Correctly dump database and tablespace ACLs

Dump out the appropriate GRANT/REVOKE commands for databases and
tablespaces from pg_dumpall to replicate what the current state is.

This was broken during the changes to buildACLCommands for 9.6+
servers for pg_init_privs.

src/bin/initdb/initdb.c

@@ -2002,6 +2002,9 @@ setup_dictionary(FILE *cmdfd)
  * time.  This is used by pg_dump to allow users to change privileges
  * on catalog objects and to have those privilege changes preserved
  * across dump/reload and pg_upgrade.
+ *
+ * Note that pg_init_privs is only for per-database objects and therefore
+ * we don't include databases or tablespaces.
  */
 static void
 setup_privileges(FILE *cmdfd)
@@ -2111,30 +2114,6 @@ setup_privileges(FILE *cmdfd)
 		"  (objoid, classoid, objsubid, initprivs, privtype)"
 		"    SELECT"
 		"        oid,"
-		"        (SELECT oid FROM pg_class WHERE relname = 'pg_database'),"
-		"        0,"
-		"        datacl,"
-		"        'i'"
-		"    FROM"
-		"        pg_database"
-		"    WHERE"
-		"        datacl IS NOT NULL;",
-		"INSERT INTO pg_init_privs "
-		"  (objoid, classoid, objsubid, initprivs, privtype)"
-		"    SELECT"
-		"        oid,"
-		"        (SELECT oid FROM pg_class WHERE relname = 'pg_tablespace'),"
-		"        0,"
-		"        spcacl,"
-		"        'i'"
-		"    FROM"
-		"        pg_tablespace"
-		"    WHERE"
-		"        spcacl IS NOT NULL;",
-		"INSERT INTO pg_init_privs "
-		"  (objoid, classoid, objsubid, initprivs, privtype)"
-		"    SELECT"
-		"        oid,"
 		"        (SELECT oid FROM pg_class WHERE "
 		"		  relname = 'pg_foreign_data_wrapper'),"
 		"        0,"

src/bin/pg_dump/pg_dumpall.c

@@ -1072,11 +1072,35 @@ dumpTablespaces(PGconn *conn)
 	/*
 	 * Get all tablespaces except built-in ones (which we assume are named
 	 * pg_xxx)
+	 *
+	 * For the tablespace ACLs, as of 9.6, we extract both the positive (as
+	 * spcacl) and negative (as rspcacl) ACLs, relative to the default ACL for
+	 * tablespaces, which are then passed to buildACLCommands() below.
+	 *
+	 * See buildACLQueries() and buildACLCommands().
+	 *
+	 * Note that we do not support initial privileges (pg_init_privs) on
+	 * tablespaces.
 	 */
-	if (server_version >= 90200)
+	if (server_version >= 90600)
 		res = executeQuery(conn, "SELECT oid, spcname, "
 						 "pg_catalog.pg_get_userbyid(spcowner) AS spcowner, "
-						   "pg_catalog.pg_tablespace_location(oid), spcacl, "
+						   "pg_catalog.pg_tablespace_location(oid), "
+						   "(SELECT pg_catalog.array_agg(acl) FROM (SELECT pg_catalog.unnest(coalesce(spcacl,pg_catalog.acldefault('t',spcowner))) AS acl "
+						   "EXCEPT SELECT pg_catalog.unnest(pg_catalog.acldefault('t',spcowner))) as foo)"
+						   "AS spcacl,"
+						   "(SELECT pg_catalog.array_agg(acl) FROM (SELECT pg_catalog.unnest(pg_catalog.acldefault('t',spcowner)) AS acl "
+						   "EXCEPT SELECT pg_catalog.unnest(coalesce(spcacl,pg_catalog.acldefault('t',spcowner)))) as foo)"
+						   "AS rspcacl,"
+						   "array_to_string(spcoptions, ', '),"
+						"pg_catalog.shobj_description(oid, 'pg_tablespace') "
+						   "FROM pg_catalog.pg_tablespace "
+						   "WHERE spcname !~ '^pg_' "
+						   "ORDER BY 1");
+	else if (server_version >= 90200)
+		res = executeQuery(conn, "SELECT oid, spcname, "
+						 "pg_catalog.pg_get_userbyid(spcowner) AS spcowner, "
+						   "pg_catalog.pg_tablespace_location(oid), spcacl, '' as rspcacl, "
 						   "array_to_string(spcoptions, ', '),"
 						"pg_catalog.shobj_description(oid, 'pg_tablespace') "
 						   "FROM pg_catalog.pg_tablespace "
@@ -1085,7 +1109,7 @@ dumpTablespaces(PGconn *conn)
 	else if (server_version >= 90000)
 		res = executeQuery(conn, "SELECT oid, spcname, "
 						 "pg_catalog.pg_get_userbyid(spcowner) AS spcowner, "
-						   "spclocation, spcacl, "
+						   "spclocation, spcacl, '' as rspcacl, "
 						   "array_to_string(spcoptions, ', '),"
 						"pg_catalog.shobj_description(oid, 'pg_tablespace') "
 						   "FROM pg_catalog.pg_tablespace "
@@ -1094,7 +1118,7 @@ dumpTablespaces(PGconn *conn)
 	else if (server_version >= 80200)
 		res = executeQuery(conn, "SELECT oid, spcname, "
 						 "pg_catalog.pg_get_userbyid(spcowner) AS spcowner, "
-						   "spclocation, spcacl, null, "
+						   "spclocation, spcacl, '' as rspcacl, null, "
 						"pg_catalog.shobj_description(oid, 'pg_tablespace') "
 						   "FROM pg_catalog.pg_tablespace "
 						   "WHERE spcname !~ '^pg_' "
@@ -1102,7 +1126,7 @@ dumpTablespaces(PGconn *conn)
 	else
 		res = executeQuery(conn, "SELECT oid, spcname, "
 						 "pg_catalog.pg_get_userbyid(spcowner) AS spcowner, "
-						   "spclocation, spcacl, "
+						   "spclocation, spcacl, '' as rspcacl, "
 						   "null, null "
 						   "FROM pg_catalog.pg_tablespace "
 						   "WHERE spcname !~ '^pg_' "
@@ -1119,8 +1143,9 @@ dumpTablespaces(PGconn *conn)
 		char	   *spcowner = PQgetvalue(res, i, 2);
 		char	   *spclocation = PQgetvalue(res, i, 3);
 		char	   *spcacl = PQgetvalue(res, i, 4);
-		char	   *spcoptions = PQgetvalue(res, i, 5);
+		char	   *rspcacl = PQgetvalue(res, i, 5);
-		char	   *spccomment = PQgetvalue(res, i, 6);
+		char	   *spcoptions = PQgetvalue(res, i, 6);
+		char	   *spccomment = PQgetvalue(res, i, 7);
 		char	   *fspcname;
 
 		/* needed for buildACLCommands() */
@@ -1138,7 +1163,7 @@ dumpTablespaces(PGconn *conn)
 							  fspcname, spcoptions);
 
 		if (!skip_acls &&
-			!buildACLCommands(fspcname, NULL, "TABLESPACE", spcacl, "",
+			!buildACLCommands(fspcname, NULL, "TABLESPACE", spcacl, rspcacl,
 							  spcowner, "", server_version, buf))
 		{
 			fprintf(stderr, _("%s: could not parse ACL list (%s) for tablespace \"%s\"\n"),
@@ -1284,14 +1309,43 @@ dumpCreateDB(PGconn *conn)
 
 	PQclear(res);
 
