Re: v16 roles, SET FALSE, INHERIT FALSE, ADMIN FALSE

On Mon, Jul 8, 2024 at 6:08 PM Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> wrote:
> >> Hmm, if that check doesn't require INHERIT TRUE I'd say it's
> >> a bug.
>
> > The code doesn't support that claim.
>
> That doesn't make it not a bug. Robert, what do you think? If this
> is correct behavior, why is it correct?

Correct is debatable, but it's definitely intentional. I didn't think
that referencing a group in pg_hba.conf constituted either (a) the
group inheriting the privileges of the role -- which would make it
governed by INHERIT -- or (b) the group being able to SET ROLE to the
role -- which would make it controlled by SET. I guess you're arguing
for INHERIT which is probably the more logical of the two, but I'm not
really sold on it. I think the pg_hba.conf matching is just asking
whether X is in set S, not whether S has the privileges of X.

For contemporaneous evidence of my thinking on this subject see
https://www.postgresql.org/message-id/CA+TgmobhEYYnW9vrHvoLvD8ODsPBJuU9CbK6tms6Owd70hFMTw@mail.gmail.com
particularly the paragraph that starts with "That's it".

--
Robert Haas
EDB: http://www.enterprisedb.com