Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 151c22d

Browse filesBrowse files
nathan-bossartnathan-bossart
committed
Revert MAINTAIN privilege and pg_maintain predefined role.
This reverts the following commits: 4dbdb82, c2122aa, 5b1a879, 9e1e9d6, ff9618e, 60684dd, 4441fc7, and b5d6382. A role with the MAINTAIN privilege may be able to use search_path tricks to escalate privileges to the table owner. Unfortunately, it is too late in the v16 development cycle to apply the proposed fix, i.e., restricting search_path when running maintenance commands. Bumps catversion. Reviewed-by: Jeff Davis Discussion: https://postgr.es/m/E1q7j7Y-000z1H-Hr%40gemulon.postgresql.org Backpatch-through: 16
1 parent ec99d6e commit 151c22d
Copy full SHA for 151c22d

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.
Dismiss banner
Expand file treeCollapse file tree

41 files changed

+179
-445
lines changed

‎doc/src/sgml/ddl.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ddl.sgml
+9-26Lines changed: 9 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -1718,8 +1718,8 @@ ALTER TABLE products RENAME TO items;
17181718
<literal>INSERT</literal>, <literal>UPDATE</literal>, <literal>DELETE</literal>,
17191719
<literal>TRUNCATE</literal>, <literal>REFERENCES</literal>, <literal>TRIGGER</literal>,
17201720
<literal>CREATE</literal>, <literal>CONNECT</literal>, <literal>TEMPORARY</literal>,
1721-
<literal>EXECUTE</literal>, <literal>USAGE</literal>, <literal>SET</literal>,
1722-
<literal>ALTER SYSTEM</literal>, and <literal>MAINTAIN</literal>.
1721+
<literal>EXECUTE</literal>, <literal>USAGE</literal>, <literal>SET</literal>
1722+
and <literal>ALTER SYSTEM</literal>.
17231723
The privileges applicable to a particular
17241724
object vary depending on the object's type (table, function, etc.).
17251725
More detail about the meanings of these privileges appears below.
@@ -2010,19 +2010,7 @@ REVOKE ALL ON accounts FROM PUBLIC;
20102010
</para>
20112011
</listitem>
20122012
</varlistentry>
2013-
2014-
<varlistentry id="ddl-priv-maintain">
2015-
<term><literal>MAINTAIN</literal></term>
2016-
<listitem>
2017-
<para>
2018-
Allows <command>VACUUM</command>, <command>ANALYZE</command>,
2019-
<command>CLUSTER</command>, <command>REFRESH MATERIALIZED VIEW</command>,
2020-
<command>REINDEX</command>, and <command>LOCK TABLE</command> on a
2021-
relation.
2022-
</para>
2023-
</listitem>
2024-
</varlistentry>
2025-
</variablelist>
2013+
</variablelist>
20262014

20272015
The privileges required by other commands are listed on the
20282016
reference page of the respective command.
@@ -2171,11 +2159,6 @@ REVOKE ALL ON accounts FROM PUBLIC;
21712159
<entry><literal>A</literal></entry>
21722160
<entry><literal>PARAMETER</literal></entry>
21732161
</row>
2174-
<row>
2175-
<entry><literal>MAINTAIN</literal></entry>
2176-
<entry><literal>m</literal></entry>
2177-
<entry><literal>TABLE</literal></entry>
2178-
</row>
21792162
</tbody>
21802163
</tgroup>
21812164
</table>
@@ -2266,7 +2249,7 @@ REVOKE ALL ON accounts FROM PUBLIC;
22662249
</row>
22672250
<row>
22682251
<entry><literal>TABLE</literal> (and table-like objects)</entry>
2269-
<entry><literal>arwdDxtm</literal></entry>
2252+
<entry><literal>arwdDxt</literal></entry>
22702253
<entry>none</entry>
22712254
<entry><literal>\dp</literal></entry>
22722255
</row>
@@ -2325,11 +2308,11 @@ GRANT SELECT (col1), UPDATE (col1) ON mytable TO miriam_rw;
23252308
<programlisting>
23262309
=&gt; \dp mytable
23272310
Access privileges
2328-
Schema | Name | Type | Access privileges | Column privileges | Policies
2329-
--------+---------+-------+------------------------+-----------------------+----------
2330-
public | mytable | table | miriam=arwdDxtm/miriam+| col1: +|
2331-
| | | =r/miriam +| miriam_rw=rw/miriam |
2332-
| | | admin=arw/miriam | |
2311+
Schema | Name | Type | Access privileges | Column privileges | Policies
2312+
--------+---------+-------+-----------------------+-----------------------+----------
2313+
public | mytable | table | miriam=arwdDxt/miriam+| col1: +|
2314+
| | | =r/miriam +| miriam_rw=rw/miriam |
2315+
| | | admin=arw/miriam | |
23332316
(1 row)
23342317
</programlisting>
23352318
</para>

