[HACKERS] privileges for changing schema owner - Mailing list pgsql-hackers

From Peter Eisentraut
Subject [HACKERS] privileges for changing schema owner
Date
Msg-id e8f31d00-7b68-b872-a73d-e36f8ce938e7@2ndquadrant.com
Whole thread Raw
Responses Re: [HACKERS] privileges for changing schema owner  (Robert Haas <robertmhaas@gmail.com>)
List pgsql-hackers
Normally, when changing the owner of an object, we check (among other
things) that the new owner has the same privileges that would be needed
to create the object from scratch.  For for example, when changing the
owner of a type, the new owner needs to have CREATE privilege on the
containing schema.  Or when changing the owner of a foreign server, the
new owner needs to have USAGE privilege on the foreign-data wrapper.

The exception is that when changing the owner of a schema or database,
we check CREATE privilege on the database of the *current* user.  There
is even a comment about it in the code:
    * NOTE: This is different from other alter-owner checks in that the    * current user is checked for create
privilegesinstead of the    * destination owner.  This is consistent with the CREATE case for    * schemas.
 

I don't understand the rationale for this or what rationale that last
sentence is apparently trying to give.

I'm trying to extrapolate whatever rule this is to new object types, if
appropriate.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services



pgsql-hackers by date:

Previous
From: Peter Eisentraut
Date:
Subject: Re: [HACKERS] Proposal : For Auto-Prewarm.
Next
From: Robert Haas
Date:
Subject: Re: [HACKERS] pg_hba_file_settings view patch