From 61de61cbbc9e618a71d4dd2c35ca362c2f5872d3 Mon Sep 17 00:00:00 2001
From: Mark Dilger <mark.dilger@enterprisedb.com>
Date: Wed, 20 Oct 2021 07:47:53 -0700
Subject: [PATCH v1 02/12] Adding role pg_manage_host_resource_settings

This new role can SET and ALTER SYSTEM SET any GUC variable which
controls server resource usage (memory, disk, cpu, etc.)
---
 doc/src/sgml/user-manag.sgml            | 12 +++-
 src/backend/utils/misc/guc.c            | 50 +++++++-------
 src/include/catalog/pg_authid.dat       |  5 ++
 src/include/utils/guc.h                 |  1 +
 src/test/regress/expected/guc_privs.out | 89 +++++++++++++++++++++++++
 src/test/regress/sql/guc_privs.sql      | 59 ++++++++++++++++
 6 files changed, 190 insertions(+), 26 deletions(-)

diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml
index afbf67c28c..25c97e4e5b 100644
--- a/doc/src/sgml/user-manag.sgml
+++ b/doc/src/sgml/user-manag.sgml
@@ -582,6 +582,10 @@ DROP ROLE doomed_role;
        <entry>Allow executing programs on the database server as the user the database runs as with
        COPY and other functions which allow executing a server-side program.</entry>
       </row>
+      <row>
+       <entry>pg_manage_host_resource_settings</entry>
+       <entry>Allow changing settings which control host resource usage.</entry>
+      </row>
      </tbody>
     </tgroup>
    </table>
@@ -626,10 +630,16 @@ DROP ROLE doomed_role;
   great care should be taken when granting these roles to users.
   </para>
 
+  <para>
+  The <literal>pg_manage_host_resource_settings</literal> role is intended to
+  allow administrators to have a trusted, but non-superuser, role to configure
+  memory, cpu, disk and filehandle usage.
+  </para>
+
   <para>
   Care should be taken when granting these roles to ensure they are only used where
   needed and with the understanding that these roles grant access to privileged
-  information.
+  information or the ability to misconfigure the server.
   </para>
 
   <para>
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 04ce8b9d5e..be3fb60e9e 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -2444,7 +2444,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"min_dynamic_shared_memory", PGC_POSTMASTER, RESOURCES_MEM,
 			gettext_noop("Amount of dynamic shared memory reserved at startup."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_MB
 		},
 		&min_dynamic_shared_memory,
@@ -2460,7 +2460,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"shared_buffers", PGC_POSTMASTER, RESOURCES_MEM,
 			gettext_noop("Sets the number of shared memory buffers used by the server."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_BLOCKS
 		},
 		&NBuffers,
@@ -2496,7 +2496,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"temp_buffers", PGC_USERSET, RESOURCES_MEM,
 			gettext_noop("Sets the maximum number of temporary buffers used by each session."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_BLOCKS | GUC_EXPLAIN
 		},
 		&num_temp_buffers,
@@ -2568,7 +2568,7 @@ static struct config_int ConfigureNamesInt[] =
 			gettext_noop("This much memory can be used by each internal "
 						 "sort operation and hash table before switching to "
 						 "temporary disk files."),
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_KB | GUC_EXPLAIN
 		},
 		&work_mem,
@@ -2580,7 +2580,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"maintenance_work_mem", PGC_USERSET, RESOURCES_MEM,
 			gettext_noop("Sets the maximum memory to be used for maintenance operations."),
 			gettext_noop("This includes operations such as VACUUM and CREATE INDEX."),
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_KB
 		},
 		&maintenance_work_mem,
@@ -2593,7 +2593,7 @@ static struct config_int ConfigureNamesInt[] =
 			gettext_noop("Sets the maximum memory to be used for logical decoding."),
 			gettext_noop("This much memory can be used by each internal "
 						 "reorder buffer before spilling to disk."),
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_KB
 		},
 		&logical_decoding_work_mem,
@@ -2610,7 +2610,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_stack_depth", PGC_SUSET, RESOURCES_MEM,
