Skip to content

[Bug]: postgres_privileges.present with object_name ALL is never idempotent #70291

Description

@b-a-t

What happened?

postgres_privileges.present accepts object_name: ALL for tables and sequences and correctly generates GRANT ... ON ALL TABLES/SEQUENCES IN SCHEMA.

However, has_privileges() passes "ALL" to privileges_list(). _make_privileges_list_query() then searches for relname = 'ALL', so the existing grants are never found. Consequently, every subsequent state run reports a change and executes the grant again.
Reproduction:

reader-all-tables:
  postgres_privileges.present:
    - name: reader
    - object_type: table
    - object_name: ALL
    - privileges:
      - SELECT
    - prepend: public
    - maintenance_db: application

Expected: the second run is clean.

Actual: every run reports SELECT as granted again.

This affects Salt 3006 and remains present in the current master/3009 implementation.

This may root back to #36279

Type of salt install

Official rpm

Major version

3006.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

oraclelinux-8

salt --versions-report output

Salt Version:
               Salt: 3006.27

Python Version:
             Python: 3.11.15 (main, Jun 29 2026, 22:21:49) [GCC 11.2.0]

Dependency Versions:
               cffi: 2.0.0
           cherrypy: 18.10.0
       cryptography: 47.0.0
           dateutil: 2.9.0.post0
          docker-py: 7.2.0
              gitdb: 4.0.12
          gitpython: 3.1.50
             Jinja2: 3.1.6
            libgit2: Not Installed
       looseversion: 1.3.0
           M2Crypto: Not Installed
               Mako: Not Installed
            msgpack: 1.1.2
       msgpack-pure: Not Installed
       mysql-python: Not Installed
          packaging: 24.0
          pycparser: 3.00
           pycrypto: Not Installed
       pycryptodome: 3.23.0
             pygit2: Not Installed
       python-gnupg: 0.5.6
             PyYAML: 6.0.3
              PyZMQ: 27.1.0
             relenv: 0.22.16
              smmap: 5.0.2
            timelib: 0.3.0
            Tornado: 6.5.5
                ZMQ: 4.3.5

Salt Extensions:
 saltext.prometheus: 2.2.0
      saltext.vault: 1.8.0

System Versions:
               dist: oracle 8.10
             locale: utf-8
            machine: x86_64
            release: 4.18.0-553.162.1.el8_10.x86_64
             system: Linux
            version: Oracle Linux Server 8.10

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugbroken, incorrect, or confusing behaviorneeds-triage

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions