BUG #19475: VACUUM on a partition still warns after MAINTAIN is granted on the partitioned parent

Started by PG Bug reporting form4 months ago2 messagesbugs
Jump to latest
#1PG Bug reporting form
noreply@postgresql.org

The following bug has been logged on the website:

Bug reference: 19475
Logged by: Chi Zhang
Email address: 798604270@qq.com
PostgreSQL version: 18.3
Operating system: Ubuntu 24.04
Description:

Hi,

I tested the current PostgreSQL master at commit 901ed9b352b (postgres
--version reports PostgreSQL 19devel). The current branch already contains
commit ff9618e82a466fc9c635f9f087776e57b21e4f14, whose commit message says:

“For partitions, allow the maintenance command if the user has the MAINTAIN
privilege on the partition or any parent.”

However, the following test case still produces a permission warning when
VACUUM is run directly on a partition after granting MAINTAIN only on its
partitioned parent.

Reproduction:

```
CREATE TABLE parent (a int) PARTITION BY RANGE (a);
CREATE TABLE child PARTITION OF parent
FOR VALUES FROM (0) TO (100);
INSERT INTO parent VALUES (1), (2), (3);

GRANT MAINTAIN ON parent TO main_role;

SET client_min_messages = warning;
SET ROLE main_role;

VACUUM child; -- WARNING: permission denied to vacuum "child", skipping it

```

#2Nathan Bossart
nathandbossart@gmail.com
In reply to: PG Bug reporting form (#1)
Re: BUG #19475: VACUUM on a partition still warns after MAINTAIN is granted on the partitioned parent

On Mon, May 11, 2026 at 07:41:42AM +0000, PG Bug reporting form wrote:

I tested the current PostgreSQL master at commit 901ed9b352b (postgres
--version reports PostgreSQL 19devel). The current branch already contains
commit ff9618e82a466fc9c635f9f087776e57b21e4f14, whose commit message says:

“For partitions, allow the maintenance command if the user has the MAINTAIN
privilege on the partition or any parent.”

Note that MAINTAIN was reverted after commit ff9618e82a and was
reintroduced in commit ecb0fd3372, so the former's commit message may no
longer be accurate.

However, the following test case still produces a permission warning when
VACUUM is run directly on a partition after granting MAINTAIN only on its
partitioned parent.

Reproduction:

```
CREATE TABLE parent (a int) PARTITION BY RANGE (a);
CREATE TABLE child PARTITION OF parent
FOR VALUES FROM (0) TO (100);
INSERT INTO parent VALUES (1), (2), (3);

GRANT MAINTAIN ON parent TO main_role;

SET client_min_messages = warning;
SET ROLE main_role;

VACUUM child; -- WARNING: permission denied to vacuum "child", skipping it

The current VACUUM documentation states the following:

To vacuum a table, one must ordinarily have the MAINTAIN privilege on
the table. However, database owners are allowed to vacuum all tables in
their databases, except shared catalogs. VACUUM will skip over any
tables that the calling user does not have permission to vacuum.

--
nathan