saltstack / saltstack/salt

[Bug]: postgres_privileges.present with object_name `ALL` is never idempotent

Open
#70,291 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

What happened?

postgres_privileges.present accepts object_name: ALL for tables and sequences and correctly generates GRANT ... ON ALL TABLES/SEQUENCES IN SCHEMA.

However, has_privileges() passes "ALL" to privileges_list(). _make_privileges_list_query() then searches for relname = 'ALL', so the existing grants are never found. Consequently, every subsequent state run reports a change and executes the grant again.
Reproduction:

reader-all-tables:
  postgres_privileges.present:
    - name: reader
    - object_type: table
    - object_name: ALL
    - privileges:
      - SELECT
    - prepend: public
    - maintenance_db: application

Expected: the second run is clean.

Actual: every run reports SELECT as granted again.

This affects Salt 3006 and remains present in the current master/3009 implementation.

This may root back to https://github.com/saltstack/salt/issues/36279

Type of salt install

Official rpm

Major version

3006.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

oraclelinux-8

salt --versions-report output
Salt Version:
               Salt: 3006.27

Python Version:
             Python: 3.11.15 (main, Jun 29 2026, 22:21:49) [GCC 11.2.0]

Dependency Versions:
               cffi: 2.0.0
           cherrypy: 18.10.0
       cryptography: 47.0.0
           dateutil: 2.9.0.post0
          docker-py: 7.2.0
              gitdb: 4.0.12
          gitpython: 3.1.50
             Jinja2: 3.1.6
            libgit2: Not Installed
       looseversion: 1.3.0
           M2Crypto: Not Installed
               Mako: Not Installed
            msgpack: 1.1.2
       msgpack-pure: Not Installed
       mysql-python: Not Installed
          packaging: 24.0
          pycparser: 3.00
           pycrypto: Not Installed
       pycryptodome: 3.23.0
             pygit2: Not Installed
       python-gnupg: 0.5.6
             PyYAML: 6.0.3
              PyZMQ: 27.1.0
             relenv: 0.22.16
              smmap: 5.0.2
            timelib: 0.3.0
            Tornado: 6.5.5
                ZMQ: 4.3.5

Salt Extensions:
 saltext.prometheus: 2.2.0
      saltext.vault: 1.8.0

System Versions:
               dist: oracle 8.10
             locale: utf-8
            machine: x86_64
            release: 4.18.0-553.162.1.el8_10.x86_64
             system: Linux
            version: Oracle Linux Server 8.10

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the postgres_privileges.present entry point and trace has_privileges(), privileges_list(), and _make_privileges_list_query() for object_name ALL. Reproduce the Salt state twice against PostgreSQL and inspect the generated privilege lookup. Done means the second run detects the existing grant and regression coverage verifies idempotence for tables and sequences.

Written by the indexing model from the issue text.

Assessment

Tech stack
postgresql, python
Domain
databases
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.