From: Erik Wienhold <ewie@ewie.name>
To: M Sarwar <sarwarmd02@outlook.com>
To: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Re: Just View create privilege to user user2
Date: Thu, 4 May 2023 11:08:50 +0200 (CEST)
Message-ID: <1679699150.1638077.1683191330069@office.mailbox.org> (raw)
In-Reply-To: <DM4PR19MB5978ABDF877412086889CC50D36C9@DM4PR19MB5978.namprd19.prod.outlook.com>
References: <DM4PR19MB5978ABDF877412086889CC50D36C9@DM4PR19MB5978.namprd19.prod.outlook.com>
> On 04/05/2023 01:07 CEST M Sarwar <sarwarmd02@outlook.com> wrote:
>
> I want user u2 to have only CREATE VIEW privilege in schema s2. I do not want
> u2 to create any other type of objects in s2 schema.
You can setup a second database db2 just for u2 and have them access your
database db1 via foreign tables. u2 still only has the SELECT privilege in db1
but can create objects in db2 and mess it up as they see fit.
If you go with a single database and event triggers as Tom wrote you must also
consider function security[0]. Otherwise u2 can override relations in s1 just
by creating compatible views in s2 and set search_path=s2,s1. u2 can thus
inject data into functions that have no explicit search_path.
[0] https://www.postgresql.org/docs/current/perm-functions.html
--
Erik
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: ewie@ewie.name, sarwarmd02@outlook.com, pgsql-admin@lists.postgresql.org
Subject: Re: Just View create privilege to user user2
In-Reply-To: <1679699150.1638077.1683191330069@office.mailbox.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox