From 151c22deee66a3390ca9a1c3675e29de54ae73fc Mon Sep 17 00:00:00 2001 From: Nathan Bossart Date: Fri, 7 Jul 2023 11:25:13 -0700 Subject: Revert MAINTAIN privilege and pg_maintain predefined role. This reverts the following commits: 4dbdb82513, c2122aae63, 5b1a879943, 9e1e9d6560, ff9618e82a, 60684dd834, 4441fc704d, and b5d6382496. A role with the MAINTAIN privilege may be able to use search_path tricks to escalate privileges to the table owner. Unfortunately, it is too late in the v16 development cycle to apply the proposed fix, i.e., restricting search_path when running maintenance commands. Bumps catversion. Reviewed-by: Jeff Davis Discussion: https://postgr.es/m/E1q7j7Y-000z1H-Hr%40gemulon.postgresql.org Backpatch-through: 16 --- doc/src/sgml/ddl.sgml | 35 +++++++------------------ doc/src/sgml/func.sgml | 2 +- doc/src/sgml/ref/alter_default_privileges.sgml | 4 +-- doc/src/sgml/ref/analyze.sgml | 6 +++-- doc/src/sgml/ref/cluster.sgml | 10 +++---- doc/src/sgml/ref/grant.sgml | 3 +-- doc/src/sgml/ref/lock.sgml | 4 +-- doc/src/sgml/ref/refresh_materialized_view.sgml | 5 ++-- doc/src/sgml/ref/reindex.sgml | 23 +++++++--------- doc/src/sgml/ref/revoke.sgml | 2 +- doc/src/sgml/ref/vacuum.sgml | 6 +++-- doc/src/sgml/user-manag.sgml | 12 --------- 12 files changed, 38 insertions(+), 74 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml index e32f8253d03..43179959658 100644 --- a/doc/src/sgml/ddl.sgml +++ b/doc/src/sgml/ddl.sgml @@ -1718,8 +1718,8 @@ ALTER TABLE products RENAME TO items; INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, TRIGGER, CREATE, CONNECT, TEMPORARY, - EXECUTE, USAGE, SET, - ALTER SYSTEM, and MAINTAIN. + EXECUTE, USAGE, SET + and ALTER SYSTEM. The privileges applicable to a particular object vary depending on the object's type (table, function, etc.). More detail about the meanings of these privileges appears below. @@ -2010,19 +2010,7 @@ REVOKE ALL ON accounts FROM PUBLIC; - - - MAINTAIN - - - Allows VACUUM, ANALYZE, - CLUSTER, REFRESH MATERIALIZED VIEW, - REINDEX, and LOCK TABLE on a - relation. - - - - + The privileges required by other commands are listed on the reference page of the respective command. @@ -2171,11 +2159,6 @@ REVOKE ALL ON accounts FROM PUBLIC; A PARAMETER - - MAINTAIN - m - TABLE - @@ -2266,7 +2249,7 @@ REVOKE ALL ON accounts FROM PUBLIC; TABLE (and table-like objects) - arwdDxtm + arwdDxt none \dp @@ -2325,11 +2308,11 @@ GRANT SELECT (col1), UPDATE (col1) ON mytable TO miriam_rw; => \dp mytable Access privileges - Schema | Name | Type | Access privileges | Column privileges | Policies ---------+---------+-------+------------------------+-----------------------+---------- - public | mytable | table | miriam=arwdDxtm/miriam+| col1: +| - | | | =r/miriam +| miriam_rw=rw/miriam | - | | | admin=arw/miriam | | + Schema | Name | Type | Access privileges | Column privileges | Policies +--------+---------+-------+-----------------------+-----------------------+---------- + public | mytable | table | miriam=arwdDxt/miriam+| col1: +| + | | | =r/miriam +| miriam_rw=rw/miriam | + | | | admin=arw/miriam | | (1 row) diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml index 5a47ce43434..0b62e0c8285 100644 --- a/doc/src/sgml/func.sgml +++ b/doc/src/sgml/func.sgml @@ -23545,7 +23545,7 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute'); are SELECT, INSERT, UPDATE, DELETE, TRUNCATE, REFERENCES, - TRIGGER, and MAINTAIN. + and