 			gettext_noop("Sets the maximum stack depth, in kilobytes."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_KB
 		},
 		&max_stack_depth,
@@ -2622,7 +2622,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"temp_file_limit", PGC_SUSET, RESOURCES_DISK,
 			gettext_noop("Limits the total size of all temporary files used by each process."),
 			gettext_noop("-1 means no limit."),
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_KB
 		},
 		&temp_file_limit,
@@ -2689,7 +2689,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_files_per_process", PGC_POSTMASTER, RESOURCES_KERNEL,
 			gettext_noop("Sets the maximum number of simultaneously open files for each server process."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&max_files_per_process,
 		1000, 64, INT_MAX,
@@ -2703,7 +2703,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_prepared_transactions", PGC_POSTMASTER, RESOURCES_MEM,
 			gettext_noop("Sets the maximum number of simultaneously prepared transactions."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&max_prepared_xacts,
 		0, 0, MAX_BACKENDS,
@@ -2867,7 +2867,7 @@ static struct config_int ConfigureNamesInt[] =
 			gettext_noop("The shared lock table is sized on the assumption that "
 						 "at most max_locks_per_transaction * max_connections distinct "
 						 "objects will need to be locked at any one time."),
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&max_locks_per_xact,
 		64, 10, INT_MAX,
@@ -2880,7 +2880,7 @@ static struct config_int ConfigureNamesInt[] =
 			gettext_noop("The shared predicate lock table is sized on the assumption that "
 						 "at most max_pred_locks_per_transaction * max_connections distinct "
 						 "objects will need to be locked at any one time."),
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&max_predicate_locks_per_xact,
 		64, 10, INT_MAX,
@@ -2892,7 +2892,7 @@ static struct config_int ConfigureNamesInt[] =
 			gettext_noop("Sets the maximum number of predicate-locked pages and tuples per relation."),
 			gettext_noop("If more than this total of pages and tuples in the same relation are locked "
 						 "by a connection, those locks are replaced by a relation-level lock."),
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&max_predicate_locks_per_relation,
 		-2, INT_MIN, INT_MAX,
@@ -2904,7 +2904,7 @@ static struct config_int ConfigureNamesInt[] =
 			gettext_noop("Sets the maximum number of predicate-locked tuples per page."),
 			gettext_noop("If more than this number of tuples on the same page are locked "
 						 "by a connection, those locks are replaced by a page-level lock."),
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&max_predicate_locks_per_page,
 		2, 0, INT_MAX,
@@ -3290,7 +3290,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"backend_flush_after", PGC_USERSET, RESOURCES_ASYNCHRONOUS,
 			gettext_noop("Number of pages after which previously performed writes are flushed to disk."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_BLOCKS
 		},
 		&backend_flush_after,
@@ -3304,7 +3304,7 @@ static struct config_int ConfigureNamesInt[] =
 			RESOURCES_ASYNCHRONOUS,
 			gettext_noop("Maximum number of concurrent worker processes."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&max_worker_processes,
 		8, 0, MAX_BACKENDS,
@@ -3544,7 +3544,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_parallel_maintenance_workers", PGC_USERSET, RESOURCES_ASYNCHRONOUS,
 			gettext_noop("Sets the maximum number of parallel processes per maintenance operation."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&max_parallel_maintenance_workers,
 		2, 0, 1024,
@@ -3555,7 +3555,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_parallel_workers_per_gather", PGC_USERSET, RESOURCES_ASYNCHRONOUS,
 			gettext_noop("Sets the maximum number of parallel processes per executor node."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_EXPLAIN
 		},
 		&max_parallel_workers_per_gather,
@@ -3567,7 +3567,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_parallel_workers", PGC_USERSET, RESOURCES_ASYNCHRONOUS,
