Re: non-superusers are allowed to drop the replication user, but are not allowed to alter or even create them, is that ok?

On Thu, Sep 30, 2021 at 8:40 PM Mark Dilger <mark(dot)dilger(at)enterprisedb(dot)com>
wrote:

>
>
> > On Sep 30, 2021, at 3:07 AM, Ashutosh Sharma <ashu(dot)coek88(at)gmail(dot)com>
> wrote:
> >
> > While working on one of the internal projects I noticed that currently
> in Postgres, we do not allow normal users to alter attributes of the
> replication user. However we do allow normal users to drop replication
> users or to even rename it using the alter command. Is that behaviour ok?
> If yes, can someone please help me understand how and why this is okay.
>
> The definition of CREATEROLE is a bit of a mess. Part of the problem is
> that roles do not have owners, which makes the permissions to drop roles
> work differently than for other object types. I have a patch pending [1]
> for the version 15 development cycle that fixes this and other problems.
> I'd appreciate feedback on the design and whether it addresses your
> concerns.
>
> [1] https://commitfest.postgresql.org/34/3223/

Thanks Mark. I'll take a look at this thread in detail to see if
it addresses the issue raised here. Although from the first email it seems
like the proposal is about allowing normal users to set some of the GUC
params that can only be set by the superusers.

With Regards,
Ashutosh Sharma.