document deviation from standard on REVOKE ROLE
Hackorum builds and tests every patch posted to the lists, not only commitfest submissions. This is Hackorum's own CI rather than the PostgreSQL project's, and it is still under testing - please report anything that looks wrong.
You can run a PostgreSQL built from this patch straight from Docker, with no checkout and no build:
docker run --rm -p 5432:5432 ghcr.io/hackorum-dev/postgres-patch:t43174psql -h localhost -U postgresBuilt from patchset v1 (message #1), September 20, 2026 at 11:59 AM.
Every patchset is also pushed to a branch of our PostgreSQL fork, so you can check out the same tree CI built. Without a PostgreSQL checkout:
git clone --branch t43174_1 https://github.com/hackorum-dev/postgres.gitIn a checkout you already have, add the fork once:
git remote add hackorum https://github.com/hackorum-dev/postgres.gitthen, for this patchset and every later one:
git fetch hackorum t43174_1 && git checkout t43174_1Patchset v1 (message #1) is on t43174_1
This is the other doc fix as suggested in
/messages/by-id/20201027220555.GS4951@momjian.us
There is already a compatibility section, so put there.
--
John Naylor
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
On Fri, Oct 30, 2020 at 02:03:48PM -0400, John Naylor wrote:
This is the other doc fix as suggested in
/messages/by-id/20201027220555.GS4951@momjian.usThere is already a compatibility section, so put there.
--
John Naylor
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company
diff --git a/doc/src/sgml/ref/revoke.sgml b/doc/src/sgml/ref/revoke.sgml index 35ff87a4f5..c8d5be92db 100644 --- a/doc/src/sgml/ref/revoke.sgml +++ b/doc/src/sgml/ref/revoke.sgml @@ -298,6 +298,12 @@ REVOKE admins FROM joe; is required according to the standard, but <productname>PostgreSQL</productname> assumes <literal>RESTRICT</literal> by default. </para> + + <para> + In the SQL standard, <command>REVOKE</command> only revokes the privilege + as granted by the invoking role. In <productname>PostgreSQL</productname>, + this will also revoke privileges granted by other roles. + </para> </refsect1><refsect1>
John, should this 2020 patch still be applied?
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
Bruce Momjian <bruce@momjian.us> writes:
On Fri, Oct 30, 2020 at 02:03:48PM -0400, John Naylor wrote:
+ In the SQL standard, <command>REVOKE</command> only revokes the privilege + as granted by the invoking role. In <productname>PostgreSQL</productname>, + this will also revoke privileges granted by other roles.
John, should this 2020 patch still be applied?
[ raised eyebrow... ] I do not think that was ever true as written,
and it's demonstrably not true now.
regression=# create user alice;
CREATE ROLE
regression=# create user bob;
CREATE ROLE
regression=# create table subject (id int);
CREATE TABLE
regression=# grant select on table subject to alice with grant option;
GRANT
regression=# grant select on table subject to bob with grant option;
GRANT
regression=# \c - alice
You are now connected to database "regression" as user "alice".
regression=> grant select on table subject to public;
GRANT
regression=> \c - bob
You are now connected to database "regression" as user "bob".
regression=> grant select on table subject to public;
GRANT
regression=> \dp subject
Access privileges
Schema | Name | Type | Access privileges | Column privileges | Policies
--------+---------+-------+---------------------------+-------------------+----------
public | subject | table | postgres=arwdDxt/postgres+| |
| | | alice=r*/postgres +| |
| | | bob=r*/postgres +| |
| | | =r/alice +| |
| | | =r/bob | |
(1 row)
regression=> revoke select on table subject from public;
REVOKE
regression=> \dp subject
Access privileges
Schema | Name | Type | Access privileges | Column privileges | Policies
--------+---------+-------+---------------------------+-------------------+----------
public | subject | table | postgres=arwdDxt/postgres+| |
| | | alice=r*/postgres +| |
| | | bob=r*/postgres +| |
| | | =r/alice | |
(1 row)
Maybe there's some related point that needs to be made,
but not that one.
regards, tom lane
On Wed, Nov 1, 2023 at 07:49:25PM -0400, Tom Lane wrote:
Bruce Momjian <bruce@momjian.us> writes:
On Fri, Oct 30, 2020 at 02:03:48PM -0400, John Naylor wrote:
+ In the SQL standard, <command>REVOKE</command> only revokes the privilege + as granted by the invoking role. In <productname>PostgreSQL</productname>, + this will also revoke privileges granted by other roles.John, should this 2020 patch still be applied?
[ raised eyebrow... ] I do not think that was ever true as written,
and it's demonstrably not true now.
..
Maybe there's some related point that needs to be made,
but not that one.
Cool, thanks, closed!
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.