 			gettext_noop("Sets the maximum number of parallel workers that can be active at one time."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_EXPLAIN
 		},
 		&max_parallel_workers,
@@ -3579,7 +3579,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"autovacuum_work_mem", PGC_SIGHUP, RESOURCES_MEM,
 			gettext_noop("Sets the maximum memory to be used by each autovacuum worker process."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_KB
 		},
 		&autovacuum_work_mem,
@@ -3762,7 +3762,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"huge_page_size", PGC_POSTMASTER, RESOURCES_MEM,
 			gettext_noop("The size of huge page that should be requested."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_UNIT_KB
 		},
 		&huge_page_size,
@@ -3977,7 +3977,7 @@ static struct config_real ConfigureNamesReal[] =
 		{"hash_mem_multiplier", PGC_USERSET, RESOURCES_MEM,
 			gettext_noop("Multiple of work_mem to use for hash tables."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS,
 			GUC_EXPLAIN
 		},
 		&hash_mem_multiplier,
@@ -5208,7 +5208,7 @@ static struct config_enum ConfigureNamesEnum[] =
 		{"dynamic_shared_memory_type", PGC_POSTMASTER, RESOURCES_MEM,
 			gettext_noop("Selects the dynamic shared memory implementation used."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&dynamic_shared_memory_type,
 		DEFAULT_DYNAMIC_SHARED_MEMORY_TYPE, dynamic_shared_memory_options,
@@ -5219,7 +5219,7 @@ static struct config_enum ConfigureNamesEnum[] =
 		{"shared_memory_type", PGC_POSTMASTER, RESOURCES_MEM,
 			gettext_noop("Selects the shared memory implementation used for the main shared memory region."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&shared_memory_type,
 		DEFAULT_SHARED_MEMORY_TYPE, shared_memory_options,
@@ -5264,7 +5264,7 @@ static struct config_enum ConfigureNamesEnum[] =
 		{"huge_pages", PGC_POSTMASTER, RESOURCES_MEM,
 			gettext_noop("Use of huge pages on Linux or Windows."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_HOST_RESOURCE_SETTINGS
 		},
 		&huge_pages,
 		HUGE_PAGES_TRY, huge_pages_options,
diff --git a/src/include/catalog/pg_authid.dat b/src/include/catalog/pg_authid.dat
index 3da68016b6..daf62c2061 100644
--- a/src/include/catalog/pg_authid.dat
+++ b/src/include/catalog/pg_authid.dat
@@ -79,5 +79,10 @@
   rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f',
   rolreplication => 'f', rolbypassrls => 'f', rolconnlimit => '-1',
   rolpassword => '_null_', rolvaliduntil => '_null_' },
+{ oid => '9279', oid_symbol => 'ROLE_PG_MANAGE_HOST_RESOURCE_SETTINGS',
+  rolname => 'pg_manage_host_resource_settings', rolsuper => 'f', rolinherit => 't',
+  rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f',
+  rolreplication => 'f', rolbypassrls => 't', rolconnlimit => '-1',
+  rolpassword => '_null_', rolvaliduntil => '_null_' },
 
 ]
diff --git a/src/include/utils/guc.h b/src/include/utils/guc.h
index 7d2c3e051e..7b0aac2216 100644
--- a/src/include/utils/guc.h
+++ b/src/include/utils/guc.h
@@ -201,6 +201,7 @@ typedef enum
 /*
  * privilege bits required to modify a GUC variable
  */
+#define GUC_MANAGE_HOST_RESOURCE_SETTINGS	0x0001
 
 /*
  * bit values in "flags" of a GUC variable
diff --git a/src/test/regress/expected/guc_privs.out b/src/test/regress/expected/guc_privs.out
index 6dc5ae3148..34a0dcfc0b 100644
--- a/src/test/regress/expected/guc_privs.out
+++ b/src/test/regress/expected/guc_privs.out
@@ -62,3 +62,92 @@ ERROR:  parameter "ssl_renegotiation_limit" cannot be changed
 RESET statement_timeout;
 RESET SESSION AUTHORIZATION;
 DROP ROLE regress_admin;
+-- Test role pg_manage_host_resource_settings
+-- Non-superuser with privileges to configure host resource usage
+CREATE ROLE regress_host_resource_admin NOSUPERUSER;
+GRANT pg_manage_host_resource_settings TO regress_host_resource_admin;
+-- Perform all operations as user 'regress_host_resource_admin' --
+SET SESSION AUTHORIZATION regress_host_resource_admin;
+-- PGC_BACKEND
+SET ignore_system_indexes = OFF;  -- fail, cannot be set after connection start
+ERROR:  parameter "ignore_system_indexes" cannot be set after connection start
