diff options
| author | Nathan Bossart <nathan@postgresql.org> | 2024-04-15 14:03:24 -0500 |
|---|---|---|
| committer | Nathan Bossart <nathan@postgresql.org> | 2024-04-15 14:03:24 -0500 |
| commit | 953cf49e166a1a64e1eaf2b091b84e02848b8c75 (patch) | |
| tree | e3965ec38dc5082e0be5f2e4bdae23275e1ae017 /doc/src | |
| parent | e0df80828abc0c01fcde123389032370b98f2015 (diff) | |
| download | postgresql-953cf49e166a1a64e1eaf2b091b84e02848b8c75.tar.gz postgresql-953cf49e166a1a64e1eaf2b091b84e02848b8c75.zip | |
doc: Note exceptions for SET ROLE's effect on privilege checks.
The documentation for SET ROLE states that superusers who switch to
a non-superuser role lose their superuser privileges. While this
is true for most commands, there are exceptions such as SET ROLE
and SET SESSION AUTHORIZATION, which continue to use the current
session user and the authenticated user, respectively.
Furthermore, the description of this command already describes its
effect, so it is arguably unnecessary to include this special case.
This commit removes the note about the superuser case and adds a
sentence about the aforementioned exceptions to the description.
Co-authored-by: Yurii Rashkovskii
Reviewed-by: Shubham Khanna, Robert Haas, Michael Paquier
Discussion: https://postgr.es/m/CA%2BRLCQysHtME0znk2KUMJN343ksboSRQSU-hCnOjesX6VK300Q%40mail.gmail.com
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/ref/set_role.sgml | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/doc/src/sgml/ref/set_role.sgml b/doc/src/sgml/ref/set_role.sgml index 083e6dc6ea9..9557bb77aba 100644 --- a/doc/src/sgml/ref/set_role.sgml +++ b/doc/src/sgml/ref/set_role.sgml @@ -37,7 +37,10 @@ RESET ROLE written as either an identifier or a string literal. After <command>SET ROLE</command>, permissions checking for SQL commands is carried out as though the named role were the one that had logged - in originally. + in originally. Note that <command>SET ROLE</command> and + <command>SET SESSION AUTHORIZATION</command> are exceptions; permissions + checks for those continue to use the current session user and the initial + session user (the <firstterm>authenticated user</firstterm>), respectively. </para> <para> @@ -89,11 +92,6 @@ RESET ROLE </para> <para> - Note that when a superuser chooses to <command>SET ROLE</command> to a - non-superuser role, they lose their superuser privileges. - </para> - - <para> <command>SET ROLE</command> has effects comparable to <link linkend="sql-set-session-authorization"><command>SET SESSION AUTHORIZATION</command></link>, but the privilege checks involved are quite different. Also, |