Skip to content

Navigation Menu

Sign in

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 4dbdb82

Browse filesBrowse files
nathan-bossartnathan-bossart
committed
Fix cache lookup hazards introduced by ff9618e.
ff9618e introduced has_partition_ancestor_privs(), which is used to check whether a user has MAINTAIN on any partition ancestors. This involves syscache lookups, and presently this function does not take any relation locks, so it is likely subject to the same kind of cache lookup failures that were fixed by 19de0ab. To fix this problem, this commit partially reverts ff9618e. Specifically, it removes the partition-related changes, including the has_partition_ancestor_privs() function mentioned above. This means that MAINTAIN on a partitioned table is no longer sufficient to perform maintenance commands on its partitions. This is more like how privileges for maintenance commands work on supported versions. Privileges are checked for each partition, so a command that flows down to all partitions might refuse to process them (e.g., if the current user doesn't have MAINTAIN on the partition). In passing, adjust a few related comments and error messages, and add a test for the privilege checks for CLUSTER on a partitioned table. Reviewed-by: Michael Paquier, Jeff Davis Discussion: https://postgr.es/m/20230613211246.GA219055%40nathanxps13
1 parent f5c446e commit 4dbdb82
Copy full SHA for 4dbdb82

18 files changed

+74
-105
lines changed

‎doc/src/sgml/ref/analyze.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/analyze.sgml
+1-4Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -190,10 +190,7 @@ ANALYZE [ VERBOSE ] [ <replaceable class="parameter">table_and_columns</replacea
190190
analyze all tables in their databases, except shared catalogs.
191191
(The restriction for shared catalogs means that a true database-wide
192192
<command>ANALYZE</command> can only be performed by superusers and roles
193-
with privileges of <literal>pg_maintain</literal>.) If a role has
194-
permission to <command>ANALYZE</command> a partitioned table, it is also
195-
permitted to <command>ANALYZE</command> each of its partitions, regardless
196-
of whether the role has the aforementioned privileges on the partition.
193+
with privileges of <literal>pg_maintain</literal>.)
197194
<command>ANALYZE</command> will skip over any tables that the calling user
198195
does not have permission to analyze.
199196
</para>

‎doc/src/sgml/ref/cluster.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/cluster.sgml
+1-4Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -137,10 +137,7 @@ CLUSTER [VERBOSE]
137137
on the table or be the table's owner, a superuser, or a role with
138138
privileges of the
139139
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
140-
role. If a role has permission to <command>CLUSTER</command> a partitioned
141-
table, it is also permitted to <command>CLUSTER</command> each of its
142-
partitions, regardless of whether the role has the aforementioned
143-
privileges on the partition. <command>CLUSTER</command> will skip over any
140+
role. <command>CLUSTER</command> will skip over any
144141
tables that the calling user does not have permission to cluster.
145142
</para>
146143

‎doc/src/sgml/ref/lock.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/lock.sgml
+1-4Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -177,10 +177,7 @@ LOCK [ TABLE ] [ ONLY ] <replaceable class="parameter">name</replaceable> [ * ]
177177
MODE</literal> (or a less-conflicting mode as described in <xref
178178
linkend="explicit-locking"/>) is permitted. If a user has
179179
<literal>SELECT</literal> privileges on the table, <literal>ACCESS SHARE
180-
MODE</literal> is permitted. If a role has permission to lock a
181-
partitioned table, it is also permitted to lock each of its partitions,
182-
regardless of whether the role has the aforementioned privileges on the
183-
partition.
180+
MODE</literal> is permitted.
184181
</para>
185182

186183
<para>

‎doc/src/sgml/ref/reindex.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/reindex.sgml
+1-5Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -306,11 +306,7 @@ REINDEX [ ( <replaceable class="parameter">option</replaceable> [, ...] ) ] { DA
306306
indexes on shared catalogs will be skipped unless the user owns the
307307
catalog (which typically won't be the case), has privileges of the
308308
<literal>pg_maintain</literal> role, or has the <literal>MAINTAIN</literal>
309-
privilege on the catalog. If a role has permission to
310-
<command>REINDEX</command> a partitioned table, it is also permitted to
311-
<command>REINDEX</command> each of its partitions, regardless of whether the
312-
role has the aforementioned privileges on the partition. Of course,
313-
superusers can always reindex anything.
309+
privilege on the catalog. Of course, superusers can always reindex anything.
314310
</para>
315311

