Re: allow granting CLUSTER, REFRESH MATERIALIZED VIEW, and REINDEX

Pavel Luzanov <p.luzanov@postgrespro.ru>

From: Pavel Luzanov <p.luzanov@postgrespro.ru>
To: Nathan Bossart <nathandbossart@gmail.com>, Jeff Davis <pgsql@j-davis.com>
Cc: pgsql-hackers@postgresql.org
Date: 2022-12-14T09:07:13Z
Lists: pgsql-hackers
After a fresh install, including the patch for \dpS [1],
I found that granting MAINTAIN privilege does not allow the TOAST table 
to be vacuumed.

postgres@postgres(16.0)=# GRANT MAINTAIN ON pg_type TO alice;
GRANT
postgres@postgres(16.0)=# \c - alice
You are now connected to database "postgres" as user "alice".
alice@postgres(16.0)=> \dpS pg_type
                                     Access privileges
    Schema   |  Name   | Type  |     Access privileges      | Column 
privileges | Policies
------------+---------+-------+----------------------------+-------------------+----------
  pg_catalog | pg_type | table | 
postgres=arwdDxtm/postgres+|                   |
             |         |       | =r/postgres +|                   |
             |         |       | alice=m/postgres |                   |
(1 row)

So, the patch for \dpS works as expected and can be committed.

alice@postgres(16.0)=> VACUUM pg_type;
WARNING:  permission denied to vacuum "pg_toast_1247", skipping it
VACUUM

[1] 
https://www.postgresql.org/message-id/20221206193606.GB3078082%40nathanxps13

-- 
Pavel Luzanov
Postgres Professional: https://postgrespro.com




Commits

  1. Improve privilege documentation for maintenance commands.

  2. Fix cache lookup hazards introduced by ff9618e82a.

  3. Move bool parameter for vacuum_rel() to option bits.

  4. Fix MAINTAIN privileges for toast tables and partitions.

  5. Add grantable MAINTAIN privilege and pg_maintain role.