> On 10 Aug 2026, at 12:03, Kirill Reshke <[email protected]> wrote:
>
> I discovered a sequence of ddl which creates grant configuration,
> unrestorable from pg_dump-pg_restore.
The diagnosis looks right, but I think the proposed fix is too broad.
Suppose the owner grants an option directly to role A, role B is a member
of A, and A grants the option to B. This is not circular: after revoking
B's membership in A, the grant from A remains valid. Changing the loop to
has_privs_of_role(B, A) would remove A's independently held option and
reject this case.
select_best_grantor() uses aclmask_direct() instead of aclmask(). WDYT about
this route?
Best regards, Andrey Borodin.