316312
<para>

‎doc/src/sgml/ref/vacuum.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/ref/vacuum.sgml
+1-4Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -452,10 +452,7 @@ VACUUM [ FULL ] [ FREEZE ] [ VERBOSE ] [ ANALYZE ] [ <replaceable class="paramet
452452
vacuum all tables in their databases, except shared catalogs.
453453
(The restriction for shared catalogs means that a true database-wide
454454
<command>VACUUM</command> can only be performed by superusers and roles
455-
with privileges of <literal>pg_maintain</literal>.) If a role has
456-
permission to <command>VACUUM</command> a partitioned table, it is also
457-
permitted to <command>VACUUM</command> each of its partitions, regardless
458-
of whether the role has the aforementioned privileges on the partition.
455+
with privileges of <literal>pg_maintain</literal>.)
459456
<command>VACUUM</command> will skip over any tables that the calling user
460457
does not have permission to vacuum.
461458
</para>

‎src/backend/commands/cluster.c

Copy file name to clipboardExpand all lines: src/backend/commands/cluster.c
+7-5Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1694,10 +1694,13 @@ get_tables_to_cluster_partitioned(MemoryContext cluster_context, Oid indexOid)
16941694
continue;
16951695

16961696
/*
1697-
* We already checked that the user has privileges to CLUSTER the
1698-
* partitioned table when we locked it earlier, so there's no need to
1699-
* check the privileges again here.
1697+
* It's possible that the user does not have privileges to CLUSTER the
1698+
* leaf partition despite having such privileges on the partitioned
1699+
* table. We skip any partitions which the user is not permitted to
1700+
* CLUSTER.
17001701
*/
1702+
if (!cluster_is_permitted_for_relation(relid, GetUserId()))
1703+
continue;
17011704

17021705
/* Use a permanent memory context for the result list */
17031706
old_context = MemoryContextSwitchTo(cluster_context);
@@ -1720,8 +1723,7 @@ get_tables_to_cluster_partitioned(MemoryContext cluster_context, Oid indexOid)
17201723
static bool
17211724
cluster_is_permitted_for_relation(Oid relid, Oid userid)
17221725
{
1723-
if (pg_class_aclcheck(relid, userid, ACL_MAINTAIN) == ACLCHECK_OK ||
1724-
has_partition_ancestor_privs(relid, userid, ACL_MAINTAIN))
1726+
if (pg_class_aclcheck(relid, userid, ACL_MAINTAIN) == ACLCHECK_OK)
17251727
return true;
17261728

17271729
ereport(WARNING,

‎src/backend/commands/indexcmds.c

Copy file name to clipboardExpand all lines: src/backend/commands/indexcmds.c
+12-15Lines changed: 12 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -2853,11 +2853,14 @@ RangeVarCallbackForReindexIndex(const RangeVar *relation,
28532853

28542854
/* Check permissions */
28552855
table_oid = IndexGetRelation(relId, true);
2856-
if (OidIsValid(table_oid) &&
2857-
pg_class_aclcheck(table_oid, GetUserId(), ACL_MAINTAIN) != ACLCHECK_OK &&
2858-
!has_partition_ancestor_privs(table_oid, GetUserId(), ACL_MAINTAIN))
2859-
aclcheck_error(ACLCHECK_NOT_OWNER, OBJECT_INDEX,
2860-
relation->relname);
2856+
if (OidIsValid(table_oid))
2857+
{
2858+
AclResult aclresult;
2859+
2860+
aclresult = pg_class_aclcheck(table_oid, GetUserId(), ACL_MAINTAIN);
2861+
if (aclresult != ACLCHECK_OK)
2862+
aclcheck_error(aclresult, OBJECT_INDEX, relation->relname);
2863+
}
28612864

28622865
/* Lock heap before index to avoid deadlock. */
28632866
if (relId != oldRelId)
@@ -3064,18 +3067,12 @@ ReindexMultipleTables(const char *objectName, ReindexObjectType objectKind,
30643067
continue;
30653068

30663069
/*
3067-
* The table can be reindexed if the user has been granted MAINTAIN on
3068-
* the table or one of its partition ancestors or the user is a
3069-
* superuser, the table owner, or the database/schema owner (but in
3070-
* the latter case, only if it's not a shared relation).
3071-
* pg_class_aclcheck includes the superuser case, and depending on
3072-
* objectKind we already know that the user has permission to run
3073-
* REINDEX on this database or schema per the permission checks at the
3074-
* beginning of this routine.
3070+
* We already checked privileges on the database or schema, but we
3071+
* further restrict reindexing shared catalogs to roles with the
3072+
* MAINTAIN privilege on the relation.
30753073
*/
30763074
if (classtuple->relisshared &&
3077-
pg_class_aclcheck(relid, GetUserId(), ACL_MAINTAIN) != ACLCHECK_OK &&
3078-
!has_partition_ancestor_privs(relid, GetUserId(), ACL_MAINTAIN))
3075+
pg_class_aclcheck(relid, GetUserId(), ACL_MAINTAIN) != ACLCHECK_OK)
30793076
continue;
30803077