+RESET ignore_system_indexes;  -- fail, cannot be set after connection start
+ERROR:  parameter "ignore_system_indexes" cannot be set after connection start
+ALTER SYSTEM SET ignore_system_indexes = OFF;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "ignore_system_indexes"
+ALTER SYSTEM RESET ignore_system_indexes;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "ignore_system_indexes"
+-- PGC_INTERNAL
+SET block_size = 50;  -- fail, cannot be changed
+ERROR:  parameter "block_size" cannot be changed
+RESET block_size;  -- fail, cannot be changed
+ERROR:  parameter "block_size" cannot be changed
+ALTER SYSTEM SET block_size = 50;  -- fail, cannot be changed
+ERROR:  parameter "block_size" cannot be changed
+ALTER SYSTEM RESET block_size;  -- fail, cannot be changed
+ERROR:  parameter "block_size" cannot be changed
+-- PGC_POSTMASTER
+SET autovacuum_freeze_max_age = 1000050000;  -- fail, requires restart
+ERROR:  parameter "autovacuum_freeze_max_age" cannot be changed without restarting the server
+RESET autovacuum_freeze_max_age;  -- fail, requires restart
+ERROR:  parameter "autovacuum_freeze_max_age" cannot be changed without restarting the server
+ALTER SYSTEM SET autovacuum_freeze_max_age = 1000050000;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "autovacuum_freeze_max_age"
+ALTER SYSTEM RESET autovacuum_freeze_max_age;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "autovacuum_freeze_max_age"
+ALTER SYSTEM SET config_file = '/usr/local/data/postgresql.conf';  -- fail, cannot be changed
+ERROR:  parameter "config_file" cannot be changed
+ALTER SYSTEM RESET config_file;  -- fail, cannot be changed
+ERROR:  parameter "config_file" cannot be changed
+ALTER SYSTEM SET max_locks_per_transaction = 50;  -- ok
+ALTER SYSTEM RESET max_locks_per_transaction;  -- ok
+-- PGC_SIGHUP
+SET autovacuum = OFF;  -- fail, requires reload
+ERROR:  parameter "autovacuum" cannot be changed now
+RESET autovacuum;  -- fail, requires reload
+ERROR:  parameter "autovacuum" cannot be changed now
+ALTER SYSTEM SET autovacuum = OFF;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "autovacuum"
+ALTER SYSTEM RESET autovacuum;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "autovacuum"
+ALTER SYSTEM SET max_pred_locks_per_page = 50;  -- ok
+ALTER SYSTEM RESET max_pred_locks_per_page;  -- ok
+-- PGC_SUSET
+SET lc_messages = 'en_US.UTF-8';  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "lc_messages"
+RESET lc_messages;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "lc_messages"
+ALTER SYSTEM SET lc_messages = 'en_US.UTF-8';  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "lc_messages"
+ALTER SYSTEM RESET lc_messages;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "lc_messages"
+SET temp_file_limit = 50;  -- ok
+RESET temp_file_limit;  -- ok
+ALTER SYSTEM SET temp_file_limit = 50;  -- ok
+ALTER SYSTEM RESET temp_file_limit;  -- ok
+-- PGC_SU_BACKEND
+SET jit_debugging_support = OFF;  -- fail, cannot be set after connection start
+ERROR:  parameter "jit_debugging_support" cannot be set after connection start
+RESET jit_debugging_support;  -- fail, cannot be set after connection start
+ERROR:  parameter "jit_debugging_support" cannot be set after connection start
+ALTER SYSTEM SET jit_debugging_support = OFF;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "jit_debugging_support"
+ALTER SYSTEM RESET jit_debugging_support;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "jit_debugging_support"
+-- PGC_USERSET
+SET DateStyle = 'ISO, MDY';  -- ok
+RESET DateStyle;  -- ok
+ALTER SYSTEM SET DateStyle = 'ISO, MDY';  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "datestyle"
+ALTER SYSTEM RESET DateStyle;  -- fail, regress_host_resource_admin has insufficient privileges
+ERROR:  permission denied to set parameter "datestyle"
+ALTER SYSTEM SET ssl_renegotiation_limit = 0;  -- fail, cannot be changed
+ERROR:  parameter "ssl_renegotiation_limit" cannot be changed
+ALTER SYSTEM RESET ssl_renegotiation_limit;  -- fail, cannot be changed
+ERROR:  parameter "ssl_renegotiation_limit" cannot be changed
+ALTER SYSTEM SET backend_flush_after = 128;  -- ok
