diff options
| -rw-r--r-- | src/backend/commands/user.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/src/backend/commands/user.c b/src/backend/commands/user.c index 5b24b6dcad8..37260edbe48 100644 --- a/src/backend/commands/user.c +++ b/src/backend/commands/user.c @@ -693,7 +693,14 @@ AlterRole(ParseState *pstate, AlterRoleStmt *stmt) */ if (dissuper) { - new_record[Anum_pg_authid_rolsuper - 1] = BoolGetDatum(boolVal(dissuper->arg)); + bool should_be_super = BoolGetDatum(boolVal(dissuper->arg)); + + if (!should_be_super && roleid == BOOTSTRAP_SUPERUSERID) + ereport(ERROR, + (errcode(ERRCODE_INSUFFICIENT_PRIVILEGE), + errmsg("permission denied: bootstrap user must be superuser"))); + + new_record[Anum_pg_authid_rolsuper - 1] = should_be_super; new_record_repl[Anum_pg_authid_rolsuper - 1] = true; } |