doc: REPACK is missing from the MAINTAIN privilege documentation
Hi hackers,
REPACK requires the MAINTAIN privilege, as its documentation states,
but REPACK is missing from the two places that enumerate the commands
MAINTAIN covers: the MAINTAIN privilege description in ddl.sgml and
the pg_maintain predefined role description in user-manag.sgml. This
looks like an oversight in commit ac58465e061, which introduced
REPACK.
The attached patch adds REPACK next to CLUSTER in both places.
Thoughts?
--
Best regards,
Shinya Kato
NTT OSS Center
Attachments:
v1-0001-doc-Add-REPACK-to-the-list-of-commands-allowed-by.patchapplication/octet-stream; name=v1-0001-doc-Add-REPACK-to-the-list-of-commands-allowed-by.patchDownload+3-2
On Wed, Jul 15, 2026 at 12:02 PM Shinya Kato <shinya11.kato@gmail.com> wrote:
Hi hackers,
REPACK requires the MAINTAIN privilege, as its documentation states,
but REPACK is missing from the two places that enumerate the commands
MAINTAIN covers: the MAINTAIN privilege description in ddl.sgml and
the pg_maintain predefined role description in user-manag.sgml. This
looks like an oversight in commit ac58465e061, which introduced
REPACK.The attached patch adds REPACK next to CLUSTER in both places.
Confirmed, and the patch looks correct to me. REPACK does require
MAINTAIN (per repack.sgml), and ac58465e061 missed adding it to these
lists.
I went through the other places that mention MAINTAIN, and these two are
indeed the only spots that enumerate the covered commands: grant.sgml
just points at ddl-priv, the privilege-abbreviations table only gives
the name/letter, and the GRANT/REVOKE synopses list MAINTAIN as a
keyword rather than expanding it. The per-command reference pages only
state that they require MAINTAIN. So the patch is complete. The
sql-repack link target exists too, and putting REPACK right after
CLUSTER reads well.
+1 from me.
Thoughts?
--
Best regards,
Shinya Kato
NTT OSS Center
--
Regards,
Ewan Young
On Wed, Jul 15, 2026 at 3:59 PM Ewan Young <kdbase.hack@gmail.com> wrote:
On Wed, Jul 15, 2026 at 12:02 PM Shinya Kato <shinya11.kato@gmail.com> wrote:
Hi hackers,
REPACK requires the MAINTAIN privilege, as its documentation states,
but REPACK is missing from the two places that enumerate the commands
MAINTAIN covers: the MAINTAIN privilege description in ddl.sgml and
the pg_maintain predefined role description in user-manag.sgml. This
looks like an oversight in commit ac58465e061, which introduced
REPACK.The attached patch adds REPACK next to CLUSTER in both places.
Confirmed, and the patch looks correct to me. REPACK does require
MAINTAIN (per repack.sgml), and ac58465e061 missed adding it to these
lists.I went through the other places that mention MAINTAIN, and these two are
indeed the only spots that enumerate the covered commands: grant.sgml
just points at ddl-priv, the privilege-abbreviations table only gives
the name/letter, and the GRANT/REVOKE synopses list MAINTAIN as a
keyword rather than expanding it. The per-command reference pages only
state that they require MAINTAIN. So the patch is complete. The
sql-repack link target exists too, and putting REPACK right after
CLUSTER reads well.+1 from me.
+1
It's also better to update the following source comment in aclchk.c.
/*
* Check if ACL_MAINTAIN is being checked and, if so, and not already set
* as part of the result, then check if the user is a member of the
* pg_maintain role, which allows VACUUM, ANALYZE, CLUSTER, REFRESH
* MATERIALIZED VIEW, REINDEX, and LOCK TABLE on all relations.
*/
if (mask & ACL_MAINTAIN &&
!(result & ACL_MAINTAIN) &&
has_privs_of_role(roleid, ROLE_PG_MAINTAIN))
result |= ACL_MAINTAIN;
Regards,
--
Fujii Masao
On Wed, Jul 15, 2026 at 6:55 PM Fujii Masao <masao.fujii@gmail.com> wrote
It's also better to update the following source comment in aclchk.c.
/*
* Check if ACL_MAINTAIN is being checked and, if so, and not already set
* as part of the result, then check if the user is a member of the
* pg_maintain role, which allows VACUUM, ANALYZE, CLUSTER, REFRESH
* MATERIALIZED VIEW, REINDEX, and LOCK TABLE on all relations.
*/
if (mask & ACL_MAINTAIN &&
!(result & ACL_MAINTAIN) &&
has_privs_of_role(roleid, ROLE_PG_MAINTAIN))
result |= ACL_MAINTAIN;
Good catch, thanks! I've updated the patch as you said.
--
Best regards,
Shinya Kato
NTT OSS Center
Attachments:
v2-0001-doc-Add-REPACK-to-the-list-of-commands-allowed-by.patchapplication/octet-stream; name=v2-0001-doc-Add-REPACK-to-the-list-of-commands-allowed-by.patchDownload+5-4
On Thu, Jul 16, 2026 at 7:36 AM Shinya Kato <shinya11.kato@gmail.com> wrote:
On Wed, Jul 15, 2026 at 6:55 PM Fujii Masao <masao.fujii@gmail.com> wrote
It's also better to update the following source comment in aclchk.c.
/*
* Check if ACL_MAINTAIN is being checked and, if so, and not already set
* as part of the result, then check if the user is a member of the
* pg_maintain role, which allows VACUUM, ANALYZE, CLUSTER, REFRESH
* MATERIALIZED VIEW, REINDEX, and LOCK TABLE on all relations.
*/
if (mask & ACL_MAINTAIN &&
!(result & ACL_MAINTAIN) &&
has_privs_of_role(roleid, ROLE_PG_MAINTAIN))
result |= ACL_MAINTAIN;Good catch, thanks! I've updated the patch as you said.
Thanks for updating the patch! I've pushed it.
Regards,
--
Fujii Masao