Re: replacing role-level NOINHERIT with a grant-level option
От | Nathan Bossart |
---|---|
Тема | Re: replacing role-level NOINHERIT with a grant-level option |
Дата | |
Msg-id | 20220830212035.GA593872@nathanxps13 обсуждение исходный текст |
Ответ на | Re: replacing role-level NOINHERIT with a grant-level option (Robert Haas <robertmhaas@gmail.com>) |
Ответы |
Re: replacing role-level NOINHERIT with a grant-level option
|
Список | pgsql-hackers |
On Tue, Aug 30, 2022 at 03:24:56PM -0400, Robert Haas wrote: > - william => charles => elizabeth => uk is OK because the first two > hops have ADMIN and the last hop has INHERIT Don't you mean the first two hops have INHERIT and the last has ADMIN? > - william => charles => elizabeth => uk => parliament is probably not > OK because although the first two hops have ADMIN and the last has > INHERIT, the third hop probably lacks INHERIT Same here. I don't mean to be pedantic, I just want to make sure I'm thinking of this correctly. > I hope this makes it clearer. select_best_grantor() can't completely > disregard links without INHERIT, because if it does, it can't pay any > attention to the last grant in the chain, which only needs to have > ADMIN, not INHERIT. But it must pay some attention to them, because > every earlier link in the chain does need to have INHERIT. By moving > the if-test up, the patch makes it behave just that way, or at least, > I think it does. Yes, this is very helpful. I always appreciate your detailed examples. I think what you are describing matches the mental model I was beginning to form. Okay, now to take a closer look at the patch... -- Nathan Bossart Amazon Web Services: https://aws.amazon.com
В списке pgsql-hackers по дате отправления: