postgres.git / summary / log / commit / refs

commit    87f738dafbe1e41a3315bf1157eca8eba63a3fa1
Author:   Fujii Masao <fujii@postgresql.org>
Date:     Thu Feb 06 15:33:11 2020 +0000
First released in: 9.4.26, 9.5.21, 9.6.17, 10.12, 11.7, 12.2

    Add note about access permission checks by inherited TRUNCATE and LOCK TABLE.
    
    Inherited queries perform access permission checks on the parent
    table only. But there are two exceptions to this rule in v12 or before;
    TRUNCATE and LOCK TABLE commands through a parent table check
    the permissions on not only the parent table but also the children
    tables. Previously these exceptions were not documented.
    
    This commit adds the note about these exceptions, into the document.
    
    Back-patch to v9.4. But we don't apply this commit to the master
    because commit e6f1e560e4 already got rid of the exception about
    inherited TRUNCATE and upcoming commit will do for the exception
    about inherited LOCK TABLE.
    
    Author: Amit Langote
    Reviewed-by: Fujii Masao
    Discussion: https://postgr.es/m/CA+HiwqHfTnMU6SUkyHxCmpHUKk7ERLHCR3vZVq19ZOQBjPBLmQ@mail.gmail.com


 doc/src/sgml/ddl.sgml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml
index aa927d22a9f..4e31c905926 100644
--- a/doc/src/sgml/ddl.sgml
+++ b/doc/src/sgml/ddl.sgml
@@ -2808,7 +2808,15 @@ VALUES ('Albany', NULL, NULL, 'NY');
    accessed through <structname>cities</>.  This preserves the appearance
    that the data is (also) in the parent table.  But
    the <structname>capitals</structname> table could not be updated directly
-   without an additional grant.  In a similar way, the parent table's row
+   without an additional grant.  Two exceptions to this rule are
+   <command>TRUNCATE</command> and <command>LOCK TABLE</command>,
+   where permissions on the child tables are always checked,
+   whether they are processed directly or recursively via those commands
+   performed on the parent table.
+  </para>
+
+  <para>
+   In a similar way, the parent table's row
    security policies (see <xref linkend="ddl-rowsecurity">) are applied to
    rows coming from child tables during an inherited query.  A child table's
    policies, if any, are applied only when it is the table explicitly named


[parent: 699700b3626f]