From 6ab463391006f871fcd111d744e09f1030b10e2c Mon Sep 17 00:00:00 2001
From: Mark Dilger <mark.dilger@enterprisedb.com>
Date: Wed, 20 Oct 2021 07:50:10 -0700
Subject: [PATCH v1 06/12] Adding role pg_manage_replication_settings

This new role can SET and ALTER SYSTEM SET any GUC variable which
controls replication behavior or resource usage.
---
 doc/src/sgml/user-manag.sgml            |  9 ++-
 src/backend/utils/misc/guc.c            | 48 +++++++-------
 src/include/catalog/pg_authid.dat       |  5 ++
 src/include/utils/guc.h                 |  1 +
 src/test/regress/expected/guc_privs.out | 85 +++++++++++++++++++++++++
 src/test/regress/sql/guc_privs.sql      | 55 ++++++++++++++++
 6 files changed, 179 insertions(+), 24 deletions(-)

diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml
index 75e2dda5d2..ed586cc260 100644
--- a/doc/src/sgml/user-manag.sgml
+++ b/doc/src/sgml/user-manag.sgml
@@ -598,6 +598,10 @@ DROP ROLE doomed_role;
        <entry>pg_manage_logging_settings</entry>
        <entry>Allow changing settings which control logging behavior.</entry>
       </row>
+      <row>
+       <entry>pg_manage_replication_settings</entry>
+       <entry>Allow changing settings which control replication behavior.</entry>
+      </row>
      </tbody>
     </tgroup>
    </table>
@@ -645,8 +649,9 @@ DROP ROLE doomed_role;
   <para>
   The <literal>pg_manage_host_resource_settings</literal>,
   <literal>pg_manage_vacuum_settings</literal>,
-  <literal>pg_manage_autovacuum_settings</literal> and
-  <literal>pg_manage_logging_settings</literal> roles are intended to allow
+  <literal>pg_manage_autovacuum_settings</literal>,
+  <literal>pg_manage_logging_settings</literal> and
+  <literal>pg_manage_replication_settings</literal> roles are intended to allow
   administrators to have trusted, but non-superuser, roles to configure the
   server.
   </para>
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 409d68943a..e40445f06a 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -1229,7 +1229,7 @@ static struct config_bool ConfigureNamesBool[] =
 		{"track_commit_timestamp", PGC_POSTMASTER, REPLICATION_SENDING,
 			gettext_noop("Collects transaction commit time."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&track_commit_timestamp,
 		false,
@@ -1998,7 +1998,7 @@ static struct config_bool ConfigureNamesBool[] =
 		{"hot_standby", PGC_POSTMASTER, REPLICATION_STANDBY,
 			gettext_noop("Allows connections and queries during recovery."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&EnableHotStandby,
 		true,
@@ -2009,7 +2009,7 @@ static struct config_bool ConfigureNamesBool[] =
 		{"hot_standby_feedback", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Allows feedback from a hot standby to the primary that will avoid query conflicts."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&hot_standby_feedback,
 		false,
@@ -2221,7 +2221,7 @@ static struct config_bool ConfigureNamesBool[] =
 		{"wal_receiver_create_temp_slot", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Sets whether a WAL receiver should create a temporary replication slot if no permanent slot is configured."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&wal_receiver_create_temp_slot,
 		false,
@@ -2361,7 +2361,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_standby_archive_delay", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Sets the maximum delay before canceling queries when a hot standby server is processing archived WAL data."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_MS
 		},
 		&max_standby_archive_delay,
@@ -2373,7 +2373,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_standby_streaming_delay", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Sets the maximum delay before canceling queries when a hot standby server is processing streamed WAL data."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_MS