30813078
/*

‎src/backend/commands/lockcmds.c

Copy file name to clipboardExpand all lines: src/backend/commands/lockcmds.c
-8Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@
1919
#include "catalog/namespace.h"
2020
#include "catalog/pg_inherits.h"
2121
#include "commands/lockcmds.h"
22-
#include "commands/tablecmds.h"
2322
#include "miscadmin.h"
2423
#include "nodes/nodeFuncs.h"
2524
#include "parser/parse_clause.h"
@@ -297,12 +296,5 @@ LockTableAclCheck(Oid reloid, LOCKMODE lockmode, Oid userid)
297296

298297
aclresult = pg_class_aclcheck(reloid, userid, aclmask);
299298

300-
/*
301-
* If this is a partition, check permissions of its ancestors if needed.
302-
*/
303-
if (aclresult != ACLCHECK_OK &&
304-
has_partition_ancestor_privs(reloid, userid, ACL_MAINTAIN))
305-
aclresult = ACLCHECK_OK;
306-
307299
return aclresult;
308300
}

‎src/backend/commands/tablecmds.c

Copy file name to clipboardExpand all lines: src/backend/commands/tablecmds.c
+4-30Lines changed: 4 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -16986,6 +16986,7 @@ RangeVarCallbackMaintainsTable(const RangeVar *relation,
1698616986
Oid relId, Oid oldRelId, void *arg)
1698716987
{
1698816988
char relkind;
16989+
AclResult aclresult;
1698916990

1699016991
/* Nothing to do if the relation was not found. */
1699116992
if (!OidIsValid(relId))
@@ -17006,36 +17007,9 @@ RangeVarCallbackMaintainsTable(const RangeVar *relation,
1700617007
errmsg("\"%s\" is not a table or materialized view", relation->relname)));
1700717008

1700817009
/* Check permissions */
17009-
if (pg_class_aclcheck(relId, GetUserId(), ACL_MAINTAIN) != ACLCHECK_OK &&
17010-
!has_partition_ancestor_privs(relId, GetUserId(), ACL_MAINTAIN))
17011-
aclcheck_error(ACLCHECK_NOT_OWNER, OBJECT_TABLE,
17012-
relation->relname);
17013-
}
17014-
17015-
/*
17016-
* If relid is a partition, returns whether userid has any of the privileges
17017-
* specified in acl on any of its ancestors. Otherwise, returns false.
17018-
*/
17019-
bool
17020-
has_partition_ancestor_privs(Oid relid, Oid userid, AclMode acl)
17021-
{
17022-
List *ancestors;
17023-
ListCell *lc;
17024-
17025-
if (!get_rel_relispartition(relid))
17026-
return false;
17027-
17028-
ancestors = get_partition_ancestors(relid);
17029-
foreach(lc, ancestors)
17030-
{
17031-
Oid ancestor = lfirst_oid(lc);
17032-
17033-
if (OidIsValid(ancestor) &&
17034-
pg_class_aclcheck(ancestor, userid, acl) == ACLCHECK_OK)
17035-
return true;
17036-
}
17037-
17038-
return false;
17010+
aclresult = pg_class_aclcheck(relId, GetUserId(), ACL_MAINTAIN);
17011+
if (aclresult != ACLCHECK_OK)
17012+
aclcheck_error(aclresult, OBJECT_TABLE, relation->relname);
1703917013
}
1704017014

