pg.ddx.io pgsql-admin@postgresql.org mailing list archive
help / color / mirror / Atom feedJust View create privilege to user user2
5+ messages / 3 participants
[nested] [flat]
* Just View create privilege to user user2
@ 2023-05-03 23:07 M Sarwar <sarwarmd02@outlook.com>
2023-05-03 23:28 ` Re: Just View create privilege to user user2 Tom Lane <tgl@sss.pgh.pa.us>
2023-05-04 09:08 ` Re: Just View create privilege to user user2 Erik Wienhold <ewie@ewie.name>
0 siblings, 2 replies; 5+ messages in thread
From: M Sarwar @ 2023-05-03 23:07 UTC (permalink / raw)
To: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Hi,
I have 2 users and 2 schemas in my database db1.
Users are u1 and u2.
Schemas are s1 and s2,
User u1 has full ( SELECT, CREATE, UPDATE, etc for tables/indexes/all objects) access from /to s1 schema.
user u2 has all SELECT on all tables of schema s1
I want user u2 to have only CREATE VIEW privilege in schema s2. I do not want u2 to create any other type of objects in s2 schema.
I am unable to find the command to grant just CREATE VIEW privilege to be granted to u2.
I will appreciate anu help on this.
Thanks,
Sarwar
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: Just View create privilege to user user2
2023-05-03 23:07 Just View create privilege to user user2 M Sarwar <sarwarmd02@outlook.com>
@ 2023-05-03 23:28 ` Tom Lane <tgl@sss.pgh.pa.us>
2023-05-03 23:38 ` Re: Just View create privilege to user user2 M Sarwar <sarwarmd02@outlook.com>
1 sibling, 1 reply; 5+ messages in thread
From: Tom Lane @ 2023-05-03 23:28 UTC (permalink / raw)
To: M Sarwar <sarwarmd02@outlook.com>; +Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
M Sarwar <sarwarmd02@outlook.com> writes:
> I want user u2 to have only CREATE VIEW privilege in schema s2. I do not want u2 to create any other type of objects in s2 schema.
> I am unable to find the command to grant just CREATE VIEW privilege to be granted to u2.
There is no such privilege, and we're quite unlikely to invent one,
because it would be outside the SQL standard's privilege model.
You could probably enforce a requirement like this with a custom
event trigger. But I'd encourage you to rethink why you think this
is a good idea.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: Just View create privilege to user user2
2023-05-03 23:07 Just View create privilege to user user2 M Sarwar <sarwarmd02@outlook.com>
2023-05-03 23:28 ` Re: Just View create privilege to user user2 Tom Lane <tgl@sss.pgh.pa.us>
@ 2023-05-03 23:38 ` M Sarwar <sarwarmd02@outlook.com>
0 siblings, 0 replies; 5+ messages in thread
From: M Sarwar @ 2023-05-03 23:38 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Hi Tom,
It is not just my idea. We have 1 such requirement now.
I am ready to think if that is going to help.
We need to provide limited access to a team which is outside of our core project team.
Can you point me to a sample trigger like which you mentioned?
Thanks,
Sarwar
________________________________
From: Tom Lane <tgl@sss.pgh.pa.us>
Sent: Wednesday, May 3, 2023 7:28 PM
To: M Sarwar <sarwarmd02@outlook.com>
Cc: pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Re: Just View create privilege to user user2
M Sarwar <sarwarmd02@outlook.com> writes:
> I want user u2 to have only CREATE VIEW privilege in schema s2. I do not want u2 to create any other type of objects in s2 schema.
> I am unable to find the command to grant just CREATE VIEW privilege to be granted to u2.
There is no such privilege, and we're quite unlikely to invent one,
because it would be outside the SQL standard's privilege model.
