Horton

Re: table partitioning and access privileges

Fujii Masao <masao.fujii@oss.nttdata.com>

View thread View on postgr.es
From: Fujii Masao <masao.fujii@oss.nttdata.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Amit Langote <amitlangote09@gmail.com>, Fujii Masao <masao.fujii@gmail.com>, PostgreSQL-development <pgsql-hackers@postgresql.org>
Date: 2020-01-30T17:45:13Z
Lists: pgsql-hackers 

On 2020/01/31 1:28, Fujii Masao wrote:
> 
> 
> On 2020/01/31 1:02, Tom Lane wrote:
>> Fujii Masao <masao.fujii@oss.nttdata.com> writes:
>>> Thanks for updating the patch! Barring any objection,
>>> I will commit this fix and backport it to all supported versions.
>>
>> Sorry for not having paid closer attention to this thread, but ...
>> is back-patching this behavioral change really a good idea?
>>
>> It's not that hard to imagine that somebody is expecting the old
>> behavior and will complain that we broke their application's security.
>> So I'd have thought it better to fix only in HEAD, with a
>> compatibility warning in the v13 release notes.
>>
>> I'm afraid it's much more likely that people will complain about
>> making such a change in a minor release than that they will be
>> happy about it.  It's particularly risky to be making it in what
>> will be the last 9.4.x release, because we will not have any
>> opportunity to undo it in that branch if there is pushback.
> 
> Fair enough. I finally did back-patch because the behavior is clearly
> documented and I failed to hear the opinions to object the back-patch.
> But I should have heard and discussed such risks more.
> 
> I'm OK to revert all those back-patch. Instead, probably the document
> should be updated in old branches.

I'm thinking to wait at least half a day before reverting
the back-patch just in case someone can give opinion
during that period.

Regards,

-- 
Fujii Masao
NTT DATA CORPORATION
Advanced Platform Technology Group
Research and Development Headquarters

Commits

  1. Make inherited LOCK TABLE perform access permission checks on parent table only.

  2. Add note about access permission checks by inherited TRUNCATE and LOCK TABLE.

  3. Revert commit 56bc82a511.

  4. Revert commit 606f350de9.

  5. Revert commit 928e755d22.

  6. Revert commit 4b96c03a0a.

  7. Revert commit a5b652f3a0.

  8. Revert commit de0177788b.

  9. Make inherited TRUNCATE perform access permission checks on parent table only.

  10. Regression tests for LOCK TABLE.