Re: fixing CREATEROLE

Mark Dilger <mark.dilger@enterprisedb.com>

From: Mark Dilger <mark.dilger@enterprisedb.com>

To: Robert Haas <robertmhaas@gmail.com>

Cc: "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>

Date: 2022-11-22T20:01:37Z

Lists: pgsql-hackers

> On Nov 21, 2022, at 12:39 PM, Robert Haas <robertmhaas@gmail.com> wrote:
> 
> I have drafted a few patches to try to improve the situation.

The 0001 and 0002 patches appear to be uncontroversial refactorings.  Patch 0003 looks on-point and a move in the right direction.  The commit message in that patch is well written.  Patch 0004 feels like something that won't get committed.  The INHERITCREATEDROLES and SETCREATEDROLES in 0004 seems clunky.

—
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company

Commits

Add new GUC createrole_self_grant.
- e5b8a4c098ad 16.0 landed
Restrict the privileges of CREATEROLE users.
- cf5eb37c5ee0 16.0 landed
Pass down current user ID to AddRoleMems and DelRoleMems.
- 39cffe95f2c5 16.0 landed
Refactor permissions-checking for role grants.
- 25bb03166b16 16.0 landed
Improve documentation of the CREATEROLE attibute.
- 0b496bc9881f 11.19 landed
- 1a5ff7be2696 12.14 landed
- 5dac191edf18 13.10 landed
- 1c77873727df 16.0 landed
- 5136c3fb575b 14.7 landed
- aa26980ca081 15.2 landed
Make role grant system more consistent with other privileges.
- ce6b672e4455 16.0 cited