puppetlabs / puppetlabs/puppetlabs-postgresql
grant on databases with only identity sequences never runs
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 232
- Forks
- 610
- Avg merge
- 5d 23h
- Merged PRs (30d)
- 4
Description
hi,
I'm not a postgres expert, but I think I found an issue with the unless check for grants with ALL SEQUENCES IN SCHEMA.
Describe the Bug
I wanted to have otherwise unprivileged user that can dump a database:
postgresql::server::database_grant { "GRANT ${u} - CONNECT - ${d}":
privilege => 'CONNECT',
db => $d,
role => $u
}
postgresql::server::grant{ "GRANT ${u} - SELECT - all tables ${d}":
object_type => 'ALL TABLES IN SCHEMA',
object_name => 'public',
privilege => 'SELECT',
db => $d,
role => $u
}
postgresql::server::grant{ "GRANT ${u} - SELECT - all sequences ${d}":
object_type => 'ALL SEQUENCES IN SCHEMA',
object_name => 'public',
privilege => 'SELECT',
db => $d,
role => $u
}
This worked on one server, but would fail on others with a permission denied on a sequence.
While debugging the puppet run, I found the unless clause and discovered that it is using information_schema.sequences. This is a view that excludes pg_depend.deptype = 'i'::"char". This leads to the grant query never running if the database is only using identity sequences.
Expected Behavior
I would expect the postgresql::server::grant runs and grants the select permission on the sequence.
Steps to Reproduce
Puppet code from above with a database that has a table with something like id INT GENERATED ALWAYS AS IDENTITY.
Environment
- postgres 15
- puppetlabs-postgresql 9.1.1
- openvox 8.14.0
- Debian 11
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the implementation of postgresql::server::grant and inspect the unless query that uses information_schema.sequences. Reproduce the case with a PostgreSQL 15 database containing an identity sequence, then verify that the ALL SEQUENCES IN SCHEMA grant runs and grants SELECT as expected.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- postgresql
- Domain
- databases
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100