Hi Chao
On 09/05/2026 04:01, Chao Li wrote:
Álvaro seems to bring the question to a deeper level, and I feel that might be
worth a dedicated discussion. For example, I am not sure ACL_CREATE on the
tablespace is enough to imply visibility of the tablespace DDL. My
understanding is that CREATE on a tablespace allows the user to create objects
within that tablespace, but it does not necessarily mean the user is allowed to
inspect the definition of the tablespace itself.
Yeah, this is a good point. I don't have a strong opinion about it, but
I'd be inclined to simply deny access to the DDL if the user does not
have enough privileges -- at least I wouldn't mind seeing an error
message in my logs :)
How about keeping the scope of this patch narrow, as only adding a hint to
guide users on how to fix the error if they really need to view the DDL of the
tablespace? I will start a separate thread for the discussion of the
access-checking model.
The attached v2 keeps the original error message and adds a hint. I took Jim’s
comment about avoiding hardcoding "pg_tablespace”. And I also added a hint in
pg_get_role_ddl_internal. With v2, the messages are like:
```
evantest=> select * from pg_get_tablespace_ddl('ts1');
ERROR: permission denied for tablespace "ts1"
HINT: Grant SELECT on catalog "pg_tablespace" to read tablespace properties.
I'm not sure that telling unprivileged users to grant themselves access
to pg_tablespace is an improvement -- IMO, a HINT here is supposed to be
actionable. Perhaps a DETAIL would be a better fit, e.g. "DETAIL: The
function requires SELECT privilege on catalog "pg_tablespace"."
On top of that, I'm also not sure that replacing the aclcheck_error with
an ereport just for the hint/detail is an option, since aclcheck_error
is supposed to provide "Standardized reporting of aclcheck permissions
failures." (from the aclcheck_error header comment)
Thanks!
Best, Jim
