Re: Granting SET and ALTER SYSTE privileges for GUCs - Mailing list pgsql-hackers

From Mark Dilger
Subject Re: Granting SET and ALTER SYSTE privileges for GUCs
Date
Msg-id 0A3D3CBA-6548-4C9E-9F46-59D5C51A1F31@enterprisedb.com
Whole thread Raw
In response to Re: Granting SET and ALTER SYSTE privileges for GUCs  (Joshua Brindle <joshua.brindle@crunchydata.com>)
Responses Re: Granting SET and ALTER SYSTE privileges for GUCs
List pgsql-hackers

> On Dec 16, 2021, at 7:43 AM, Joshua Brindle <joshua.brindle@crunchydata.com> wrote:
>
> Ah, I understand now. Would it be possible to pass the
> SettingAclRelationId if it exists or InvalidOid if not?

SettingAclRelationId is always defined, so we can always pass that value.  But the settingId itself may sometimes be
InvalidOid.

> That way if a
> MAC implementation cares about a particular GUC it'll ensure it's in
> pg_setting_acl.

A much cleaner solution would be to create new ObjectAccessTypes with a corresponding new Invoke macro and Run
function. Those could take setting names, not Oids, and include additional information about whether the operation is
SET,RESET or ALTER SYSTEM, what the new value is (if any), what kind of setting it is (bool, int, ...), etc.  I don't
thinksuch a patch would even be all that hard to write. 

What do you think?

—
Mark Dilger
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company






pgsql-hackers by date:

Previous
From: Thomas Munro
Date:
Subject: Re: Apple's ranlib warns about protocol_openssl.c
Next
From: Alvaro Herrera
Date:
Subject: Re: Column Filtering in Logical Replication