-	/* Now collect all the information about databases to dump */
+
-	if (server_version >= 90300)
+	/*
+	 * Now collect all the information about databases to dump.
+	 *
+	 * For the database ACLs, as of 9.6, we extract both the positive (as
+	 * datacl) and negative (as rdatacl) ACLs, relative to the default ACL for
+	 * databases, which are then passed to buildACLCommands() below.
+	 *
+	 * See buildACLQueries() and buildACLCommands().
+	 *
+	 * Note that we do not support initial privileges (pg_init_privs) on
+	 * databases.
+	 */
+	if (server_version >= 90600)
 		res = executeQuery(conn,
 						   "SELECT datname, "
 						   "coalesce(rolname, (select rolname from pg_authid where oid=(select datdba from pg_database where datname='template0'))), "
 						   "pg_encoding_to_char(d.encoding), "
 						   "datcollate, datctype, datfrozenxid, datminmxid, "
-						   "datistemplate, datacl, datconnlimit, "
+						   "datistemplate, "
+						   "(SELECT pg_catalog.array_agg(acl) FROM (SELECT pg_catalog.unnest(coalesce(datacl,pg_catalog.acldefault('d',datdba))) AS acl "
+						   "EXCEPT SELECT pg_catalog.unnest(pg_catalog.acldefault('d',datdba))) as foo)"
+						   "AS datacl,"
+						   "(SELECT pg_catalog.array_agg(acl) FROM (SELECT pg_catalog.unnest(pg_catalog.acldefault('d',datdba)) AS acl "
+						   "EXCEPT SELECT pg_catalog.unnest(coalesce(datacl,pg_catalog.acldefault('d',datdba)))) as foo)"
+						   "AS rdatacl,"
+						   "datconnlimit, "
+						   "(SELECT spcname FROM pg_tablespace t WHERE t.oid = d.dattablespace) AS dattablespace "
+			  "FROM pg_database d LEFT JOIN pg_authid u ON (datdba = u.oid) "
+						   "WHERE datallowconn ORDER BY 1");
+	else if (server_version >= 90300)
+		res = executeQuery(conn,
+						   "SELECT datname, "
+						   "coalesce(rolname, (select rolname from pg_authid where oid=(select datdba from pg_database where datname='template0'))), "
+						   "pg_encoding_to_char(d.encoding), "
+						   "datcollate, datctype, datfrozenxid, datminmxid, "
+						   "datistemplate, datacl, '' as rdatacl, datconnlimit, "
 						   "(SELECT spcname FROM pg_tablespace t WHERE t.oid = d.dattablespace) AS dattablespace "
 			  "FROM pg_database d LEFT JOIN pg_authid u ON (datdba = u.oid) "
 						   "WHERE datallowconn ORDER BY 1");
@@ -1301,7 +1355,7 @@ dumpCreateDB(PGconn *conn)
 						   "coalesce(rolname, (select rolname from pg_authid where oid=(select datdba from pg_database where datname='template0'))), "
 						   "pg_encoding_to_char(d.encoding), "
 					  "datcollate, datctype, datfrozenxid, 0 AS datminmxid, "
-						   "datistemplate, datacl, datconnlimit, "
+						   "datistemplate, datacl, '' as rdatacl, datconnlimit, "
 						   "(SELECT spcname FROM pg_tablespace t WHERE t.oid = d.dattablespace) AS dattablespace "
 			  "FROM pg_database d LEFT JOIN pg_authid u ON (datdba = u.oid) "
 						   "WHERE datallowconn ORDER BY 1");
@@ -1311,7 +1365,7 @@ dumpCreateDB(PGconn *conn)
 						   "coalesce(rolname, (select rolname from pg_authid where oid=(select datdba from pg_database where datname='template0'))), "
 						   "pg_encoding_to_char(d.encoding), "
