@@ -1559,7 +1559,8 @@ REFRESH MATERIALIZED VIEW sro_mv;
1559
1559
ERROR: cannot fire deferred trigger within security-restricted operation
1560
1560
CONTEXT: SQL function "mv_action" statement 1
1561
1561
BEGIN; SET CONSTRAINTS ALL IMMEDIATE; REFRESH MATERIALIZED VIEW sro_mv; COMMIT;
1562
- ERROR: must have admin option on role "regress_priv_group2"
1562
+ ERROR: permission denied to grant role "regress_priv_group2"
1563
+ DETAIL: Only roles with the ADMIN option on role "regress_priv_group2" may grant this role.
1563
1564
CONTEXT: SQL function "unwanted_grant" statement 1
1564
1565
SQL statement "SELECT unwanted_grant()"
1565
1566
PL/pgSQL function sro_trojan() line 1 at PERFORM
@@ -1589,10 +1590,12 @@ CREATE FUNCTION dogrant_ok() RETURNS void LANGUAGE sql SECURITY DEFINER AS
1589
1590
GRANT regress_priv_group2 TO regress_priv_user5; -- ok: had ADMIN OPTION
1590
1591
SET ROLE regress_priv_group2;
1591
1592
GRANT regress_priv_group2 TO regress_priv_user5; -- fails: SET ROLE suspended privilege
1592
- ERROR: must have admin option on role "regress_priv_group2"
1593
+ ERROR: permission denied to grant role "regress_priv_group2"
1594
+ DETAIL: Only roles with the ADMIN option on role "regress_priv_group2" may grant this role.
1593
1595
SET SESSION AUTHORIZATION regress_priv_user1;
1594
1596
GRANT regress_priv_group2 TO regress_priv_user5; -- fails: no ADMIN OPTION
1595
- ERROR: must have admin option on role "regress_priv_group2"
1597
+ ERROR: permission denied to grant role "regress_priv_group2"
1598
+ DETAIL: Only roles with the ADMIN option on role "regress_priv_group2" may grant this role.
1596
1599
SELECT dogrant_ok(); -- ok: SECURITY DEFINER conveys ADMIN
1597
1600
NOTICE: role "regress_priv_user5" is already a member of role "regress_priv_group2"
1598
1601
dogrant_ok
@@ -1602,14 +1605,16 @@ NOTICE: role "regress_priv_user5" is already a member of role "regress_priv_gro
1602
1605
1603
1606
SET ROLE regress_priv_group2;
1604
1607
GRANT regress_priv_group2 TO regress_priv_user5; -- fails: SET ROLE did not help
1605
- ERROR: must have admin option on role "regress_priv_group2"
1608
+ ERROR: permission denied to grant role "regress_priv_group2"
1609
+ DETAIL: Only roles with the ADMIN option on role "regress_priv_group2" may grant this role.
1606
1610
SET SESSION AUTHORIZATION regress_priv_group2;
1607
1611
GRANT regress_priv_group2 TO regress_priv_user5; -- ok: a role can self-admin
1608
1612
NOTICE: role "regress_priv_user5" is already a member of role "regress_priv_group2"
1609
1613
CREATE FUNCTION dogrant_fails() RETURNS void LANGUAGE sql SECURITY DEFINER AS
1610
1614
'GRANT regress_priv_group2 TO regress_priv_user5';
1611
1615
SELECT dogrant_fails(); -- fails: no self-admin in SECURITY DEFINER
1612
- ERROR: must have admin option on role "regress_priv_group2"
1616
+ ERROR: permission denied to grant role "regress_priv_group2"
1617
+ DETAIL: Only roles with the ADMIN option on role "regress_priv_group2" may grant this role.
1613
1618
CONTEXT: SQL function "dogrant_fails" statement 1
1614
1619
DROP FUNCTION dogrant_fails();
1615
1620
SET SESSION AUTHORIZATION regress_priv_user4;
0 commit comments