TRIGGER. diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgml index a33461fbc2f..f1d54f5aa35 100644 --- a/doc/src/sgml/ref/alter_default_privileges.sgml +++ b/doc/src/sgml/ref/alter_default_privileges.sgml @@ -28,7 +28,7 @@ ALTER DEFAULT PRIVILEGES where abbreviated_grant_or_revoke is one of: -GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN } +GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } [, ...] | ALL [ PRIVILEGES ] } ON TABLES TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ] @@ -51,7 +51,7 @@ GRANT { USAGE | CREATE | ALL [ PRIVILEGES ] } TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ] REVOKE [ GRANT OPTION FOR ] - { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN } + { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } [, ...] | ALL [ PRIVILEGES ] } ON TABLES FROM { [ GROUP ] role_name | PUBLIC } [, ...] diff --git a/doc/src/sgml/ref/analyze.sgml b/doc/src/sgml/ref/analyze.sgml index 954491b5df0..aa3e9e1c5fe 100644 --- a/doc/src/sgml/ref/analyze.sgml +++ b/doc/src/sgml/ref/analyze.sgml @@ -182,9 +182,11 @@ ANALYZE [ VERBOSE ] [ table_and_columnsNotes - To analyze a table, one must ordinarily have the MAINTAIN - privilege on the table. However, database owners are allowed to + To analyze a table, one must ordinarily be the table's owner or a + superuser. However, database owners are allowed to analyze all tables in their databases, except shared catalogs. + (The restriction for shared catalogs means that a true database-wide + ANALYZE can only be performed by a superuser.) ANALYZE will skip over any tables that the calling user does not have permission to analyze. diff --git a/doc/src/sgml/ref/cluster.sgml b/doc/src/sgml/ref/cluster.sgml index 06f3d269e67..0ed29a5c6d4 100644 --- a/doc/src/sgml/ref/cluster.sgml +++ b/doc/src/sgml/ref/cluster.sgml @@ -70,8 +70,9 @@ CLUSTER [VERBOSE] CLUSTER without a table_name reclusters all the previously-clustered tables in the current database that the calling user - has privileges for. This form of CLUSTER cannot be - executed inside a transaction block. + owns, or all such tables if called by a superuser. This + form of CLUSTER cannot be executed inside a transaction + block. @@ -132,11 +133,6 @@ CLUSTER [VERBOSE] Notes - - To cluster a table, one must have the MAINTAIN privilege - on the table. - - In cases where you are accessing single rows randomly within a table, the actual order of the data in the diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml index 35bf0332c8f..1ae5770fbbf 100644 --- a/doc/src/sgml/ref/grant.sgml +++ b/doc/src/sgml/ref/grant.sgml @@ -21,7 +21,7 @@ PostgreSQL documentation -GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN } +GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } [, ...] | ALL [ PRIVILEGES ] } ON { [ TABLE ] table_name [, ...] | ALL TABLES IN SCHEMA schema_name [, ...] } @@ -193,7 +193,6 @@ GRANT role_name [, ...] TO USAGE SET ALTER SYSTEM - MAINTAIN Specific types of privileges, as defined in . diff --git a/doc/src/sgml/ref/lock.sgml b/doc/src/sgml/ref/lock.sgml index 070855da18b..6ce2518de74 100644 --- a/doc/src/sgml/ref/lock.sgml +++ b/doc/src/sgml/ref/lock.sgml @@ -166,8 +166,8 @@ LOCK [ TABLE ] [ ONLY ] name [ * ] To lock a table, the user must have the right privilege for the specified - lockmode. - If the user has MAINTAIN, + lockmode, or be the table's + owner or a superuser. If the user has UPDATE, DELETE, or TRUNCATE privileges on the table, any lockmode is