From 7f5ec60686edbc3c0555bfa5c743719405321002 Mon Sep 17 00:00:00 2001 From: Matheus Alcantara Date: Thu, 27 Aug 2026 15:07:39 -0300 Subject: [PATCH v3] Let the REPACK decoding worker bypass connection privilege checks REPACK (CONCURRENTLY) launches a background worker to decode the changes made while the table is being rewritten. Since cluster_rel() switches the current user to the owner of the table being repacked, that is the role the worker connects as, and the worker asked for a bypass of the LOGIN check only. The CONNECT privilege on the database was therefore still checked against the table owner, who has no reason to have it, so the command could fail with ERROR: permission denied for database "d" DETAIL: User does not have CONNECT privilege. CONTEXT: REPACK decoding worker Pass BGWORKER_BYPASS_ALLOWCONN as well, as parallel.c already does for parallel workers: the backend that launched the worker is connected to the database already, and the worker only decodes changes on its behalf. Author: Matheus Alcantara Reported-by: Nathan Bossart Discussion: https://www.postgresql.org/message-id/apBbzFd_EYAfHV45@nathan --- src/backend/commands/repack_worker.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/backend/commands/repack_worker.c b/src/backend/commands/repack_worker.c index af7e2a94764..a49b681059f 100644 --- a/src/backend/commands/repack_worker.c +++ b/src/backend/commands/repack_worker.c @@ -101,8 +101,15 @@ RepackWorkerMain(Datum main_arg) pq_set_parallel_leader(shared->backend_pid, shared->backend_proc_number); - /* Connect to the database. LOGIN is not required. */ + /* + * Connect to the database. Like parallel workers do, we skip the + * connection authorization checks. The backend that launched us is + * already connected to this database, and the role we run as is the owner + * of the table being repacked, which needs neither the LOGIN attribute + * nor the CONNECT privilege for our purposes. + */ BackgroundWorkerInitializeConnectionByOid(shared->dbid, shared->roleid, + BGWORKER_BYPASS_ALLOWCONN | BGWORKER_BYPASS_ROLELOGINCHECK); /* -- 2.50.1 (Apple Git-155)