Skip to content

skip and warn about role mismatch in Maintenance Functions #806

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: development
Choose a base branch
from
Open

skip and warn about role mismatch in Maintenance Functions #806

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d8474d4
skip and warn about role mismatch in run_maintenance
jw1u1 Sep 10, 2025
4361087
skip and warn about role mismatch in partition_data_time and partitio…
jw1u1 Sep 12, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 13 additions & 0 deletions sql/functions/partition_data_id.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ v_max_partition_id bigint;
v_min_partition_id bigint;
v_parent_schema text;
v_parent_tablename text;
v_parent_owner text;
v_partition_interval bigint;
v_partition_id bigint[];
v_rowcount bigint;
Expand Down Expand Up @@ -69,6 +70,18 @@ IF v_control_type <> 'id' OR (v_control_type = 'id' AND v_epoch <> 'none') THEN
RAISE EXCEPTION 'Control column for given partition set is not id/serial based or epoch flag is set for time-based partitioning.';
END IF;

SELECT c.relowner::regrole
INTO v_parent_owner
FROM pg_catalog.pg_class c
JOIN pg_catalog.pg_namespace n ON c.relnamespace = n.oid
WHERE n.nspname = v_parent_schema
AND c.relname = v_parent_tablename;

IF v_parent_owner != current_role THEN
RAISE EXCEPTION 'parent table % owner is % but current role is %', p_parent_table, v_parent_owner, current_role;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So I don't think this is accounting for role inheritance/group membership. It's just looking to see if the name of the owner simply matches the name of the current role. If a role is a member of another role, it's considered an owner of all of the same objects.

Also doesn't account for if a superuser is running it, which should be able to succeed as well.

Copy link
Contributor Author

@jw1u1 jw1u1 Oct 22, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you ever seen a proper setup with different Owner of Partitions?
You'll usually want to have the same owner.
Of course does run_maintenance work as a superuser but the background worker will fail to drop partitions owned by postgres.
And postgres might have not the same default privileges as inheritance/group membership is not taken into account with default privileges.
Would you like to add a new config parameter "ensure_same_partition_owner"?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

pg_partman already has a setting to force ownership/permissions to be passed down from the parent. If you set inherit_privileges to true in part_config it will do this.

I'm not 100% on what ownership PG does by default for partitioned tables, so I'll have to test it out what happens when another role in the same group or the superuser adds a child. But by default, privileges are not inherited to children so users must go through the parent to access the data. Inheriting privileges allows the users of the table to by-pass the read/write penalties of going through the parent if they happen to know what the child table name is.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Owner is the role that executes the maintenance function and that's a mess.
If inherit_privileges=true changes the owner, please make it default.

END IF;


IF p_source_table IS NOT NULL THEN
-- Set source table to user given source table instead of parent table
v_source_schemaname := NULL;
Expand Down
12 changes: 12 additions & 0 deletions sql/functions/partition_data_time.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ v_max_partition_timestamp timestamptz;
v_min_partition_timestamp timestamptz;
v_parent_schema text;
v_parent_tablename text;
v_parent_owner text;
v_partition_expression text;
v_partition_interval interval;
v_partition_suffix text;
Expand Down Expand Up @@ -76,6 +77,17 @@ IF v_control_type <> 'time' THEN
END IF;
END IF;

SELECT c.relowner::regrole
INTO v_parent_owner
FROM pg_catalog.pg_class c
JOIN pg_catalog.pg_namespace n ON c.relnamespace = n.oid
WHERE n.nspname = v_parent_schema
AND c.relname = v_parent_tablename;

IF v_parent_owner != current_role THEN
RAISE EXCEPTION 'parent table % owner is % but current role is %', p_parent_table, v_parent_owner, current_role;
END IF;

-- Replace the parent variables with the source variables if using source table for child table data
IF p_source_table IS NOT NULL THEN
-- Set source table to user given source table instead of parent table
Expand Down
10 changes: 8 additions & 2 deletions sql/functions/run_maintenance.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@ v_parent_exists text;
v_parent_oid oid;
v_parent_schema text;
v_parent_tablename text;
v_parent_owner text;
v_partition_expression text;
v_premade_count int;
v_row record;
Expand Down Expand Up @@ -162,13 +163,18 @@ LOOP
END IF;
END IF;

SELECT n.nspname, c.relname, c.oid
INTO v_parent_schema, v_parent_tablename, v_parent_oid
SELECT n.nspname, c.relname, c.oid, c.relowner::regrole
INTO v_parent_schema, v_parent_tablename, v_parent_oid, v_parent_owner
FROM pg_catalog.pg_class c
JOIN pg_catalog.pg_namespace n ON c.relnamespace = n.oid
WHERE n.nspname = split_part(v_row.parent_table, '.', 1)::name
AND c.relname = split_part(v_row.parent_table, '.', 2)::name;

IF v_parent_owner != current_role THEN
RAISE WARNING 'Child partition creation skipped for parent table % owner is % but current role is %', v_row.parent_table, v_parent_owner, current_role;
CONTINUE;
END IF;

-- Always returns the default partition first if it exists
SELECT partition_tablename INTO v_default_tablename
FROM @[email protected]_partitions(v_row.parent_table, p_include_default := true) LIMIT 1;
Expand Down