 						   "null::text AS datcollate, null::text AS datctype, datfrozenxid, 0 AS datminmxid, "
-						   "datistemplate, datacl, datconnlimit, "
+						   "datistemplate, datacl, '' as rdatacl, datconnlimit, "
 						   "(SELECT spcname FROM pg_tablespace t WHERE t.oid = d.dattablespace) AS dattablespace "
 			  "FROM pg_database d LEFT JOIN pg_authid u ON (datdba = u.oid) "
 						   "WHERE datallowconn ORDER BY 1");
@@ -1321,7 +1375,7 @@ dumpCreateDB(PGconn *conn)
 						   "coalesce(usename, (select usename from pg_shadow where usesysid=(select datdba from pg_database where datname='template0'))), "
 						   "pg_encoding_to_char(d.encoding), "
 						   "null::text AS datcollate, null::text AS datctype, datfrozenxid, 0 AS datminmxid, "
-						   "datistemplate, datacl, -1 as datconnlimit, "
+						   "datistemplate, datacl, '' as rdatacl, -1 as datconnlimit, "
 						   "(SELECT spcname FROM pg_tablespace t WHERE t.oid = d.dattablespace) AS dattablespace "
 		   "FROM pg_database d LEFT JOIN pg_shadow u ON (datdba = usesysid) "
 						   "WHERE datallowconn ORDER BY 1");
@@ -1331,7 +1385,7 @@ dumpCreateDB(PGconn *conn)
 						   "coalesce(usename, (select usename from pg_shadow where usesysid=(select datdba from pg_database where datname='template0'))), "
 						   "pg_encoding_to_char(d.encoding), "
 						   "null::text AS datcollate, null::text AS datctype, datfrozenxid, 0 AS datminmxid, "
-						   "datistemplate, datacl, -1 as datconnlimit, "
+						   "datistemplate, datacl, '' as rdatacl, -1 as datconnlimit, "
 						   "'pg_default' AS dattablespace "
 		   "FROM pg_database d LEFT JOIN pg_shadow u ON (datdba = usesysid) "
 						   "WHERE datallowconn ORDER BY 1");
@@ -1343,7 +1397,7 @@ dumpCreateDB(PGconn *conn)
 						   "(select usename from pg_shadow where usesysid=(select datdba from pg_database where datname='template0'))), "
 						   "pg_encoding_to_char(d.encoding), "
 						   "null::text AS datcollate, null::text AS datctype, 0 AS datfrozenxid, 0 AS datminmxid, "
-						   "datistemplate, '' as datacl, -1 as datconnlimit, "
+						   "datistemplate, '' as datacl, '' as rdatacl, -1 as datconnlimit, "
 						   "'pg_default' AS dattablespace "
 						   "FROM pg_database d "
 						   "WHERE datallowconn ORDER BY 1");
@@ -1359,7 +1413,7 @@ dumpCreateDB(PGconn *conn)
 						   "pg_encoding_to_char(d.encoding), "
 						   "null::text AS datcollate, null::text AS datctype, 0 AS datfrozenxid, 0 AS datminmxid, "
 						   "'f' as datistemplate, "
-						   "'' as datacl, -1 as datconnlimit, "
+						   "'' as datacl, '' as rdatacl, -1 as datconnlimit, "
 						   "'pg_default' AS dattablespace "
 						   "FROM pg_database d "
 						   "ORDER BY 1");
@@ -1376,8 +1430,9 @@ dumpCreateDB(PGconn *conn)
 		uint32		dbminmxid = atooid(PQgetvalue(res, i, 6));
 		char	   *dbistemplate = PQgetvalue(res, i, 7);
 		char	   *dbacl = PQgetvalue(res, i, 8);
-		char	   *dbconnlimit = PQgetvalue(res, i, 9);
+		char	   *rdbacl = PQgetvalue(res, i, 9);
-		char	   *dbtablespace = PQgetvalue(res, i, 10);
+		char	   *dbconnlimit = PQgetvalue(res, i, 10);
+		char	   *dbtablespace = PQgetvalue(res, i, 11);
 		char	   *fdbname;
 