 		},
 		&max_standby_streaming_delay,
@@ -2385,7 +2385,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"recovery_min_apply_delay", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Sets the minimum delay for applying changes during recovery."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_MS
 		},
 		&recovery_min_apply_delay,
@@ -2397,7 +2397,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"wal_receiver_status_interval", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Sets the maximum interval between WAL receiver status reports to the sending server."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_S
 		},
 		&wal_receiver_status_interval,
@@ -2409,7 +2409,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"wal_receiver_timeout", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Sets the maximum wait time to receive data from the sending server."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_MS
 		},
 		&wal_receiver_timeout,
@@ -2831,7 +2831,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"vacuum_defer_cleanup_age", PGC_SIGHUP, REPLICATION_PRIMARY,
 			gettext_noop("Number of transactions by which VACUUM and HOT cleanup should be deferred, if any."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&vacuum_defer_cleanup_age,
 		0, 0, 1000000,			/* see ComputeXidHorizons */
@@ -2940,7 +2940,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"wal_keep_size", PGC_SIGHUP, REPLICATION_SENDING,
 			gettext_noop("Sets the size of WAL files held for standby servers."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_MB
 		},
 		&wal_keep_size_mb,
@@ -3065,7 +3065,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_wal_senders", PGC_POSTMASTER, REPLICATION_SENDING,
 			gettext_noop("Sets the maximum number of simultaneously running WAL sender processes."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&max_wal_senders,
 		10, 0, MAX_BACKENDS,
@@ -3077,7 +3077,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"max_replication_slots", PGC_POSTMASTER, REPLICATION_SENDING,
 			gettext_noop("Sets the maximum number of simultaneously defined replication slots."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&max_replication_slots,
 		10, 0, MAX_BACKENDS /* XXX? */ ,
@@ -3090,7 +3090,7 @@ static struct config_int ConfigureNamesInt[] =
 			gettext_noop("Replication slots will be marked as failed, and segments released "
 						 "for deletion or recycling, if this much space is occupied by WAL "
 						 "on disk."),
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_MB
 		},
 		&max_slot_wal_keep_size_mb,
@@ -3102,7 +3102,7 @@ static struct config_int ConfigureNamesInt[] =
 		{"wal_sender_timeout", PGC_USERSET, REPLICATION_SENDING,
 			gettext_noop("Sets the maximum time to wait for WAL replication."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_MS
 		},
 		&wal_sender_timeout,
@@ -3317,7 +3317,7 @@ static struct config_int ConfigureNamesInt[] =
 			REPLICATION_SUBSCRIBERS,
 			gettext_noop("Maximum number of logical replication worker processes."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&max_logical_replication_workers,
 		4, 0, MAX_BACKENDS,
@@ -3330,7 +3330,7 @@ static struct config_int ConfigureNamesInt[] =
 			REPLICATION_SUBSCRIBERS,
 			gettext_noop("Maximum number of table synchronization workers per subscription."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&max_sync_workers_per_subscription,
 		2, 0, MAX_BACKENDS,
@@ -3438,7 +3438,7 @@ static struct config_int ConfigureNamesInt[] =
 			gettext_noop("Sets the time to wait before retrying to retrieve WAL "
 						 "after a failed attempt."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_UNIT_MS
 		},
 		&wal_retrieve_retry_interval,
@@ -4218,7 +4218,7 @@ static struct config_string ConfigureNamesString[] =