‎doc/src/sgml/func.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/func.sgml
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23545,7 +23545,7 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute');
2354523545
are <literal>SELECT</literal>, <literal>INSERT</literal>,
2354623546
<literal>UPDATE</literal>, <literal>DELETE</literal>,
2354723547
<literal>TRUNCATE</literal>, <literal>REFERENCES</literal>,
23548-
<literal>TRIGGER</literal>, and <literal>MAINTAIN</literal>.
23548+
and <literal>TRIGGER</literal>.
2354923549
</para></entry>
2355023550
</row>
2355123551

‎doc/src/sgml/ref/alter_default_privileges.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/alter_default_privileges.sgml
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ ALTER DEFAULT PRIVILEGES
2828

2929
<phrase>where <replaceable class="parameter">abbreviated_grant_or_revoke</replaceable> is one of:</phrase>
3030

31-
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
31+
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
3232
[, ...] | ALL [ PRIVILEGES ] }
3333
ON TABLES
3434
TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
@@ -51,7 +51,7 @@ GRANT { USAGE | CREATE | ALL [ PRIVILEGES ] }
5151
TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
5252

5353
REVOKE [ GRANT OPTION FOR ]
54-
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
54+
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
5555
[, ...] | ALL [ PRIVILEGES ] }
5656
ON TABLES
5757
FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]

‎doc/src/sgml/ref/analyze.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/analyze.sgml
+4-2Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -182,9 +182,11 @@ ANALYZE [ VERBOSE ] [ <replaceable class="parameter">table_and_columns</replacea
182182
<title>Notes</title>
183183

184184
<para>
185-
To analyze a table, one must ordinarily have the <literal>MAINTAIN</literal>
186-
privilege on the table. However, database owners are allowed to
185+
To analyze a table, one must ordinarily be the table's owner or a
186+
superuser. However, database owners are allowed to
187187
analyze all tables in their databases, except shared catalogs.
188+
(The restriction for shared catalogs means that a true database-wide
189+
<command>ANALYZE</command> can only be performed by a superuser.)
188190
<command>ANALYZE</command> will skip over any tables that the calling user
189191
does not have permission to analyze.
190192
</para>

‎doc/src/sgml/ref/cluster.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/cluster.sgml
+3-7Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,9 @@ CLUSTER [VERBOSE]
7070
<command>CLUSTER</command> without a
7171
<replaceable class="parameter">table_name</replaceable> reclusters all the
7272
previously-clustered tables in the current database that the calling user
73-
has privileges for. This form of <command>CLUSTER</command> cannot be
74-
executed inside a transaction block.
73+
owns, or all such tables if called by a superuser. This
74+
form of <command>CLUSTER</command> cannot be executed inside a transaction
75+
block.
7576
</para>
7677

7778
<para>
@@ -132,11 +133,6 @@ CLUSTER [VERBOSE]
132133
<refsect1>
133134
<title>Notes</title>
134135

135-
<para>
136-
To cluster a table, one must have the <literal>MAINTAIN</literal> privilege
137-
on the table.
138-
</para>
139-
140136
<para>
141137
In cases where you are accessing single rows randomly
142138
within a table, the actual order of the data in the

‎doc/src/sgml/ref/grant.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/grant.sgml
+1-2Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ PostgreSQL documentation
2121

2222
<refsynopsisdiv>
2323
<synopsis>
24-
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
24+
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
2525
[, ...] | ALL [ PRIVILEGES ] }
2626
ON { [ TABLE ] <replaceable class="parameter">table_name</replaceable> [, ...]
2727
| ALL TABLES IN SCHEMA <replaceable class="parameter">schema_name</replaceable> [, ...] }
@@ -193,7 +193,6 @@ GRANT <replaceable class="parameter">role_name</replaceable> [, ...] TO <replace
193193
<term><literal>USAGE</literal></term>
194194
<term><literal>SET</literal></term>
195195
<term><literal>ALTER SYSTEM</literal></term>
196-
<term><literal>MAINTAIN</literal></term>
197196
<listitem>
198197
<para>
199198
Specific types of privileges, as defined in <xref linkend="ddl-priv"/>.