1704117015
/*

‎src/backend/commands/vacuum.c

Copy file name to clipboardExpand all lines: src/backend/commands/vacuum.c
+2-8Lines changed: 2 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,6 @@
4141
#include "catalog/pg_namespace.h"
4242
#include "commands/cluster.h"
4343
#include "commands/defrem.h"
44-
#include "commands/tablecmds.h"
4544
#include "commands/vacuum.h"
4645
#include "miscadmin.h"
4746
#include "nodes/makefuncs.h"
@@ -721,17 +720,12 @@ vacuum_is_permitted_for_relation(Oid relid, Form_pg_class reltuple,
721720
/*----------
722721
* A role has privileges to vacuum or analyze the relation if any of the
723722
* following are true:
724-
* - the role is a superuser
725-
* - the role owns the relation
726723
* - the role owns the current database and the relation is not shared
727-
* - the role has been granted the MAINTAIN privilege on the relation
728-
* - the role has privileges to vacuum/analyze any of the relation's
729-
* partition ancestors
724+
* - the role has the MAINTAIN privilege on the relation
730725
*----------
731726
*/
732727
if ((object_ownercheck(DatabaseRelationId, MyDatabaseId, GetUserId()) && !reltuple->relisshared) ||
733-
pg_class_aclcheck(relid, GetUserId(), ACL_MAINTAIN) == ACLCHECK_OK ||
734-
has_partition_ancestor_privs(relid, GetUserId(), ACL_MAINTAIN))
728+
pg_class_aclcheck(relid, GetUserId(), ACL_MAINTAIN) == ACLCHECK_OK)
735729
return true;
736730

737731
relname = NameStr(reltuple->relname);

‎src/include/commands/tablecmds.h

Copy file name to clipboardExpand all lines: src/include/commands/tablecmds.h
-1Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,6 @@ extern void AtEOSubXact_on_commit_actions(bool isCommit,
9999
extern void RangeVarCallbackMaintainsTable(const RangeVar *relation,
100100
Oid relId, Oid oldRelId,
101101
void *arg);
102-
extern bool has_partition_ancestor_privs(Oid relid, Oid userid, AclMode acl);
103102

104103
extern void RangeVarCallbackOwnsRelation(const RangeVar *relation,
105104
Oid relId, Oid oldRelId, void *arg);

‎src/test/isolation/expected/cluster-conflict-partition.out

Copy file name to clipboardExpand all lines: src/test/isolation/expected/cluster-conflict-partition.out
+6-8Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,15 @@ Parsed test spec with 2 sessions
33
starting permutation: s1_begin s1_lock_parent s2_auth s2_cluster s1_commit s2_reset
44
step s1_begin: BEGIN;
55
step s1_lock_parent: LOCK cluster_part_tab IN SHARE UPDATE EXCLUSIVE MODE;
6-
step s2_auth: SET ROLE regress_cluster_part;
6+
step s2_auth: SET ROLE regress_cluster_part; SET client_min_messages = ERROR;
77
step s2_cluster: CLUSTER cluster_part_tab USING cluster_part_ind; <waiting ...>
88
step s1_commit: COMMIT;
99
step s2_cluster: <... completed>
1010
step s2_reset: RESET ROLE;
1111

1212
starting permutation: s1_begin s2_auth s1_lock_parent s2_cluster s1_commit s2_reset
1313
step s1_begin: BEGIN;
14-
step s2_auth: SET ROLE regress_cluster_part;
14+
step s2_auth: SET ROLE regress_cluster_part; SET client_min_messages = ERROR;
1515
step s1_lock_parent: LOCK cluster_part_tab IN SHARE UPDATE EXCLUSIVE MODE;
1616
step s2_cluster: CLUSTER cluster_part_tab USING cluster_part_ind; <waiting ...>
1717
step s1_commit: COMMIT;
@@ -21,17 +21,15 @@ step s2_reset: RESET ROLE;
2121
starting permutation: s1_begin s1_lock_child s2_auth s2_cluster s1_commit s2_reset
2222
step s1_begin: BEGIN;
2323
step s1_lock_child: LOCK cluster_part_tab1 IN SHARE UPDATE EXCLUSIVE MODE;
24-
step s2_auth: SET ROLE regress_cluster_part;
25-
step s2_cluster: CLUSTER cluster_part_tab USING cluster_part_ind; <waiting ...>
24+
step s2_auth: SET ROLE regress_cluster_part; SET client_min_messages = ERROR;
25+
step s2_cluster: CLUSTER cluster_part_tab USING cluster_part_ind;
2626
step s1_commit: COMMIT;
27-
step s2_cluster: <... completed>
2827
step s2_reset: RESET ROLE;
2928

