postgres.git / summary / log / commit / refs
commit bf1840255123d90e777c72341d36149d09bef0e5
Author: Fujii Masao <fujii@postgresql.org>
Date: Thu Feb 06 15:33:11 2020 +0000
First released in: 9.4.26, 9.5.21, 9.6.17, 10.12, 11.7, 12.2
Add note about access permission checks by inherited TRUNCATE and LOCK TABLE.
Inherited queries perform access permission checks on the parent
table only. But there are two exceptions to this rule in v12 or before;
TRUNCATE and LOCK TABLE commands through a parent table check
the permissions on not only the parent table but also the children
tables. Previously these exceptions were not documented.
This commit adds the note about these exceptions, into the document.
Back-patch to v9.4. But we don't apply this commit to the master
because commit e6f1e560e4 already got rid of the exception about
inherited TRUNCATE and upcoming commit will do for the exception
about inherited LOCK TABLE.
Author: Amit Langote
Reviewed-by: Fujii Masao
Discussion: https://postgr.es/m/CA+HiwqHfTnMU6SUkyHxCmpHUKk7ERLHCR3vZVq19ZOQBjPBLmQ@mail.gmail.com
doc/src/sgml/ddl.sgml | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml
index 8d2908c34d8..ba1b0571edc 100644
--- a/doc/src/sgml/ddl.sgml
+++ b/doc/src/sgml/ddl.sgml
@@ -2323,7 +2323,11 @@ VALUES ('New York', NULL, NULL, 'NY');
access privilege checking. This preserves the appearance that the
data is (also) in the parent table. Accessing the child tables
directly is, however, not automatically allowed and would require
- further privileges to be granted.
+ further privileges to be granted. Two exceptions to this rule are
+ <command>TRUNCATE</command> and <command>LOCK TABLE</command>,
+ where permissions on the child tables are always checked,
+ whether they are processed directly or recursively via those commands
+ performed on the parent table.
</para>
<sect2 id="ddl-inherit-caveats">
[parent: d034ab0bb2ae]