 		fdbname = pg_strdup(fmtId(dbname));
@@ -1469,7 +1524,7 @@ dumpCreateDB(PGconn *conn)
 		}
 
 		if (!skip_acls &&
-			!buildACLCommands(fdbname, NULL, "DATABASE", dbacl, "", dbowner,
+			!buildACLCommands(fdbname, NULL, "DATABASE", dbacl, rdbacl, dbowner,
 							  "", server_version, buf))
 		{
 			fprintf(stderr, _("%s: could not parse ACL list (%s) for database \"%s\"\n"),

src/bin/pg_dump/t/002_pg_dump.pl

@@ -141,6 +141,9 @@ my %pgdump_runs = (
 		dump_cmd => [
 			'pg_dumpall', '-f', "$tempdir/pg_dumpall_globals_clean.sql",
 			'-g', '-c', ], },
+	pg_dumpall_dbprivs => {
+		dump_cmd =>
+		  [ 'pg_dumpall', '-f', "$tempdir/pg_dumpall_dbprivs.sql", ], },
 	no_privs => {
 		dump_cmd =>
 		  [ 'pg_dump', '-f', "$tempdir/no_privs.sql", '-x', 'postgres', ], },
@@ -240,6 +243,7 @@ my %tests = (
 			exclude_test_table      => 1,
 			exclude_test_table_data => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -258,6 +262,7 @@ my %tests = (
 			\QNOREPLICATION NOBYPASSRLS;\E
 			/xm,
 		like => {
+			pg_dumpall_dbprivs       => 1,
 			pg_dumpall_globals       => 1,
 			pg_dumpall_globals_clean => 1, },
 		unlike => {
@@ -292,6 +297,7 @@ my %tests = (
 			exclude_test_table_data => 1,
 			no_privs                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -310,6 +316,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -328,6 +335,7 @@ my %tests = (
 			exclude_test_table_data => 1,
 			no_privs                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -346,6 +354,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -367,6 +376,7 @@ my %tests = (
 			no_privs                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -387,6 +397,7 @@ my %tests = (
 			no_privs                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -408,6 +419,7 @@ my %tests = (
 			no_privs                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -427,6 +439,7 @@ my %tests = (
 			exclude_test_table_data => 1,
 			no_privs                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -445,6 +458,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -504,6 +518,7 @@ my %tests = (
 	#			exclude_test_table => 1,
 	#			exclude_test_table_data => 1,
 	#			no_privs => 1,
+	#			pg_dumpall_dbprivs       => 1,
 	#			section_data => 1,
 	#			test_schema_plus_blobs => 1,
 	#		},
@@ -529,6 +544,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -546,6 +562,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -568,6 +585,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1, },
 		unlike => {
@@ -591,6 +609,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1, },
 		unlike => {
@@ -614,6 +633,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1, },
 		unlike => {
@@ -649,6 +669,7 @@ my %tests = (
 			no_owner               => 1,
 			only_dump_test_schema  => 1,
 			only_dump_test_table   => 1,
+			pg_dumpall_dbprivs     => 1,
 			section_data           => 1,
 			test_schema_plus_blobs => 1, },
 		unlike => {
@@ -674,6 +695,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			section_data            => 1,
 			test_schema_plus_blobs  => 1, },
 		unlike => {
@@ -711,6 +733,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			section_data            => 1,
 			test_schema_plus_blobs  => 1, },
 		unlike => {
@@ -736,6 +759,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			section_data             => 1, },
 		unlike => {
 			only_dump_test_schema  => 1,
@@ -757,6 +781,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			section_data             => 1,
 			only_dump_test_schema    => 1,
 			only_dump_test_table     => 1,
@@ -777,6 +802,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			section_data             => 1,
 			only_dump_test_schema    => 1,
 			only_dump_test_table     => 1,
@@ -797,6 +823,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			section_data             => 1,
 			only_dump_test_schema    => 1,
 			only_dump_test_table     => 1,
@@ -816,6 +843,7 @@ my %tests = (
 		create_sql   => 'CREATE ROLE dump_test;',
 		regexp       => qr/^CREATE ROLE dump_test;/m,
 		like         => {
+			pg_dumpall_dbprivs       => 1,
 			pg_dumpall_globals       => 1,
 			pg_dumpall_globals_clean => 1, },