3029
starting permutation: s1_begin s2_auth s1_lock_child s2_cluster s1_commit s2_reset
3130
step s1_begin: BEGIN;
32-
step s2_auth: SET ROLE regress_cluster_part;
31+
step s2_auth: SET ROLE regress_cluster_part; SET client_min_messages = ERROR;
3332
step s1_lock_child: LOCK cluster_part_tab1 IN SHARE UPDATE EXCLUSIVE MODE;
34-
step s2_cluster: CLUSTER cluster_part_tab USING cluster_part_ind; <waiting ...>
33+
step s2_cluster: CLUSTER cluster_part_tab USING cluster_part_ind;
3534
step s1_commit: COMMIT;
36-
step s2_cluster: <... completed>
3735
step s2_reset: RESET ROLE;

‎src/test/isolation/specs/cluster-conflict-partition.spec

Copy file name to clipboardExpand all lines: src/test/isolation/specs/cluster-conflict-partition.spec
+5-2Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,15 @@ step s1_lock_child { LOCK cluster_part_tab1 IN SHARE UPDATE EXCLUSIVE MODE;
2323
step s1_commit { COMMIT; }
2424

2525
session s2
26-
step s2_auth { SET ROLE regress_cluster_part; }
26+
step s2_auth { SET ROLE regress_cluster_part; SET client_min_messages = ERROR; }
2727
step s2_cluster { CLUSTER cluster_part_tab USING cluster_part_ind; }
2828
step s2_reset { RESET ROLE; }
2929

30-
# CLUSTER waits if locked, passes for all cases.
30+
# CLUSTER on the parent waits if locked, passes for all cases.
3131
permutation s1_begin s1_lock_parent s2_auth s2_cluster s1_commit s2_reset
3232
permutation s1_begin s2_auth s1_lock_parent s2_cluster s1_commit s2_reset
33+
34+
# When taking a lock on a partition leaf, CLUSTER on the parent skips
35+
# the leaf, passes for all cases.
3336
permutation s1_begin s1_lock_child s2_auth s2_cluster s1_commit s2_reset
3437
permutation s1_begin s2_auth s1_lock_child s2_cluster s1_commit s2_reset

‎src/test/regress/expected/cluster.out

Copy file name to clipboardExpand all lines: src/test/regress/expected/cluster.out
+6-1Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -502,20 +502,25 @@ CREATE TABLE ptnowner1 PARTITION OF ptnowner FOR VALUES IN (1);
502502
CREATE ROLE regress_ptnowner;
503503
CREATE TABLE ptnowner2 PARTITION OF ptnowner FOR VALUES IN (2);
504504
ALTER TABLE ptnowner1 OWNER TO regress_ptnowner;
505+
SET SESSION AUTHORIZATION regress_ptnowner;
506+
CLUSTER ptnowner USING ptnowner_i_idx;
507+
ERROR: permission denied for table ptnowner
508+
RESET SESSION AUTHORIZATION;
505509
ALTER TABLE ptnowner OWNER TO regress_ptnowner;
506510
CREATE TEMP TABLE ptnowner_oldnodes AS
507511
SELECT oid, relname, relfilenode FROM pg_partition_tree('ptnowner') AS tree
508512
JOIN pg_class AS c ON c.oid=tree.relid;
509513
SET SESSION AUTHORIZATION regress_ptnowner;
510514
CLUSTER ptnowner USING ptnowner_i_idx;
515+
WARNING: permission denied to cluster "ptnowner2", skipping it
511516
RESET SESSION AUTHORIZATION;
512517
SELECT a.relname, a.relfilenode=b.relfilenode FROM pg_class a
513518
JOIN ptnowner_oldnodes b USING (oid) ORDER BY a.relname COLLATE "C";
514519
relname | ?column?
515520
-----------+----------
516521
ptnowner | t
517522
ptnowner1 | f
518-
ptnowner2 | f
523+
ptnowner2 | t
519524
(3 rows)
520525

521526
DROP TABLE ptnowner;

‎src/test/regress/expected/create_index.out

Copy file name to clipboardExpand all lines: src/test/regress/expected/create_index.out
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2831,9 +2831,9 @@ RESET ROLE;
28312831
GRANT USAGE ON SCHEMA pg_toast TO regress_reindexuser;
28322832
SET SESSION ROLE regress_reindexuser;
28332833
REINDEX TABLE pg_toast.pg_toast_1260;
2834-
ERROR: must be owner of table pg_toast_1260
2834+
ERROR: permission denied for table pg_toast_1260
28352835
REINDEX INDEX pg_toast.pg_toast_1260_index;
2836-
ERROR: must be owner of index pg_toast_1260_index
2836+
ERROR: permission denied for index pg_toast_1260_index
28372837
-- Clean up
28382838
RESET ROLE;
28392839
REVOKE USAGE ON SCHEMA pg_toast FROM regress_reindexuser;

