Content-Type: multipart/alternative;
 boundary="------------isVaK0khceLEVW0HF8001Y9x"
Message-ID: <908bf36d-51e5-469e-aa2e-062ab68dca59@gmail.com>
Date: Thu, 15 Jan 2026 14:47:42 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: BUG #19379: Role pg_read_all_data don't allowed read large
 objects
To: "David G. Johnston" <david.g.johnston@gmail.com>,
 "long76.git@mail.ru" <long76.git@mail.ru>,
 "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>
References: <19379-089536632927293f@postgresql.org>
 <CAKFQuwZbtoAs1Ew62aC25R1r7i=M1J_3UmCsssidwDn2Xe6XhA@mail.gmail.com>
Content-Language: en-US
From: Pierre Forstmann <pierre.forstmann@gmail.com>
In-Reply-To: <CAKFQuwZbtoAs1Ew62aC25R1r7i=M1J_3UmCsssidwDn2Xe6XhA@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/908bf36d-51e5-469e-aa2e-062ab68dca59%40gmail.com>
Precedence: bulk

This is a multi-part message in MIME format.
--------------isVaK0khceLEVW0HF8001Y9x
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

It could be interesting to have a new predefined role pg_read_all_lo to 
be able to read all LO.

Maybe it could be done with an extension with some background task to 
take into account newly created LO but it should be easier to have this 
coded without an extension.

Le 15/01/2026 à 14:36, David G. Johnston a écrit :
> On Thursday, January 15, 2026, PG Bug reporting form 
> <noreply@postgresql.org> wrote:
>
>     The following bug has been logged on the website:
>
>     Bug reference:      19379
>     Logged by:          Misha Shaygu
>     Email address: long76.git@mail.ru
>     PostgreSQL version: 17.7
>     Operating system:   Kubuntu 24.04
>     Description:
>
>     My goal: create role for backup any database on server
>
>     Steps:
>     1. CREATE USER backup_user;
>     2. GRANT pg_read_all_data TO backup_user;
>     3. pg_dump my_db
>     4. got error to read large object
>
>     Following by links
>     https://www.postgresql.org/docs/17/predefined-roles.html
>     <https://www.postgresql.org/docs/17/predefined-roles.html>
>     https://www.postgresql.org/docs/17/lo-implementation.html
>     <https://www.postgresql.org/docs/17/lo-implementation.html>
>     "SELECT privileges are required to read a large object" and role
>     "pg_read_all_data" grant it, but it don't work!
>
>     Please fix it, thanks!
>
>
> The docs you link note that all data is “tables, views, sequences”.  
> Large objects are not listed.  Maybe that means the name is a bit 
> misleading but it’s working as documented.
>
> Likewise, the LO page doesn’t say anything about read all being 
> applicable.
>
> David J.
--------------isVaK0khceLEVW0HF8001Y9x
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>It could be interesting to have a new predefined role
      pg_read_all_lo to be able to read all LO.</p>
    <p>Maybe it could be done with an extension with some background
      task to take into account newly created LO but it should be easier
      to have this coded without an extension.</p>
    <div class="moz-cite-prefix">Le 15/01/2026 à 14:36, David G.
      Johnston a écrit :<br>
    </div>
    <blockquote type="cite"
cite="mid:CAKFQuwZbtoAs1Ew62aC25R1r7i=M1J_3UmCsssidwDn2Xe6XhA@mail.gmail.com">
      <meta http-equiv="content-type" content="text/html; charset=UTF-8">
      On Thursday, January 15, 2026, PG Bug reporting form &lt;<a
        href="mailto:noreply@postgresql.org" target="_blank"
        moz-do-not-send="true" class="moz-txt-link-freetext">noreply@postgresql.org</a>&gt;
      wrote:<br>
      <blockquote class="gmail_quote"
style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">The
        following bug has been logged on the website:<br>
        <br>
        Bug reference:      19379<br>
        Logged by:          Misha Shaygu<br>
        Email address:      <a href="mailto:long76.git@mail.ru"
          target="_blank" moz-do-not-send="true"
          class="moz-txt-link-freetext">long76.git@mail.ru</a><br>
        PostgreSQL version: 17.7<br>
        Operating system:   Kubuntu 24.04<br>
        Description:        <br>
        <br>
        My goal: create role for backup any database on server<br>
        <br>
        Steps:<br>
        1. CREATE USER backup_user;<br>
        2. GRANT pg_read_all_data TO backup_user;<br>
        3. pg_dump my_db<br>
        4. got error to read large object<br>
        <br>
        Following by links<br>
        <a
href="https://www.postgresql.org/docs/17/predefined-roles.html"
          target="_blank" moz-do-not-send="true">https://www.postgresql.org/doc<wbr>s/17/predefined-roles.html</a><br>
        <a
href="https://www.postgresql.org/docs/17/lo-implementation.html"
          target="_blank" moz-do-not-send="true">https://www.postgresql.org/doc<wbr>s/17/lo-implementation.html</a><br>
        "SELECT privileges are required to read a large object" and role<br>
        "pg_read_all_data" grant it, but it don't work!<br>
        <br>
        Please fix it, thanks!<br>
      </blockquote>
      <div><br>
      </div>
      <div>The docs you link note that all data is “tables, views,
        sequences”.  Large objects are not listed.  Maybe that means the
        name is a bit misleading but it’s working as documented.</div>
      <div><br>
      </div>
      <div>Likewise, the LO page doesn’t say anything about read all
        being applicable.</div>
      <div><br>
      </div>
      <div>David J.</div>
      <div> </div>
    </blockquote>
  </body>
</html>

--------------isVaK0khceLEVW0HF8001Y9x--