 		unlike => {
@@ -852,6 +880,33 @@ my %tests = (
 			no_owner                 => 1,
 			only_dump_test_schema    => 1,
 			only_dump_test_table     => 1,
+			pg_dumpall_dbprivs       => 1,
+			pg_dumpall_globals       => 1,
+			pg_dumpall_globals_clean => 1,
+			schema_only              => 1,
+			section_pre_data         => 1,
+			section_post_data        => 1,
+			test_schema_plus_blobs   => 1, }, },
+	'CREATE DATABASE dump_test' => {
+		create_order => 47,
+		create_sql => 'CREATE DATABASE dump_test;',
+		regexp => qr/^
+			\QCREATE DATABASE dump_test WITH TEMPLATE = template0 \E
+			.*;/xm,
+		like   => { pg_dumpall_dbprivs => 1, },
+		unlike => {
+			binary_upgrade           => 1,
+			clean                    => 1,
+			clean_if_exists          => 1,
+			createdb                 => 1,
+			defaults                 => 1,
+			exclude_dump_test_schema => 1,
+			exclude_test_table       => 1,
+			exclude_test_table_data  => 1,
+			no_privs                 => 1,
+			no_owner                 => 1,
+			only_dump_test_schema    => 1,
+			only_dump_test_table     => 1,
 			pg_dumpall_globals       => 1,
 			pg_dumpall_globals_clean => 1,
 			schema_only              => 1,
@@ -872,6 +927,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -909,6 +965,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -942,6 +999,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -974,6 +1032,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1005,6 +1064,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1036,6 +1096,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1066,6 +1127,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_post_data        => 1, },
 		unlike => {
@@ -1097,6 +1159,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1126,6 +1189,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1156,6 +1220,7 @@ my %tests = (
 			no_privs                 => 1,
 			no_owner                 => 1,
 			only_dump_test_schema    => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1,
 			test_schema_plus_blobs   => 1,
@@ -1183,6 +1248,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1206,6 +1272,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1236,6 +1303,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1266,6 +1334,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1304,6 +1373,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1335,6 +1405,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1359,6 +1430,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -1383,6 +1455,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -1411,6 +1484,7 @@ my %tests = (
 #			exclude_test_table_data => 1,
 #			no_privs => 1,
 #			no_owner => 1,
+#			pg_dumpall_dbprivs       => 1,
 #			schema_only => 1,
 #			section_post_data => 1,
 #		},
@@ -1440,6 +1514,7 @@ my %tests = (
 			exclude_test_table_data => 1,
 			no_privs                => 1,
 			no_owner                => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1, },
 		unlike => {
@@ -1471,6 +1546,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1502,6 +1578,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1531,6 +1608,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1559,6 +1637,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1587,6 +1666,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1615,6 +1695,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1643,6 +1724,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_post_data       => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1667,6 +1749,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1691,6 +1774,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -1723,6 +1807,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1753,6 +1838,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1785,6 +1871,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1815,6 +1902,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -1845,6 +1933,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -1873,6 +1962,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -1901,6 +1991,7 @@ my %tests = (
 			exclude_test_table_data  => 1,
 			no_privs                 => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_post_data        => 1, },