‎doc/src/sgml/ref/lock.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/lock.sgml
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,8 +166,8 @@ LOCK [ TABLE ] [ ONLY ] <replaceable class="parameter">name</replaceable> [ * ]
166166

167167
<para>
168168
To lock a table, the user must have the right privilege for the specified
169-
<replaceable class="parameter">lockmode</replaceable>.
170-
If the user has <literal>MAINTAIN</literal>,
169+
<replaceable class="parameter">lockmode</replaceable>, or be the table's
170+
owner or a superuser. If the user has
171171
<literal>UPDATE</literal>, <literal>DELETE</literal>, or
172172
<literal>TRUNCATE</literal> privileges on the table, any <replaceable
173173
class="parameter">lockmode</replaceable> is permitted. If the user has

‎doc/src/sgml/ref/refresh_materialized_view.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/refresh_materialized_view.sgml
+2-3Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,8 @@ REFRESH MATERIALIZED VIEW [ CONCURRENTLY ] <replaceable class="parameter">name</
3131

3232
<para>
3333
<command>REFRESH MATERIALIZED VIEW</command> completely replaces the
34-
contents of a materialized view. To execute this command you must have the
35-
<literal>MAINTAIN</literal>
36-
privilege on the materialized view. The old contents are discarded. If
34+
contents of a materialized view. To execute this command you must be the
35+
owner of the materialized view. The old contents are discarded. If
3736
<literal>WITH DATA</literal> is specified (or defaults) the backing query
3837
is executed to provide the new data, and the materialized view is left in a
3938
scannable state. If <literal>WITH NO DATA</literal> is specified no new

‎doc/src/sgml/ref/reindex.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/reindex.sgml
+9-14Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -292,21 +292,16 @@ REINDEX [ ( <replaceable class="parameter">option</replaceable> [, ...] ) ] { DA
292292
</para>
293293

294294
<para>
295-
Reindexing a single index or table requires
296-
having the <literal>MAINTAIN</literal> privilege on the
297-
table. Note that while <command>REINDEX</command> on a partitioned index or
298-
table requires having the <literal>MAINTAIN</literal> privilege on the
299-
partitioned table, such commands skip the privilege checks when processing
300-
the individual partitions. Reindexing a schema or database requires being the
301-
owner of that schema or database or having privileges of the
302-
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
303-
role. Note specifically that it's thus
295+
Reindexing a single index or table requires being the owner of that
296+
index or table. Reindexing a schema or database requires being the
297+
owner of that schema or database. Note specifically that it's thus
304298
possible for non-superusers to rebuild indexes of tables owned by
305-
other users. However, as a special exception,
306-
<command>REINDEX DATABASE</command>, <command>REINDEX SCHEMA</command>,
307-
and <command>REINDEX SYSTEM</command> will skip indexes on shared catalogs
308-
unless the user has the <literal>MAINTAIN</literal> privilege on the
309-
catalog.
299+
other users. However, as a special exception, when
300+
<command>REINDEX DATABASE</command>, <command>REINDEX SCHEMA</command>
301+
or <command>REINDEX SYSTEM</command> is issued by a non-superuser,
302+
indexes on shared catalogs will be skipped unless the user owns the
303+
catalog (which typically won't be the case). Of course, superusers
304+
can always reindex anything.
310305
</para>
311306

312307
<para>

‎doc/src/sgml/ref/revoke.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/revoke.sgml
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ PostgreSQL documentation
2222
<refsynopsisdiv>
2323
<synopsis>
2424
REVOKE [ GRANT OPTION FOR ]
25-
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
25+
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
2626
[, ...] | ALL [ PRIVILEGES ] }
2727
ON { [ TABLE ] <replaceable class="parameter">table_name</replaceable> [, ...]
2828
| ALL TABLES IN SCHEMA <replaceable>schema_name</replaceable> [, ...] }

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.