 		{"promote_trigger_file", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Specifies a file name whose presence ends recovery in the standby."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&PromoteTriggerFile,
 		"",
@@ -4229,7 +4229,7 @@ static struct config_string ConfigureNamesString[] =
 		{"primary_conninfo", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Sets the connection string to be used to connect to the sending server."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&PrimaryConnInfo,
 		"",
@@ -4240,7 +4240,7 @@ static struct config_string ConfigureNamesString[] =
 		{"primary_slot_name", PGC_SIGHUP, REPLICATION_STANDBY,
 			gettext_noop("Sets the name of the replication slot to use on the sending server."),
 			NULL,
-			GUC_SUPERUSER_ONLY
+			GUC_MANAGE_REPLICATION_SETTINGS
 		},
 		&PrimarySlotName,
 		"",
@@ -4804,7 +4804,7 @@ static struct config_string ConfigureNamesString[] =
 		{"synchronous_standby_names", PGC_SIGHUP, REPLICATION_PRIMARY,
 			gettext_noop("Number of synchronous standbys and list of names of potential synchronous ones."),
 			NULL,
-			GUC_SUPERUSER_ONLY,
+			GUC_MANAGE_REPLICATION_SETTINGS,
 			GUC_LIST_INPUT
 		},
 		&SyncRepStandbyNames,
@@ -7647,6 +7647,10 @@ role_has_privileges(Oid roleid, int privileges)
 		! has_privs_of_role(roleid, ROLE_PG_WRITE_SERVER_FILES))
 		return false;
 
+	if ((privileges & GUC_MANAGE_REPLICATION_SETTINGS) &&
+		! has_privs_of_role(roleid, ROLE_PG_MANAGE_REPLICATION_SETTINGS))
+		return false;
+
 	return true;
 }
 
diff --git a/src/include/catalog/pg_authid.dat b/src/include/catalog/pg_authid.dat
index 41d119f7b2..b36c81bf95 100644
--- a/src/include/catalog/pg_authid.dat
+++ b/src/include/catalog/pg_authid.dat
@@ -99,5 +99,10 @@
   rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f',
   rolreplication => 'f', rolbypassrls => 't', rolconnlimit => '-1',
   rolpassword => '_null_', rolvaliduntil => '_null_' },
+{ oid => '9283', oid_symbol => 'ROLE_PG_MANAGE_REPLICATION_SETTINGS',
+  rolname => 'pg_manage_replication_settings', rolsuper => 'f', rolinherit => 't',
+  rolcreaterole => 'f', rolcreatedb => 'f', rolcanlogin => 'f',
+  rolreplication => 'f', rolbypassrls => 't', rolconnlimit => '-1',
+  rolpassword => '_null_', rolvaliduntil => '_null_' },
 
 ]
diff --git a/src/include/utils/guc.h b/src/include/utils/guc.h
index 94d0b3c19d..ad75ac1e97 100644
--- a/src/include/utils/guc.h
+++ b/src/include/utils/guc.h
@@ -206,6 +206,7 @@ typedef enum
 #define GUC_MANAGE_AUTOVACUUM_SETTINGS		0x0004
 #define GUC_MANAGE_LOGGING_SETTINGS			0x0008
 #define GUC_WRITE_SERVER_FILES				0x0010
+#define GUC_MANAGE_REPLICATION_SETTINGS		0x0020
 
 /*
  * bit values in "flags" of a GUC variable
diff --git a/src/test/regress/expected/guc_privs.out b/src/test/regress/expected/guc_privs.out
index 443c0237bd..82dcdb7133 100644
--- a/src/test/regress/expected/guc_privs.out
+++ b/src/test/regress/expected/guc_privs.out
@@ -496,3 +496,88 @@ ERROR:  parameter "ssl_renegotiation_limit" cannot be changed
 RESET statement_timeout;
 RESET SESSION AUTHORIZATION;
 DROP ROLE regress_log_full_admin;
+-- Test role pg_manage_replication_settings
+-- Non-superuser with privileges to configure replication settings
+CREATE ROLE regress_replication_admin NOSUPERUSER;
+GRANT pg_manage_replication_settings TO regress_replication_admin;
+-- Perform all operations as user 'regress_replication_admin' --
+SET SESSION AUTHORIZATION regress_replication_admin;
+-- PGC_BACKEND
+SET ignore_system_indexes = OFF;  -- fail, cannot be set after connection start
+ERROR:  parameter "ignore_system_indexes" cannot be set after connection start
+RESET ignore_system_indexes;  -- fail, cannot be set after connection start
+ERROR:  parameter "ignore_system_indexes" cannot be set after connection start
+ALTER SYSTEM SET ignore_system_indexes = OFF;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "ignore_system_indexes"
