Re: predefined role(s) for VACUUM and ANALYZE

Pavel Luzanov <p.luzanov@postgrespro.ru>

From: Pavel Luzanov <p.luzanov@postgrespro.ru>
To: Andrew Dunstan <andrew@dunslane.net>, Nathan Bossart <nathandbossart@gmail.com>
Cc: Corey Huinker <corey.huinker@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>, Stephen Frost <sfrost@snowman.net>, Bharath Rupireddy <bharath.rupireddyforpostgres@gmail.com>, "David G. Johnston" <david.g.johnston@gmail.com>, Kyotaro Horiguchi <horikyota.ntt@gmail.com>, Michael Paquier <michael@paquier.xyz>, Robert Haas <robertmhaas@gmail.com>, "pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Date: 2022-12-05T20:21:08Z
Lists: pgsql-hackers
Hello,

While looking into the new feature, I found the following situation with 
the \dp command displaying privileges on the system tables:

GRANT VACUUM, ANALYZE ON TABLE pg_type TO alice;

SELECT relacl FROM pg_class WHERE oid = 'pg_type'::regclass;
                            relacl
-------------------------------------------------------------
  {=r/postgres,postgres=arwdDxtvz/postgres,alice=vz/postgres}
(1 row)

But the \dp command does not show the granted privileges:

\dp pg_type
                             Access privileges
  Schema | Name | Type | Access privileges | Column privileges | Policies
--------+------+------+-------------------+-------------------+----------
(0 rows)

The comment in src/bin/psql/describe.c explains the situation:

     /*
      * Unless a schema pattern is specified, we suppress system and temp
      * tables, since they normally aren't very interesting from a 
permissions
      * point of view.  You can see 'em by explicit request though, eg 
with \z
      * pg_catalog.*
      */


So to see the privileges you have to explicitly specify the schema name:

\dp pg_catalog.pg_type
                                      Access privileges
    Schema   |  Name   | Type  |      Access privileges      | Column 
privileges | Policies
------------+---------+-------+-----------------------------+-------------------+----------
  pg_catalog | pg_type | table | =r/postgres +|                   |
             |         |       | 
postgres=arwdDxtvz/postgres+|                   |
             |         |       | alice=vz/postgres |                   |
(1 row)

But perhaps this behavior should be reviewed or at least documented?

-----
Pavel Luzanov



Commits

  1. Provide non-superuser predefined roles for vacuum and analyze

  2. Provide per-table permissions for vacuum and analyze.

  3. Expand AclMode to 64 bits

  4. Simplify WARNING messages from skipped vacuum/analyze on a table

  5. Allow granting SET and ALTER SYSTEM privileges on GUC parameters.

  6. Add String object access hooks