Re: Role membership and DROP

2019-11-20 Thread Tom Lane
Laurenz Albe writes: > On Tue, 2019-11-19 at 13:21 -0500, Tom Lane wrote: >> Looking at the page again, I notice that there's a para a little further >> down that overlaps quite a bit with what we're discussing here, but it's >> about implicit grant options rather than the right to DROP. In the >

Re: Role membership and DROP

2019-11-19 Thread Laurenz Albe
On Tue, 2019-11-19 at 13:21 -0500, Tom Lane wrote: > Laurenz Albe writes: > > On Fri, 2019-11-15 at 13:41 -0500, Tom Lane wrote: > > > Laurenz Albe writes: > > > > On Wed, 2019-11-13 at 17:17 -0500, Tom Lane wrote: > > > > > It might be worth clarifying this point in section 5.7, > > > > > https:

Re: Role membership and DROP

2019-11-19 Thread Tom Lane
Laurenz Albe writes: > On Fri, 2019-11-15 at 13:41 -0500, Tom Lane wrote: >> Laurenz Albe writes: >>> On Wed, 2019-11-13 at 17:17 -0500, Tom Lane wrote: It might be worth clarifying this point in section 5.7, https://www.postgresql.org/docs/devel/ddl-priv.html > I like your second sent

Re: Role membership and DROP

2019-11-18 Thread Laurenz Albe
On Fri, 2019-11-15 at 13:41 -0500, Tom Lane wrote: > Laurenz Albe writes: > > On Wed, 2019-11-13 at 17:17 -0500, Tom Lane wrote: > > > It might be worth clarifying this point in section 5.7, > > > https://www.postgresql.org/docs/devel/ddl-priv.html > > > but let's not duplicate that in every ref/

Re: Role membership and DROP

2019-11-15 Thread Tom Lane
Laurenz Albe writes: > On Wed, 2019-11-13 at 17:17 -0500, Tom Lane wrote: >> It might be worth clarifying this point in section 5.7, >> https://www.postgresql.org/docs/devel/ddl-priv.html >> but let's not duplicate that in every ref/ page. > I have attached a proposed patch. The right to

Re: Role membership and DROP

2019-11-15 Thread Laurenz Albe
On Wed, 2019-11-13 at 17:17 -0500, Tom Lane wrote: > Laurenz Albe writes: > > I realized only today that if role A is a member of role B, > > A can ALTER and DROP objects owned by B. > > I don't have a problem with that, but the documentation seems to > > suggest otherwise. For example, for DROP

Re: Role membership and DROP

2019-11-13 Thread Tom Lane
Laurenz Albe writes: > I realized only today that if role A is a member of role B, > A can ALTER and DROP objects owned by B. > I don't have a problem with that, but the documentation seems to > suggest otherwise. For example, for DROP TABLE: >Only the table owner, the schema owner, and supe

Role membership and DROP

2019-11-13 Thread Laurenz Albe
I realized only today that if role A is a member of role B, A can ALTER and DROP objects owned by B. I don't have a problem with that, but the documentation seems to suggest otherwise. For example, for DROP TABLE: Only the table owner, the schema owner, and superuser can drop a table. Should