permitted. If the user has diff --git a/doc/src/sgml/ref/refresh_materialized_view.sgml b/doc/src/sgml/ref/refresh_materialized_view.sgml index 19737668cdb..675d6090f3c 100644 --- a/doc/src/sgml/ref/refresh_materialized_view.sgml +++ b/doc/src/sgml/ref/refresh_materialized_view.sgml @@ -31,9 +31,8 @@ REFRESH MATERIALIZED VIEW [ CONCURRENTLY ] name REFRESH MATERIALIZED VIEW completely replaces the - contents of a materialized view. To execute this command you must have the - MAINTAIN - privilege on the materialized view. The old contents are discarded. If + contents of a materialized view. To execute this command you must be the + owner of the materialized view. The old contents are discarded. If WITH DATA is specified (or defaults) the backing query is executed to provide the new data, and the materialized view is left in a scannable state. If WITH NO DATA is specified no new diff --git a/doc/src/sgml/ref/reindex.sgml b/doc/src/sgml/ref/reindex.sgml index bef3486843c..21e2e91d896 100644 --- a/doc/src/sgml/ref/reindex.sgml +++ b/doc/src/sgml/ref/reindex.sgml @@ -292,21 +292,16 @@ REINDEX [ ( option [, ...] ) ] { DA - Reindexing a single index or table requires - having the MAINTAIN privilege on the - table. Note that while REINDEX on a partitioned index or - table requires having the MAINTAIN privilege on the - partitioned table, such commands skip the privilege checks when processing - the individual partitions. Reindexing a schema or database requires being the - owner of that schema or database or having privileges of the - pg_maintain - role. Note specifically that it's thus + Reindexing a single index or table requires being the owner of that + index or table. Reindexing a schema or database requires being the + owner of that schema or database. Note specifically that it's thus possible for non-superusers to rebuild indexes of tables owned by - other users. However, as a special exception, - REINDEX DATABASE, REINDEX SCHEMA, - and REINDEX SYSTEM will skip indexes on shared catalogs - unless the user has the MAINTAIN privilege on the - catalog. + other users. However, as a special exception, when + REINDEX DATABASE, REINDEX SCHEMA + or REINDEX SYSTEM is issued by a non-superuser, + indexes on shared catalogs will be skipped unless the user owns the + catalog (which typically won't be the case). Of course, superusers + can always reindex anything. diff --git a/doc/src/sgml/ref/revoke.sgml b/doc/src/sgml/ref/revoke.sgml index 8df492281a1..2db66bbf378 100644 --- a/doc/src/sgml/ref/revoke.sgml +++ b/doc/src/sgml/ref/revoke.sgml @@ -22,7 +22,7 @@ PostgreSQL documentation REVOKE [ GRANT OPTION FOR ] - { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN } + { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } [, ...] | ALL [ PRIVILEGES ] } ON { [ TABLE ] table_name [, ...] | ALL TABLES IN SCHEMA schema_name [, ...] } diff --git a/doc/src/sgml/ref/vacuum.sgml b/doc/src/sgml/ref/vacuum.sgml index c42bbea9e22..65c03bf8299 100644 --- a/doc/src/sgml/ref/vacuum.sgml +++ b/doc/src/sgml/ref/vacuum.sgml @@ -444,9 +444,11 @@ VACUUM [ FULL ] [ FREEZE ] [ VERBOSE ] [ ANALYZE ] [ CHECKPOINT command. - - pg_maintain - Allow executing - VACUUM, - ANALYZE, - CLUSTER, - REFRESH MATERIALIZED VIEW, - REINDEX, - and LOCK TABLE on all - relations, as if having MAINTAIN rights on those - objects, even without having it explicitly. - pg_use_reserved_connections Allow use of connection slots reserved via -- cgit v1.2.3