Re: BUG #14242: Role with a setconfig "role" setting to a nonexistent role causes pg_upgrade to fail
Andrew Gierth <andrew@tao11.riddles.org.uk>
From: Andrew Gierth <andrew@tao11.riddles.org.uk>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: "David G. Johnston" <david.g.johnston@gmail.com>,
"bossartn\@amazon.com" <bossartn@amazon.com>,
"pgsql-bugs\@postgresql.org" <pgsql-bugs@postgresql.org>
Date: 2016-07-11T23:36:05Z
Lists: pgsql-bugs
>>>>> "Tom" == Tom Lane <tgl@sss.pgh.pa.us> writes: > Andrew Gierth <andrew@tao11.riddles.org.uk> writes: >> I don't think this is documented but it has obvious uses. Tom> Does it? For ALTER ROLE, there's actually a question that comes up not all that infrequently on irc: "how do I arrange things so that what user 'foo' does, by default, ends up owned by group role 'bar'" I'm pretty sure I have never actually suggested that anyone do it this way (because I had no idea it worked until I tried it just now), but I can see the use case. Tom> If the named role is the same as the actual role, then it's Tom> useless. If they're different, it seems at best confusing. In Tom> the context of ALTER DATABASE SET, it seems both confusing and Tom> possibly a security hazard. It _appears_ to silently fail if the user logging in is not actually a member of the specified role. I have not looked at the code. -- Andrew (irc:RhodiumToad)
Commits
-
Fix some inappropriately-disallowed uses of ALTER ROLE/DATABASE SET.
- c7f0275fbd4f 11.12 landed
- c39aa1e878cb 13.3 landed
- a7fcb62852dc 12.7 landed
- 69d5ca484b69 14.0 landed
- 46b6635b7742 10.17 landed
- 041f4efd25e2 9.6.22 landed