 		unlike => {
@@ -2021,6 +2112,7 @@ my %tests = (
 			no_owner                 => 1,
 			only_dump_test_schema    => 1,
 			only_dump_test_table     => 1,
+			pg_dumpall_dbprivs       => 1,
 			pg_dumpall_globals       => 1,
 			schema_only              => 1, }, },
 	'GRANT USAGE ON SCHEMA dump_test_second_schema' => {
@@ -2040,6 +2132,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -2047,6 +2140,30 @@ my %tests = (
 			only_dump_test_table   => 1,
 			pg_dumpall_globals     => 1,
 			test_schema_plus_blobs => 1, }, },
+	'GRANT CREATE ON DATABASE dump_test' => {
+		create_order => 48,
+		create_sql   => 'GRANT CREATE ON DATABASE dump_test TO dump_test;',
+		regexp => qr/^
+			\QGRANT CREATE ON DATABASE dump_test TO dump_test;\E
+			/xm,
+		like => {
+			pg_dumpall_dbprivs       => 1, },
+		unlike => {
+			binary_upgrade           => 1,
+			clean                    => 1,
+			clean_if_exists          => 1,
+			createdb                 => 1,
+			defaults                 => 1,
+			exclude_dump_test_schema => 1,
+			exclude_test_table       => 1,
+			exclude_test_table_data  => 1,
+			no_owner                 => 1,
+			only_dump_test_schema    => 1,
+			only_dump_test_table     => 1,
+			pg_dumpall_globals       => 1,
+			schema_only              => 1,
+			section_pre_data         => 1, ,
+			test_schema_plus_blobs   => 1, }, },
 	'GRANT SELECT ON TABLE test_table' => {
 		create_order => 5,
 		create_sql   => 'GRANT SELECT ON TABLE dump_test.test_table
@@ -2062,6 +2179,7 @@ my %tests = (
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
 			only_dump_test_table    => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -2085,6 +2203,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -2110,6 +2229,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -2135,6 +2255,7 @@ my %tests = (
 			exclude_test_table_data => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			schema_only             => 1,
 			section_pre_data        => 1,
 			test_schema_plus_blobs  => 1, },
@@ -2159,6 +2280,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -2242,6 +2364,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -2268,6 +2391,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			test_schema_plus_blobs  => 1,
 			section_post_data       => 1, },
 		unlike => {
@@ -2293,6 +2417,7 @@ my %tests = (
 			no_privs                => 1,
 			no_owner                => 1,
 			only_dump_test_schema   => 1,
+			pg_dumpall_dbprivs      => 1,
 			test_schema_plus_blobs  => 1,
 			section_post_data       => 1, },
 		unlike => {
@@ -2302,6 +2427,30 @@ my %tests = (
 			pg_dumpall_globals       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, }, },
+	'REVOKE CONNECT ON DATABASE dump_test FROM public' => {
+		create_order => 49,
+		create_sql   => 'REVOKE CONNECT ON DATABASE dump_test FROM public;',
+		regexp => qr/^
+			\QREVOKE CONNECT,TEMPORARY ON DATABASE dump_test FROM PUBLIC;\E\n
+			\QGRANT TEMPORARY ON DATABASE dump_test TO PUBLIC;\E
+			/xm,
+		like => {
+			pg_dumpall_dbprivs       => 1, },
+		unlike => {
+			binary_upgrade           => 1,
+			clean                    => 1,
+			clean_if_exists          => 1,
+			createdb                 => 1,
+			defaults                 => 1,
+			exclude_dump_test_schema => 1,
+			exclude_test_table       => 1,
+			exclude_test_table_data  => 1,
+			no_owner                 => 1,
+			only_dump_test_schema    => 1,
+			only_dump_test_table     => 1,
+			schema_only              => 1,
+			section_pre_data         => 1,
+			test_schema_plus_blobs   => 1, }, },
 	'REVOKE EXECUTE ON FUNCTION pg_sleep() FROM public' => {
 		create_order => 15,
 		create_sql   => 'REVOKE EXECUTE ON FUNCTION pg_sleep(float8)
@@ -2319,6 +2468,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -2339,6 +2489,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -2362,6 +2513,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {
@@ -2382,6 +2534,7 @@ my %tests = (
 			exclude_test_table       => 1,
 			exclude_test_table_data  => 1,
 			no_owner                 => 1,
+			pg_dumpall_dbprivs       => 1,
 			schema_only              => 1,
 			section_pre_data         => 1, },
 		unlike => {