‎src/test/regress/expected/privileges.out

Copy file name to clipboardExpand all lines: src/test/regress/expected/privileges.out
+4-4Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2928,13 +2928,13 @@ WARNING: permission denied to analyze "maintain_test", skipping it
29282928
VACUUM (ANALYZE) maintain_test;
29292929
WARNING: permission denied to vacuum "maintain_test", skipping it
29302930
CLUSTER maintain_test USING maintain_test_a_idx;
2931-
ERROR: must be owner of table maintain_test
2931+
ERROR: permission denied for table maintain_test
29322932
REFRESH MATERIALIZED VIEW refresh_test;
2933-
ERROR: must be owner of table refresh_test
2933+
ERROR: permission denied for table refresh_test
29342934
REINDEX TABLE maintain_test;
2935-
ERROR: must be owner of table maintain_test
2935+
ERROR: permission denied for table maintain_test
29362936
REINDEX INDEX maintain_test_a_idx;
2937-
ERROR: must be owner of index maintain_test_a_idx
2937+
ERROR: permission denied for index maintain_test_a_idx
29382938
REINDEX SCHEMA reindex_test;
29392939
ERROR: must be owner of schema reindex_test
29402940
RESET ROLE;

‎src/test/regress/expected/vacuum.out

Copy file name to clipboardExpand all lines: src/test/regress/expected/vacuum.out
+18Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -442,14 +442,20 @@ ALTER TABLE vacowned_parted OWNER TO regress_vacuum;
442442
ALTER TABLE vacowned_part1 OWNER TO regress_vacuum;
443443
SET ROLE regress_vacuum;
444444
VACUUM vacowned_parted;
445+
WARNING: permission denied to vacuum "vacowned_part2", skipping it
445446
VACUUM vacowned_part1;
446447
VACUUM vacowned_part2;
448+
WARNING: permission denied to vacuum "vacowned_part2", skipping it
447449
ANALYZE vacowned_parted;
450+
WARNING: permission denied to analyze "vacowned_part2", skipping it
448451
ANALYZE vacowned_part1;
449452
ANALYZE vacowned_part2;
453+
WARNING: permission denied to analyze "vacowned_part2", skipping it
450454
VACUUM (ANALYZE) vacowned_parted;
455+
WARNING: permission denied to vacuum "vacowned_part2", skipping it
451456
VACUUM (ANALYZE) vacowned_part1;
452457
VACUUM (ANALYZE) vacowned_part2;
458+
WARNING: permission denied to vacuum "vacowned_part2", skipping it
453459
RESET ROLE;
454460
-- Only one partition owned by other user.
455461
ALTER TABLE vacowned_parted OWNER TO CURRENT_USER;
@@ -478,14 +484,26 @@ ALTER TABLE vacowned_parted OWNER TO regress_vacuum;
478484
ALTER TABLE vacowned_part1 OWNER TO CURRENT_USER;
479485
SET ROLE regress_vacuum;
480486
VACUUM vacowned_parted;
487+
WARNING: permission denied to vacuum "vacowned_part1", skipping it
488+
WARNING: permission denied to vacuum "vacowned_part2", skipping it
481489
VACUUM vacowned_part1;
490+
WARNING: permission denied to vacuum "vacowned_part1", skipping it
482491
VACUUM vacowned_part2;
492+
WARNING: permission denied to vacuum "vacowned_part2", skipping it
483493
ANALYZE vacowned_parted;
494+
WARNING: permission denied to analyze "vacowned_part1", skipping it
495+
WARNING: permission denied to analyze "vacowned_part2", skipping it
484496
ANALYZE vacowned_part1;
497+
WARNING: permission denied to analyze "vacowned_part1", skipping it
485498
ANALYZE vacowned_part2;
499+
WARNING: permission denied to analyze "vacowned_part2", skipping it
486500
VACUUM (ANALYZE) vacowned_parted;
501+
WARNING: permission denied to vacuum "vacowned_part1", skipping it
502+
WARNING: permission denied to vacuum "vacowned_part2", skipping it
487503
VACUUM (ANALYZE) vacowned_part1;
504+
WARNING: permission denied to vacuum "vacowned_part1", skipping it
488505
VACUUM (ANALYZE) vacowned_part2;
506+
WARNING: permission denied to vacuum "vacowned_part2", skipping it
489507
RESET ROLE;
490508
DROP TABLE vacowned;
491509
DROP TABLE vacowned_parted;

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.