+ALTER SYSTEM RESET ignore_system_indexes;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "ignore_system_indexes"
+-- PGC_INTERNAL
+SET block_size = 50;  -- fail, cannot be changed
+ERROR:  parameter "block_size" cannot be changed
+RESET block_size;  -- fail, cannot be changed
+ERROR:  parameter "block_size" cannot be changed
+ALTER SYSTEM SET block_size = 50;  -- fail, cannot be changed
+ERROR:  parameter "block_size" cannot be changed
+ALTER SYSTEM RESET block_size;  -- fail, cannot be changed
+ERROR:  parameter "block_size" cannot be changed
+-- PGC_POSTMASTER
+SET autovacuum_freeze_max_age = 1000050000;  -- fail, requires restart
+ERROR:  parameter "autovacuum_freeze_max_age" cannot be changed without restarting the server
+RESET autovacuum_freeze_max_age;  -- fail, requires restart
+ERROR:  parameter "autovacuum_freeze_max_age" cannot be changed without restarting the server
+ALTER SYSTEM SET autovacuum_freeze_max_age = 1000050000;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "autovacuum_freeze_max_age"
+ALTER SYSTEM RESET autovacuum_freeze_max_age;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "autovacuum_freeze_max_age"
+ALTER SYSTEM SET config_file = '/usr/local/data/postgresql.conf';  -- fail, cannot be changed
+ERROR:  parameter "config_file" cannot be changed
+ALTER SYSTEM RESET config_file;  -- fail, cannot be changed
+ERROR:  parameter "config_file" cannot be changed
+ALTER SYSTEM SET max_replication_slots = 50;  -- ok
+ALTER SYSTEM RESET max_replication_slots;  -- ok
+-- PGC_SIGHUP
+SET autovacuum = OFF;  -- fail, requires reload
+ERROR:  parameter "autovacuum" cannot be changed now
+RESET autovacuum;  -- fail, requires reload
+ERROR:  parameter "autovacuum" cannot be changed now
+ALTER SYSTEM SET autovacuum = OFF;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "autovacuum"
+ALTER SYSTEM RESET autovacuum;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "autovacuum"
+ALTER SYSTEM SET synchronous_standby_names = 'fee, fi, fo, fum';  -- ok
+ALTER SYSTEM RESET synchronous_standby_names;  -- ok
+-- PGC_SUSET
+SET lc_messages = 'en_US.UTF-8';  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "lc_messages"
+RESET lc_messages;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "lc_messages"
+ALTER SYSTEM SET lc_messages = 'en_US.UTF-8';  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "lc_messages"
+ALTER SYSTEM RESET lc_messages;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "lc_messages"
+-- PGC_SU_BACKEND
+SET jit_debugging_support = OFF;  -- fail, cannot be set after connection start
+ERROR:  parameter "jit_debugging_support" cannot be set after connection start
+RESET jit_debugging_support;  -- fail, cannot be set after connection start
+ERROR:  parameter "jit_debugging_support" cannot be set after connection start
+ALTER SYSTEM SET jit_debugging_support = OFF;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "jit_debugging_support"
+ALTER SYSTEM RESET jit_debugging_support;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "jit_debugging_support"
+-- PGC_USERSET
+SET DateStyle = 'ISO, MDY';  -- ok
+RESET DateStyle;  -- ok
+ALTER SYSTEM SET DateStyle = 'ISO, MDY';  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "datestyle"
+ALTER SYSTEM RESET DateStyle;  -- fail, regress_replication_admin has insufficient privileges
+ERROR:  permission denied to set parameter "datestyle"
+ALTER SYSTEM SET ssl_renegotiation_limit = 0;  -- fail, cannot be changed
+ERROR:  parameter "ssl_renegotiation_limit" cannot be changed
+ALTER SYSTEM RESET ssl_renegotiation_limit;  -- fail, cannot be changed
+ERROR:  parameter "ssl_renegotiation_limit" cannot be changed
+ALTER SYSTEM SET wal_sender_timeout = 50;  -- ok
+ALTER SYSTEM RESET wal_sender_timeout;  -- ok
+-- Finished testing role pg_manage_replication_settings
