Revoke role membership does not remove cascade privileges

From: Virender Singla <virender(dot)cse(at)gmail(dot)com>
To: pgsql-bugs(at)lists(dot)postgresql(dot)org
Cc: Aniket Jha <aniketkumarj(at)gmail(dot)com>
Subject: Revoke role membership does not remove cascade privileges
Date: 2025-10-01 09:32:21
Message-ID: CAM6Zo8wD7RtQNhbQHODc9DobiW+GpT=tnqOSMz4+mnzA9m0zMg@mail.gmail.com
Views: Whole Thread | Raw Message | Download mbox | Resend email
Thread:
Lists: pgsql-bugs

We encountered an upgrade failure due to error:
"ERROR: grant options cannot be granted back to your own grantor"

The failure scenario is reproducible in Postgres v16/v17 (may be before
that as well). The root cause of this failure is that revoking a role
membership does not consequently revoke associated cascade privileges.

Steps to Reproduce:

/* Create two users: "user1" and "user2" */

/* Login "user1" */

create database db1;

GRANT ALL ON DATABASE db1 TO user2 WITH GRANT OPTION;

/* Login "user2", gets error due to obvious reason */

GRANT ALL ON DATABASE db1 TO user2 WITH GRANT OPTION;
ERROR: grant options cannot be granted back to your own grantor

/* Login "user1" */

grant user1 to user2;

/* Login "user2" */

GRANT ALL ON DATABASE db1 TO user2 WITH GRANT OPTION;

/* Login "user2" */

select datacl from pg_database where datname='db1';
datacl
-------------------------------------------------------------------
{=Tc/user1,user1=CTc/user1,user2=C*T*c*/user1,user2=C*T*c*/user2}

/* Now revoke role membership but it does not update ACL in pg_database */

revoke user2 from user1;

/* ACL "user2=C*T*c*/user2" still remains in the catalog causing upgrade
failure during pg_restore */

select datacl from pg_database where datname='db1';
datacl
-------------------------------------------------------------------
{=Tc/user1,user1=CTc/user1,user2=C*T*c*/user1,user2=C*T*c*/user2}

This causes upgrade failure as during pg_restore, "user2" tries to grant
permission to itself without any role membership of "user1".
A side effect of this behaviour is that, now even if
"user1" revokes the grant permission from "use2", "user2" can still
grant the permission to others.

Thanks,
Virender

Browse pgsql-bugs by date

  From Date Subject
Next Message Erki Eessaar 2025-10-01 09:34:01 Re: Potential bug: Enforcing/not enforcing a CHECK constraint fails on an empty table
Previous Message David Rowley 2025-10-01 05:24:52 Re: Potential bug: Enforcing/not enforcing a CHECK constraint fails on an empty table