On Thu, Mar 16, 2023 at 04:59:53PM +0100, Peter Eisentraut wrote:
> On 16.03.23 16:48, Nathan Bossart wrote:
>> > I think the following change in DropRole() is incorrect:
>> >
>> > if (!is_admin_of_role(GetUserId(), roleid))
>> > ereport(ERROR,
>> > (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
>> > - errmsg("must have admin option on role \"%s\"",
>> > - role)));
>> > + errmsg("permission denied to drop role"),
>> > + errdetail("Only roles with the %s attribute and the %s
>> > option on role \"%s\" may drop this role.",
>> > + "CREATEROLE", "ADMIN",
>> > NameStr(roleform->rolname))));
>> >
>> > The message does not reflect what check is actually performed. (Perhaps
>> > this was confused with a similar but not exactly the same check in
>> > RenameRole().)
>> Hm. Is your point that we should only mention the admin option here? I
>> mentioned both createrole and admin option in this message (and the
>> createrole check above this point) in an attempt to avoid giving partial
>> information.
>
> AFAICT, the mention of CREATEROLE is incorrect, because the code doesn't
> actually check for the CREATEROLE attribute.
There is a createrole check at the top of DropRole():
/*
* DROP ROLE
*/
void
DropRole(DropRoleStmt *stmt)
{
Relation pg_authid_rel,
pg_auth_members_rel;
ListCell *item;
List *role_addresses = NIL;
if (!have_createrole_privilege())
ereport(ERROR,
(errcode(ERRCODE_INSUFFICIENT_PRIVILEGE),
errmsg("permission denied to drop role")));
Granted, no one will see the admin option error unless they at least have
createrole, so we could leave it out, but my intent was to list the full
set of privileges required to drop the role to avoid ambiguity.
--
Nathan Bossart
Amazon Web Services: https://aws.amazon.com