Fix pg_dump of grouped large object ACLs granted by a non-owner

From: Baji Shaik <baji(dot)pgdev(at)gmail(dot)com>
To: PostgreSQL-development <pgsql-hackers(at)lists(dot)postgresql(dot)org>
Cc: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Subject: Fix pg_dump of grouped large object ACLs granted by a non-owner
Date: 2026-11-05 23:52:12
Message-ID: CA+fm-RPHE4-r8r=ruBadcbMAuafEce+v7ouh4-A86KJ6=gqkpA@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Hi,

I noticed that pg_dump fails an assertion in IssueACLPerBlob() when
large objects that pg_dump groups together have grants made by a role
other than the owner. Non-assert builds instead write commands like
"SET SESSION AUTHORIZATION bob16385(null);", so the restore fails.

CREATE ROLE bob;
SELECT lo_create(16385), lo_create(16386);
GRANT SELECT ON LARGE OBJECT 16385, 16386 TO bob WITH GRANT OPTION;
SET ROLE bob;
GRANT SELECT ON LARGE OBJECT 16385, 16386 TO PUBLIC;
RESET ROLE;
-- then pg_dump the database

IssueACLPerBlob() expects every ACL command to name a large object,
but the SET/RESET SESSION AUTHORIZATION commands around the grantor's
GRANTs don't. The attached patch emits those commands once, unchanged,
and adds a test. This came with a45c78e3284, so it affects 17 and later.

Thoughts?

Thanks,
Baji Shaik

Attachment Content-Type Size
0001-Fix-pg_dump-of-grouped-large-object-ACLs-granted-by-.patch application/octet-stream 2.9 KB

Browse pgsql-hackers by date

  From Date Subject
Next Message Richard Guo 2026-11-06 01:11:16 Re: ERROR: too late to create a new PlaceHolderInfo
Previous Message Zsolt Parragi 2026-11-05 23:20:32 BGWORKER_INTERRUPTIBLE workers are never restarted after DROP/ALTER/CREATE DATABASE