Horton

Re: Clarification on Role Access Rights to Table Indexes

Nathan Bossart <nathandbossart@gmail.com>

View thread View on postgr.es
From: Nathan Bossart <nathandbossart@gmail.com>
To: Jeff Davis <pgsql@j-davis.com>
Cc: Corey Huinker <corey.huinker@gmail.com>, Tom Lane <tgl@sss.pgh.pa.us>, Ayush Vatsa <ayushvatsa1810@gmail.com>, Robert Haas <robertmhaas@gmail.com>, "David G. Johnston" <david.g.johnston@gmail.com>, PostgreSQL Hackers <pgsql-hackers@postgresql.org>
Date: 2025-10-14T16:05:32Z
Lists: pgsql-hackers, pgsql-general 
Thanks for reviewing.

On Mon, Oct 13, 2025 at 07:23:36PM -0700, Jeff Davis wrote:
> The unlikely scenarios are a bit confusing. I'd probably error for
> either case. Also, the error message on the second scenario is wrong if
> the previous lookup was a table, I think.

Yeah, I think that's a better idea.

> IIUC this is locking before the privilege check. Is there a reason why
> we think this is OK here (and in amcheck_lock_relation_and_check()) but
> not for the stats?

For amcheck, AFAICT there aren't actually any ACL checks within the code
because the function is restricted to superuser by default.  For
pg_prewarm, I don't know.  You do have to install the extension before
using it, but once installed, it's available to everyone by default.  My
guess is that it just hasn't been a problem in the field.

Regardless, fixing the lock-before-privilege-checks behavior doesn't strike
me as a bug, so I think we ought to proceed with something like 0003 for
back-patching purposes and then to rework it further for v19.  Does that
sound okay to you?

>> * 0004 is a small patch to teach dblink to use
>> RangeVarGetRelidExtended().  I believe this code predates that
>> function.  I don't intend to back-patch this one.
> 
> Looks good.

I'm going to go commit this one now to get it out of the way.

-- 
nathan

Commits

  1. Fix privilege checks for pg_prewarm() on indexes.

  2. Fix lookup code for REINDEX INDEX.

  3. Fix redefinition of typedef RangeVar.

  4. Fix lookups in pg_{clear,restore}_{attribute,relation}_stats().

  5. dblink: Avoid locking relation before privilege check.