From: | PG Bug reporting form <noreply(at)postgresql(dot)org> |
---|---|
To: | pgsql-bugs(at)lists(dot)postgresql(dot)org |
Cc: | ken(dot)karma(at)gmail(dot)com |
Subject: | BUG #16795: Can't give "grant execute on pg_start_backup to .." |
Date: | 2020-12-28 19:29:46 |
Message-ID: | 16795-0d02ad33c474bfbe@postgresql.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-bugs |
The following bug has been logged on the website:
Bug reference: 16795
Logged by: Ken
Email address: ken(dot)karma(at)gmail(dot)com
PostgreSQL version: 13.1
Operating system: CentOS Linux release 7.9.2009
Description:
I'm want to make backup user who haven't SUPERUSER, but have "Replication"
role what must be enough, in document:
25.3.3.1. Making a Non-Exclusive Low-Level Backup
A non-exclusive low level backup is one that allows other concurrent backups
to be running (both those started using the same backup API and those
started using pg_basebackup).
Ensure that WAL archiving is enabled and working.
Connect to the server (it does not matter which database) as a user with
rights to run pg_start_backup (superuser, or a user who has been granted
EXECUTE on the function) and issue the command:
SELECT pg_start_backup('label', false, false);
But I can't give this grant:
psql -U postgres
psql (13.1)
Type "help" for help.
postgres=# create role backup replication login;
CREATE ROLE
postgres=# grant pg_read_all_settings to backup ;
GRANT ROLE
postgres=# grant SELECT on pg_start_backup to backup ;
ERROR: relation "pg_start_backup" does not exist
postgres=# grant EXECUTE on pg_catalog.pg_start_backup to backup ;
ERROR: relation "pg_catalog.pg_start_backup" does not exist
postgres=# grant SELECT on pg_catalog.pg_start_backup to backup ;
ERROR: relation "pg_catalog.pg_start_backup" does not exist
postgres=# select pg_start_backup('Daily backup');
pg_start_backup
-----------------
0/10000028
(1 row)
postgres=# \df pg_start_backup ;
List of functions
Schema | Name | Result data type |
Argument data types | Type
------------+-----------------+------------------+------------------------------------------------------------------------+------
pg_catalog | pg_start_backup | pg_lsn | label text, fast boolean
DEFAULT false, exclusive boolean DEFAULT true | func
(1 row)
[root(at)host(dot)test(dot)mta ~]# psql -U backup postgres
psql (13.1)
Type "help" for help.
postgres=> select pg_start_backup('Daily backup');
ERROR: permission denied for function pg_start_backup
postgres=> \du+
List of roles
Role name | Attributes |
Member of | Description
-----------+------------------------------------------------------------+------------------------+-------------
backup | Replication |
{pg_read_all_settings} |
postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {}
|
In PostrgreSQL log:
2020-12-28 19:20:07.696 EET postgres postgres [10076]ERROR: relation
"pg_catalog.pg_start_backup" does not exist
2020-12-28 19:20:07.696 EET postgres postgres [10076]STATEMENT: grant
EXECUTE on pg_catalog.pg_start_backup to backup ;
2020-12-28 19:21:48.853 EET postgres postgres [10076]ERROR: relation
"pg_catalog.pg_start_backup" does not exist
2020-12-28 19:21:48.853 EET postgres postgres [10076]STATEMENT: grant
SELECT on pg_catalog.pg_start_backup to backup ;
2020-12-28 20:18:30.281 EET postgres backup [12482]ERROR: permission denied
for function pg_start_backup
2020-12-28 20:18:30.281 EET postgres backup [12482]STATEMENT: select
pg_start_backup('Daily backup');
Do I miss something, why can't I give execute on pg_start_backup to user
backup?
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2020-12-28 20:48:12 | Re: BUG #16795: Can't give "grant execute on pg_start_backup to .." |
Previous Message | Tom Lane | 2020-12-28 17:14:46 | Re: Missing compiled default for channel_binding param from PQconndefaults |