Horton

Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX

Pavel Luzanov <p.luzanov@postgrespro.ru>

View thread View on postgr.es
From: Pavel Luzanov <p.luzanov@postgrespro.ru>
To: Nathan Bossart <nathandbossart@gmail.com>, Michael Paquier <michael@paquier.xyz>
Cc: Jeff Davis <pgsql@j-davis.com>, Alvaro Herrera <alvherre@alvh.no-ip.org>, pgsql-hackers@postgresql.org
Date: 2022-12-15T09:42:00Z
Lists: pgsql-hackers 
On 15.12.2022 03:27, Nathan Bossart wrote:
> Another option I'm looking at is skipping the privilege checks when VACUUM
> recurses to a TOAST table.  This won't allow you to VACUUM the TOAST table
> directly, but it would at least address the originally-reported issue

This approach can be implemented for partitioned tables too. Skipping
the privilege checks when VACUUM/ANALYZE recurses to partitions.

> I don't know if this is good enough.

At least it's better than before.

> It seems like ideally you should be
> able to VACUUM a TOAST table directly if you have MAINTAIN on its main
> relation.

I agree, that would be ideally.

-- 
Pavel Luzanov
Postgres Professional: https://postgrespro.com

Commits

  1. Improve privilege documentation for maintenance commands.

  2. Fix cache lookup hazards introduced by ff9618e82a.

  3. Move bool parameter for vacuum_rel() to option bits.

  4. Fix MAINTAIN privileges for toast tables and partitions.

  5. Add grantable MAINTAIN privilege and pg_maintain role.