Horton

Re: CREATEROLE and role ownership hierarchies

Joshua Brindle <joshua.brindle@crunchydata.com>

View thread View on postgr.es
From: Joshua Brindle <joshua.brindle@crunchydata.com>
To: Andrew Dunstan <andrew@dunslane.net>
Cc: Mark Dilger <mark.dilger@enterprisedb.com>, Shinya Kato <Shinya11.Kato@oss.nttdata.com>, "Bossart, Nathan" <bossartn@amazon.com>, PostgreSQL-development <pgsql-hackers@postgresql.org>, Jeff Davis <pgsql@j-davis.com>
Date: 2022-01-04T14:35:31Z
Lists: pgsql-hackers 
On Mon, Jan 3, 2022 at 5:08 PM Andrew Dunstan <andrew@dunslane.net> wrote:
>
>
> On 12/23/21 16:06, Joshua Brindle wrote:
> > On Tue, Dec 21, 2021 at 8:26 PM Mark Dilger
> > <mark.dilger@enterprisedb.com> wrote:
> >>
> >>
> >>> On Dec 21, 2021, at 5:11 PM, Shinya Kato <Shinya11.Kato@oss.nttdata.com> wrote:
> >>>
> >>> I fixed the patches because they cannot be applied to HEAD.
> >> Thank you.
> > I reviewed and tested these and they LGTM. FYI the rebased v3 patches
> > upthread are raw diffs so git am won't apply them.
>
>
> That's not at all unusual. I normally apply patches just using
>
>    patch -p 1 < $patchfile
>
> > I can add myself to
> > the CF as a reviewer if it is helpful.
>
>
> Please do.

I just ran across this and I don't know if it is intended behavior or
not, can you tell me why this happens?

postgres=> \du+
                                                List of roles
 Role name |  Owner   |                         Attributes
            | Member of | Description
-----------+----------+------------------------------------------------------------+-----------+-------------
 brindle   | brindle  | Password valid until 2022-01-05 00:00:00-05
            | {}        |
 joshua    | postgres | Create role
            | {}        |
 postgres  | postgres | Superuser, Create role, Create DB,
Replication, Bypass RLS | {}        |

postgres=> \password
Enter new password for user "brindle":
Enter it again:
ERROR:  role "brindle" with OID 16384 owns itself

Commits

  1. Make role grant system more consistent with other privileges.

  2. Ensure that pg_auth_members.grantor is always valid.

  3. Remove the ability of a role to administer itself.

  4. Add tests of the CREATEROLE attribute

  5. Replace explicit PIN entries in pg_depend with an OID range test.

  6. Shore up ADMIN OPTION restrictions.

  7. Add pg_has_role() family of privilege inquiry functions modeled after the

  8. Align GRANT/REVOKE behavior more closely with the SQL spec, per discussion