+RESET statement_timeout;
+RESET SESSION AUTHORIZATION;
+DROP ROLE regress_replication_admin;
diff --git a/src/test/regress/sql/guc_privs.sql b/src/test/regress/sql/guc_privs.sql
index 767c5ecc46..3b652fea2d 100644
--- a/src/test/regress/sql/guc_privs.sql
+++ b/src/test/regress/sql/guc_privs.sql
@@ -330,3 +330,58 @@ ALTER SYSTEM RESET ssl_renegotiation_limit;  -- fail, cannot be changed
 RESET statement_timeout;
 RESET SESSION AUTHORIZATION;
 DROP ROLE regress_log_full_admin;
+-- Test role pg_manage_replication_settings
+-- Non-superuser with privileges to configure replication settings
+CREATE ROLE regress_replication_admin NOSUPERUSER;
+GRANT pg_manage_replication_settings TO regress_replication_admin;
+-- Perform all operations as user 'regress_replication_admin' --
+SET SESSION AUTHORIZATION regress_replication_admin;
+-- PGC_BACKEND
+SET ignore_system_indexes = OFF;  -- fail, cannot be set after connection start
+RESET ignore_system_indexes;  -- fail, cannot be set after connection start
+ALTER SYSTEM SET ignore_system_indexes = OFF;  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM RESET ignore_system_indexes;  -- fail, regress_replication_admin has insufficient privileges
+-- PGC_INTERNAL
+SET block_size = 50;  -- fail, cannot be changed
+RESET block_size;  -- fail, cannot be changed
+ALTER SYSTEM SET block_size = 50;  -- fail, cannot be changed
+ALTER SYSTEM RESET block_size;  -- fail, cannot be changed
+-- PGC_POSTMASTER
+SET autovacuum_freeze_max_age = 1000050000;  -- fail, requires restart
+RESET autovacuum_freeze_max_age;  -- fail, requires restart
+ALTER SYSTEM SET autovacuum_freeze_max_age = 1000050000;  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM RESET autovacuum_freeze_max_age;  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM SET config_file = '/usr/local/data/postgresql.conf';  -- fail, cannot be changed
+ALTER SYSTEM RESET config_file;  -- fail, cannot be changed
+ALTER SYSTEM SET max_replication_slots = 50;  -- ok
+ALTER SYSTEM RESET max_replication_slots;  -- ok
+-- PGC_SIGHUP
+SET autovacuum = OFF;  -- fail, requires reload
+RESET autovacuum;  -- fail, requires reload
+ALTER SYSTEM SET autovacuum = OFF;  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM RESET autovacuum;  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM SET synchronous_standby_names = 'fee, fi, fo, fum';  -- ok
+ALTER SYSTEM RESET synchronous_standby_names;  -- ok
+-- PGC_SUSET
+SET lc_messages = 'en_US.UTF-8';  -- fail, regress_replication_admin has insufficient privileges
+RESET lc_messages;  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM SET lc_messages = 'en_US.UTF-8';  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM RESET lc_messages;  -- fail, regress_replication_admin has insufficient privileges
+-- PGC_SU_BACKEND
+SET jit_debugging_support = OFF;  -- fail, cannot be set after connection start
+RESET jit_debugging_support;  -- fail, cannot be set after connection start
+ALTER SYSTEM SET jit_debugging_support = OFF;  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM RESET jit_debugging_support;  -- fail, regress_replication_admin has insufficient privileges
+-- PGC_USERSET
+SET DateStyle = 'ISO, MDY';  -- ok
+RESET DateStyle;  -- ok
+ALTER SYSTEM SET DateStyle = 'ISO, MDY';  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM RESET DateStyle;  -- fail, regress_replication_admin has insufficient privileges
+ALTER SYSTEM SET ssl_renegotiation_limit = 0;  -- fail, cannot be changed
+ALTER SYSTEM RESET ssl_renegotiation_limit;  -- fail, cannot be changed
+ALTER SYSTEM SET wal_sender_timeout = 50;  -- ok
+ALTER SYSTEM RESET wal_sender_timeout;  -- ok
+-- Finished testing role pg_manage_replication_settings
+RESET statement_timeout;
+RESET SESSION AUTHORIZATION;
+DROP ROLE regress_replication_admin;
-- 
2.21.1 (Apple Git-122.3)

