Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc2122aa

Browse files
Improve privilege documentation for maintenance commands.
The documentation of the required privileges for maintenancecommands (i.e., VACUUM, ANALYZE, CLUSTER, LOCK TABLE, REFRESHMATERIALIZED VIEW, and REINDEX) is redundant, inaccurate, anddifficult to read. This commit fixes and simplifies thisdocumentation by removing references to ownership, superuser, andthe pg_maintain role. In addition, this removes notes aboutdatabase-wide VACUUM and ANALYZE, clarifies matters for REINDEX onpartitioned indexes and tables, and strengthens the description ofthe pg_maintain role.Reviewed-by: Michael Paquier, Jeff DavisDiscussion:https://postgr.es/m/20230615041044.GA736001%40nathanxps13
1 parent4dbdb82 commitc2122aa

File tree

7 files changed

+22
-41
lines changed

7 files changed

+22
-41
lines changed

‎doc/src/sgml/ref/analyze.sgml

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -183,14 +183,8 @@ ANALYZE [ VERBOSE ] [ <replaceable class="parameter">table_and_columns</replacea
183183

184184
<para>
185185
To analyze a table, one must ordinarily have the <literal>MAINTAIN</literal>
186-
privilege on the table or be the table's owner, a superuser, or a role with
187-
privileges of the
188-
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
189-
role. However, database owners are allowed to
186+
privilege on the table. However, database owners are allowed to
190187
analyze all tables in their databases, except shared catalogs.
191-
(The restriction for shared catalogs means that a true database-wide
192-
<command>ANALYZE</command> can only be performed by superusers and roles
193-
with privileges of <literal>pg_maintain</literal>.)
194188
<command>ANALYZE</command> will skip over any tables that the calling user
195189
does not have permission to analyze.
196190
</para>

‎doc/src/sgml/ref/cluster.sgml

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -134,11 +134,7 @@ CLUSTER [VERBOSE]
134134

135135
<para>
136136
To cluster a table, one must have the <literal>MAINTAIN</literal> privilege
137-
on the table or be the table's owner, a superuser, or a role with
138-
privileges of the
139-
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
140-
role. <command>CLUSTER</command> will skip over any
141-
tables that the calling user does not have permission to cluster.
137+
on the table.
142138
</para>
143139

144140
<para>

‎doc/src/sgml/ref/lock.sgml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -166,10 +166,8 @@ LOCK [ TABLE ] [ ONLY ] <replaceable class="parameter">name</replaceable> [ * ]
166166

167167
<para>
168168
To lock a table, the user must have the right privilege for the specified
169-
<replaceable class="parameter">lockmode</replaceable>, or be the table's
170-
owner, a superuser, or a role with privileges of the <link
171-
linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
172-
role. If the user has <literal>MAINTAIN</literal>,
169+
<replaceable class="parameter">lockmode</replaceable>.
170+
If the user has <literal>MAINTAIN</literal>,
173171
<literal>UPDATE</literal>, <literal>DELETE</literal>, or
174172
<literal>TRUNCATE</literal> privileges on the table, any <replaceable
175173
class="parameter">lockmode</replaceable> is permitted. If the user has

‎doc/src/sgml/ref/refresh_materialized_view.sgml

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,10 +31,8 @@ REFRESH MATERIALIZED VIEW [ CONCURRENTLY ] <replaceable class="parameter">name</
3131

3232
<para>
3333
<command>REFRESH MATERIALIZED VIEW</command> completely replaces the
34-
contents of a materialized view. To execute this command you must be the
35-
owner of the materialized view, have privileges of the
36-
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
37-
role, or have the <literal>MAINTAIN</literal>
34+
contents of a materialized view. To execute this command you must have the
35+
<literal>MAINTAIN</literal>
3836
privilege on the materialized view. The old contents are discarded. If
3937
<literal>WITH DATA</literal> is specified (or defaults) the backing query
4038
is executed to provide the new data, and the materialized view is left in a

‎doc/src/sgml/ref/reindex.sgml

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -292,21 +292,21 @@ REINDEX [ ( <replaceable class="parameter">option</replaceable> [, ...] ) ] { DA
292292
</para>
293293

294294
<para>
295-
Reindexing a single index or table requires being the owner of that
296-
index or table, having privileges of the
297-
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
298-
role, or having the <literal>MAINTAIN</literal> privilege on the
299-
table. Reindexing a schema or database requires being the
295+
Reindexing a single index or table requires
296+
having the <literal>MAINTAIN</literal> privilege on the
297+
table. Note that while <command>REINDEX</command> on a partitioned index or
298+
table requires having the <literal>MAINTAIN</literal> privilege on the
299+
partitioned table, such commands skip the privilege checks when processing
300+
the individual partitions. Reindexing a schema or database requires being the
300301
owner of that schema or database or having privileges of the
301-
<literal>pg_maintain</literal> role. Note specifically that it's thus
302+
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
303+
role. Note specifically that it's thus
302304
possible for non-superusers to rebuild indexes of tables owned by
303-
other users. However, as a special exception, when
304-
<command>REINDEX DATABASE</command>, <command>REINDEX SCHEMA</command>
305-
or <command>REINDEX SYSTEM</command> is issued by a non-superuser,
306-
indexes on shared catalogs will be skipped unless the user owns the
307-
catalog (which typically won't be the case), has privileges of the
308-
<literal>pg_maintain</literal> role, or has the <literal>MAINTAIN</literal>
309-
privilege on the catalog. Of course, superusers can always reindex anything.
305+
other users. However, as a special exception,
306+
<command>REINDEX DATABASE</command>, <command>REINDEX SCHEMA</command>,
307+
and <command>REINDEX SYSTEM</command> will skip indexes on shared catalogs
308+
unless the user has the <literal>MAINTAIN</literal> privilege on the
309+
catalog.
310310
</para>
311311

312312
<para>

‎doc/src/sgml/ref/vacuum.sgml

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -445,14 +445,8 @@ VACUUM [ FULL ] [ FREEZE ] [ VERBOSE ] [ ANALYZE ] [ <replaceable class="paramet
445445

446446
<para>
447447
To vacuum a table, one must ordinarily have the <literal>MAINTAIN</literal>
448-
privilege on the table or be the table's owner, a superuser, or a role with
449-
privileges of the
450-
<link linkend="predefined-roles-table"><literal>pg_maintain</literal></link>
451-
role. However, database owners are allowed to
448+
privilege on the table. However, database owners are allowed to
452449
vacuum all tables in their databases, except shared catalogs.
453-
(The restriction for shared catalogs means that a true database-wide
454-
<command>VACUUM</command> can only be performed by superusers and roles
455-
with privileges of <literal>pg_maintain</literal>.)
456450
<command>VACUUM</command> will skip over any tables that the calling user
457451
does not have permission to vacuum.
458452
</para>

‎doc/src/sgml/user-manag.sgml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -692,7 +692,8 @@ DROP ROLE doomed_role;
692692
<link linkend="sql-refreshmaterializedview"><command>REFRESH MATERIALIZED VIEW</command></link>,
693693
<link linkend="sql-reindex"><command>REINDEX</command></link>,
694694
and <link linkend="sql-lock"><command>LOCK TABLE</command></link> on all
695-
relations.</entry>
695+
relations, as if having <literal>MAINTAIN</literal> rights on those
696+
objects, even without having it explicitly.</entry>
696697
</row>
697698
<row>
698699
<entry>pg_use_reserved_connections</entry>

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp