From 923a44997b38399d9e8a3ffaaa9e5b606c948b22 Mon Sep 17 00:00:00 2001 From: Yurii Rashkovskii Date: Fri, 15 Sep 2023 11:18:48 -0700 Subject: [PATCH] Minor improvement to SET ROLE documentation. This helps indicating that even though `SET ROLE` made by a superuser will make that superuser to lose their privileges, there's still one they retain, and that is the ability to `SET ROLE` again. --- doc/src/sgml/ref/set_role.sgml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/doc/src/sgml/ref/set_role.sgml b/doc/src/sgml/ref/set_role.sgml index 13bad1bf66..808a99e8fc 100644 --- a/doc/src/sgml/ref/set_role.sgml +++ b/doc/src/sgml/ref/set_role.sgml @@ -42,9 +42,12 @@ RESET ROLE The specified role_name - must be a role that the current session user is a member of. - (If the session user is a superuser, any role can be selected.) - + must be a role that the current session user is a member of. The current + session user must have the SET option for the specified + role_name, either directly + or indirectly via a chain of memberships with the SET option. (If the + session user is a superuser, any role can be selected.) + The SESSION and LOCAL modifiers act the same @@ -88,7 +91,9 @@ RESET ROLE Note that when a superuser chooses to SET ROLE to a - non-superuser role, they lose their superuser privileges. + non-superuser role, they lose their superuser privileges, except for + the privilege to change to another role again using SET ROLE + or RESET ROLE. -- 2.33.0