BUG #16795: Can't give "grant execute on pg_start_backup to .."

From: PG Bug reporting form <noreply(at)postgresql(dot)org>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: ken(dot)karma(at)gmail(dot)com
Subject: BUG #16795: Can't give "grant execute on pg_start_backup to .."
Date: 2020-12-28 19:29:46
Message-ID: 16795-0d02ad33c474bfbe@postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

The following bug has been logged on the website:

Bug reference: 16795
Logged by: Ken
Email address: ken(dot)karma(at)gmail(dot)com
PostgreSQL version: 13.1
Operating system: CentOS Linux release 7.9.2009
Description:

I'm want to make backup user who haven't SUPERUSER, but have "Replication"
role what must be enough, in document:
25.3.3.1. Making a Non-Exclusive Low-Level Backup
A non-exclusive low level backup is one that allows other concurrent backups
to be running (both those started using the same backup API and those
started using pg_basebackup).
Ensure that WAL archiving is enabled and working.
Connect to the server (it does not matter which database) as a user with
rights to run pg_start_backup (superuser, or a user who has been granted
EXECUTE on the function) and issue the command:
SELECT pg_start_backup('label', false, false);
But I can't give this grant:
psql -U postgres
psql (13.1)
Type "help" for help.
postgres=# create role backup replication login;
CREATE ROLE
postgres=# grant pg_read_all_settings to backup ;
GRANT ROLE
postgres=# grant SELECT on pg_start_backup to backup ;
ERROR: relation "pg_start_backup" does not exist
postgres=# grant EXECUTE on pg_catalog.pg_start_backup to backup ;
ERROR: relation "pg_catalog.pg_start_backup" does not exist
postgres=# grant SELECT on pg_catalog.pg_start_backup to backup ;
ERROR: relation "pg_catalog.pg_start_backup" does not exist
postgres=# select pg_start_backup('Daily backup');
pg_start_backup
-----------------
0/10000028
(1 row)
postgres=# \df pg_start_backup ;
List of functions
Schema | Name | Result data type |
Argument data types | Type
------------+-----------------+------------------+------------------------------------------------------------------------+------
pg_catalog | pg_start_backup | pg_lsn | label text, fast boolean
DEFAULT false, exclusive boolean DEFAULT true | func
(1 row)

[root(at)host(dot)test(dot)mta ~]# psql -U backup postgres
psql (13.1)
Type "help" for help.

postgres=> select pg_start_backup('Daily backup');
ERROR: permission denied for function pg_start_backup

postgres=> \du+
List of roles
Role name | Attributes |
Member of | Description
-----------+------------------------------------------------------------+------------------------+-------------
backup | Replication |
{pg_read_all_settings} |
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
|

In PostrgreSQL log:
2020-12-28 19:20:07.696 EET postgres postgres [10076]ERROR: relation
"pg_catalog.pg_start_backup" does not exist
2020-12-28 19:20:07.696 EET postgres postgres [10076]STATEMENT: grant
EXECUTE on pg_catalog.pg_start_backup to backup ;
2020-12-28 19:21:48.853 EET postgres postgres [10076]ERROR: relation
"pg_catalog.pg_start_backup" does not exist
2020-12-28 19:21:48.853 EET postgres postgres [10076]STATEMENT: grant
SELECT on pg_catalog.pg_start_backup to backup ;
2020-12-28 20:18:30.281 EET postgres backup [12482]ERROR: permission denied
for function pg_start_backup
2020-12-28 20:18:30.281 EET postgres backup [12482]STATEMENT: select
pg_start_backup('Daily backup');

Do I miss something, why can't I give execute on pg_start_backup to user
backup?

Responses

Browse pgsql-bugs by date

  From Date Subject
Next Message Tom Lane 2020-12-28 20:48:12 Re: BUG #16795: Can't give "grant execute on pg_start_backup to .."
Previous Message Tom Lane 2020-12-28 17:14:46 Re: Missing compiled default for channel_binding param from PQconndefaults