+ALTER SYSTEM RESET backend_flush_after;  -- ok
+-- Finished testing role pg_manage_host_resource_settings
+RESET statement_timeout;
+RESET SESSION AUTHORIZATION;
+DROP ROLE regress_host_resource_admin;
diff --git a/src/test/regress/sql/guc_privs.sql b/src/test/regress/sql/guc_privs.sql
index a8fafe4fa1..a8a78e61de 100644
--- a/src/test/regress/sql/guc_privs.sql
+++ b/src/test/regress/sql/guc_privs.sql
@@ -46,3 +46,62 @@ ALTER SYSTEM RESET ssl_renegotiation_limit;  -- fail, cannot be changed
 RESET statement_timeout;
 RESET SESSION AUTHORIZATION;
 DROP ROLE regress_admin;
+-- Test role pg_manage_host_resource_settings
+-- Non-superuser with privileges to configure host resource usage
+CREATE ROLE regress_host_resource_admin NOSUPERUSER;
+GRANT pg_manage_host_resource_settings TO regress_host_resource_admin;
+-- Perform all operations as user 'regress_host_resource_admin' --
+SET SESSION AUTHORIZATION regress_host_resource_admin;
+-- PGC_BACKEND
+SET ignore_system_indexes = OFF;  -- fail, cannot be set after connection start
+RESET ignore_system_indexes;  -- fail, cannot be set after connection start
+ALTER SYSTEM SET ignore_system_indexes = OFF;  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM RESET ignore_system_indexes;  -- fail, regress_host_resource_admin has insufficient privileges
+-- PGC_INTERNAL
+SET block_size = 50;  -- fail, cannot be changed
+RESET block_size;  -- fail, cannot be changed
+ALTER SYSTEM SET block_size = 50;  -- fail, cannot be changed
+ALTER SYSTEM RESET block_size;  -- fail, cannot be changed
+-- PGC_POSTMASTER
+SET autovacuum_freeze_max_age = 1000050000;  -- fail, requires restart
+RESET autovacuum_freeze_max_age;  -- fail, requires restart
+ALTER SYSTEM SET autovacuum_freeze_max_age = 1000050000;  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM RESET autovacuum_freeze_max_age;  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM SET config_file = '/usr/local/data/postgresql.conf';  -- fail, cannot be changed
+ALTER SYSTEM RESET config_file;  -- fail, cannot be changed
+ALTER SYSTEM SET max_locks_per_transaction = 50;  -- ok
+ALTER SYSTEM RESET max_locks_per_transaction;  -- ok
+-- PGC_SIGHUP
+SET autovacuum = OFF;  -- fail, requires reload
+RESET autovacuum;  -- fail, requires reload
+ALTER SYSTEM SET autovacuum = OFF;  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM RESET autovacuum;  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM SET max_pred_locks_per_page = 50;  -- ok
+ALTER SYSTEM RESET max_pred_locks_per_page;  -- ok
+-- PGC_SUSET
+SET lc_messages = 'en_US.UTF-8';  -- fail, regress_host_resource_admin has insufficient privileges
+RESET lc_messages;  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM SET lc_messages = 'en_US.UTF-8';  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM RESET lc_messages;  -- fail, regress_host_resource_admin has insufficient privileges
+SET temp_file_limit = 50;  -- ok
+RESET temp_file_limit;  -- ok
+ALTER SYSTEM SET temp_file_limit = 50;  -- ok
+ALTER SYSTEM RESET temp_file_limit;  -- ok
+-- PGC_SU_BACKEND
+SET jit_debugging_support = OFF;  -- fail, cannot be set after connection start
+RESET jit_debugging_support;  -- fail, cannot be set after connection start
+ALTER SYSTEM SET jit_debugging_support = OFF;  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM RESET jit_debugging_support;  -- fail, regress_host_resource_admin has insufficient privileges
+-- PGC_USERSET
+SET DateStyle = 'ISO, MDY';  -- ok
+RESET DateStyle;  -- ok
+ALTER SYSTEM SET DateStyle = 'ISO, MDY';  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM RESET DateStyle;  -- fail, regress_host_resource_admin has insufficient privileges
+ALTER SYSTEM SET ssl_renegotiation_limit = 0;  -- fail, cannot be changed
+ALTER SYSTEM RESET ssl_renegotiation_limit;  -- fail, cannot be changed
+ALTER SYSTEM SET backend_flush_after = 128;  -- ok
+ALTER SYSTEM RESET backend_flush_after;  -- ok
+-- Finished testing role pg_manage_host_resource_settings
+RESET statement_timeout;
+RESET SESSION AUTHORIZATION;
+DROP ROLE regress_host_resource_admin;
-- 
2.21.1 (Apple Git-122.3)

