATE | ACL_DELETE));
>  
> +	/*
> +	 * Check if ACL_VACUUM is being checked and, if so, and not already set as
> +	 * part of the result, then check if the user is a member of the
> +	 * pg_vacuum_all_tables role, which allows VACUUM on all relations.
> +	 */
> +	if (mask & ACL_VACUUM &&
> +		!(result & ACL_VACUUM) &&
> +		has_privs_of_role(roleid, ROLE_PG_VACUUM_ALL_TABLES))
> +		result |= ACL_VACUUM;
> +
> +	/*
> +	 * Check if ACL_ANALYZE is being checked and, if so, and not already set as
> +	 * part of the result, then check if the user is a member of the
> +	 * pg_analyze_all_tables role, which allows ANALYZE on all relations.
> +	 */
> +	if (mask & ACL_ANALYZE &&
> +		!(result & ACL_ANALYZE) &&
> +		has_privs_of_role(roleid, ROLE_PG_ANALYZE_ALL_TABLES))
> +		result |= ACL_ANALYZE;
> +
>  	return result;
>  }

These checks are getting rather repetitive, how about a data-driven
approach, along the lines of the below patch?  I'm not quite happy with
the naming of the struct and its members (and maybe it should be in a
header?), suggestions welcome.

- ilmari