Superuser can't revoke role granted by non-superuser
От | Alexander Kukushkin |
---|---|
Тема | Superuser can't revoke role granted by non-superuser |
Дата | |
Msg-id | CAFh8B=nCyWbxgD9uF5x7NV8y8PGvH_1t6wAfNQkjRnzEhN7OGA@mail.gmail.com обсуждение исходный текст |
Ответы |
Re: Superuser can't revoke role granted by non-superuser
|
Список | pgsql-bugs |
Hi,
Here is a self-contained example with 17.2, however I assume that 16 and master will exhibit similar behaviour.
postgres=# create user a with createrole;
CREATE ROLE
postgres=# create user b with createrole;
CREATE ROLE
postgres=# set role a;
SET
postgres=> create user aa;
CREATE ROLE
postgres=> set role b;
SET
postgres=> create user bb;
CREATE ROLE
postgres=> grant bb to aa;
GRANT ROLE
postgres=> \drg
List of role grants
Role name | Member of | Options | Grantor
-----------+-----------+--------------+----------
a | aa | ADMIN | postgres
aa | bb | INHERIT, SET | b
b | bb | ADMIN | postgres
(3 rows)
postgres=> reset role;
RESET
postgres=# revoke bb from aa;
WARNING: role "aa" has not been granted membership in role "bb" by role "postgres"
REVOKE ROLE
postgres=# \drg
List of role grants
Role name | Member of | Options | Grantor
-----------+-----------+--------------+----------
a | aa | ADMIN | postgres
aa | bb | INHERIT, SET | b
b | bb | ADMIN | postgres
(3 rows)
CREATE ROLE
postgres=# create user b with createrole;
CREATE ROLE
postgres=# set role a;
SET
postgres=> create user aa;
CREATE ROLE
postgres=> set role b;
SET
postgres=> create user bb;
CREATE ROLE
postgres=> grant bb to aa;
GRANT ROLE
postgres=> \drg
List of role grants
Role name | Member of | Options | Grantor
-----------+-----------+--------------+----------
a | aa | ADMIN | postgres
aa | bb | INHERIT, SET | b
b | bb | ADMIN | postgres
(3 rows)
postgres=> reset role;
RESET
postgres=# revoke bb from aa;
WARNING: role "aa" has not been granted membership in role "bb" by role "postgres"
REVOKE ROLE
postgres=# \drg
List of role grants
Role name | Member of | Options | Grantor
-----------+-----------+--------------+----------
a | aa | ADMIN | postgres
aa | bb | INHERIT, SET | b
b | bb | ADMIN | postgres
(3 rows)
IMO, superusers should be able to revoke privileges it didn't grant.
Regards,
--
Alexander Kukushkin
В списке pgsql-bugs по дате отправления: