From 9910860770045cf8ee365cfeaaa90561f5b1e43f Mon Sep 17 00:00:00 2001 From: Fujii Masao Date: Wed, 24 Jun 2026 08:14:36 +0900 Subject: [PATCH v1] Add hints for sequence sync permission warnings --- doc/src/sgml/logical-replication.sgml | 12 ++++++++---- src/backend/replication/logical/sequencesync.c | 7 +++++-- 2 files changed, 13 insertions(+), 6 deletions(-) diff --git a/doc/src/sgml/logical-replication.sgml b/doc/src/sgml/logical-replication.sgml index 9e7868487de..f0c25a75460 100644 --- a/doc/src/sgml/logical-replication.sgml +++ b/doc/src/sgml/logical-replication.sgml @@ -2542,9 +2542,10 @@ CONTEXT: processing remote data for replication origin "pg_16395" during "INSER - In order to be able to copy the initial table or sequence data, the role - used for the replication connection must have the SELECT - privilege on a published table or sequence (or be a superuser). + In order to be able to copy the initial table data or synchronize + sequences, the role used for the replication connection must have the + SELECT privilege on a published table or sequence (or be + a superuser). @@ -2602,7 +2603,10 @@ CONTEXT: processing remote data for replication origin "pg_16395" during "INSER needs privileges to SELECT, INSERT, UPDATE, and DELETE from the target table, and does not need privileges to SET ROLE - to the table owner. However, this also means that any user who owns + to the table owner. When synchronizing sequences, the subscription owner + similarly needs UPDATE privilege on the target sequence + and does not need privileges to SET ROLE to the sequence + owner. However, this also means that any user who owns a table into which replication is happening can execute arbitrary code with the privileges of the subscription owner. For example, they could do this by simply attaching a trigger to one of the tables which they own. diff --git a/src/backend/replication/logical/sequencesync.c b/src/backend/replication/logical/sequencesync.c index f47f962c7db..7910d610c60 100644 --- a/src/backend/replication/logical/sequencesync.c +++ b/src/backend/replication/logical/sequencesync.c @@ -206,7 +206,9 @@ report_sequence_errors(List *mismatched_seqs_idx, errmsg_plural("insufficient privileges on subscriber sequence (%s)", "insufficient privileges on subscriber sequences (%s)", list_length(sub_insuffperm_seqs_idx), - seqstr.data)); + seqstr.data), + MySubscription->runasowner ? + errhint("Grant UPDATE on the sequence to the subscription owner on the subscriber.") : 0); } if (pub_insuffperm_seqs_idx) @@ -217,7 +219,8 @@ report_sequence_errors(List *mismatched_seqs_idx, errmsg_plural("insufficient privileges on publisher sequence (%s)", "insufficient privileges on publisher sequences (%s)", list_length(pub_insuffperm_seqs_idx), - seqstr.data)); + seqstr.data), + errhint("Grant SELECT on the sequence to the role used for the replication connection on the publisher.")); } if (missing_seqs_idx) -- 2.53.0