You could probably enforce a requirement like this with a custom
event trigger. But I'd encourage you to rethink why you think this
is a good idea.
regards, tom lane
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: Just View create privilege to user user2
2023-05-03 23:07 Just View create privilege to user user2 M Sarwar <sarwarmd02@outlook.com>
@ 2023-05-04 09:08 ` Erik Wienhold <ewie@ewie.name>
2023-05-04 13:21 ` Re: Just View create privilege to user user2 M Sarwar <sarwarmd02@outlook.com>
1 sibling, 1 reply; 5+ messages in thread
From: Erik Wienhold @ 2023-05-04 09:08 UTC (permalink / raw)
To: M Sarwar <sarwarmd02@outlook.com>; pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
> On 04/05/2023 01:07 CEST M Sarwar <sarwarmd02@outlook.com> wrote:
>
> I want user u2 to have only CREATE VIEW privilege in schema s2. I do not want
> u2 to create any other type of objects in s2 schema.
You can setup a second database db2 just for u2 and have them access your
database db1 via foreign tables. u2 still only has the SELECT privilege in db1
but can create objects in db2 and mess it up as they see fit.
If you go with a single database and event triggers as Tom wrote you must also
consider function security[0]. Otherwise u2 can override relations in s1 just
by creating compatible views in s2 and set search_path=s2,s1. u2 can thus
inject data into functions that have no explicit search_path.
[0] https://www.postgresql.org/docs/current/perm-functions.html
--
Erik
^ permalink raw reply [nested|flat] 5+ messages in thread
* Re: Just View create privilege to user user2
2023-05-03 23:07 Just View create privilege to user user2 M Sarwar <sarwarmd02@outlook.com>
2023-05-04 09:08 ` Re: Just View create privilege to user user2 Erik Wienhold <ewie@ewie.name>
@ 2023-05-04 13:21 ` M Sarwar <sarwarmd02@outlook.com>
0 siblings, 0 replies; 5+ messages in thread
From: M Sarwar @ 2023-05-04 13:21 UTC (permalink / raw)
To: Erik Wienhold <ewie@ewie.name>; pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Erik,
Instead of going thru second database db2 which is giving any object creation privilege, I may just stay with single databse db1 with second user u2 with full privilege in this schema s2. That way I do not need to provide additional resource of the database db2.
My idea is to not to give any privilege other than CREATE VIEWs to u2.
Thanks,
Sarwar
________________________________
From: Erik Wienhold <ewie@ewie.name>
Sent: Thursday, May 4, 2023 5:08 AM
To: M Sarwar <sarwarmd02@outlook.com>; pgsql-admin@lists.postgresql.org <pgsql-admin@lists.postgresql.org>
Subject: Re: Just View create privilege to user user2
> On 04/05/2023 01:07 CEST M Sarwar <sarwarmd02@outlook.com> wrote:
>
> I want user u2 to have only CREATE VIEW privilege in schema s2. I do not want
> u2 to create any other type of objects in s2 schema.
You can setup a second database db2 just for u2 and have them access your
database db1 via foreign tables. u2 still only has the SELECT privilege in db1
but can create objects in db2 and mess it up as they see fit.
If you go with a single database and event triggers as Tom wrote you must also
consider function security[0]. Otherwise u2 can override relations in s1 just
by creating compatible views in s2 and set search_path=s2,s1. u2 can thus
inject data into functions that have no explicit search_path.
[0] https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.postgresql.org%2Fdocs%2Fcurrent...;
--
Erik
^ permalink raw reply [nested|flat] 5+ messages in thread
end of thread, other threads:[~2023-05-04 13:21 UTC | newest]
Thread overview: 5+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2023-05-03 23:07 Just View create privilege to user user2 M Sarwar <sarwarmd02@outlook.com>
2023-05-03 23:28 ` Tom Lane <tgl@sss.pgh.pa.us>
2023-05-03 23:38 ` M Sarwar <sarwarmd02@outlook.com>
2023-05-04 09:08 ` Erik Wienhold <ewie@ewie.name>
2023-05-04 13:21 ` M Sarwar <sarwarmd02@outlook.com>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox