From: Achilleas Mantzios <achill@matrix.gatewaynet.com>
To: pgsql-admin@lists.postgresql.org
Subject: Re: permission denied (even when run as postgres) for views after making their owner nosuperuser
Date: Fri, 26 Jan 2018 16:59:46 +0200
Message-ID: <3b4e1884-e2df-0152-e258-8adb984a2252@matrix.gatewaynet.com> (raw)
In-Reply-To: <CAKFQuwa9AVro05Qv_du+Nu23Z17nLLhhSYtY9H7pBfLgNm0AHg@mail.gmail.com>
References: <b09b3f84-2ffd-2861-161c-55c02158b340@matrix.gatewaynet.com>
<CAKFQuwa9AVro05Qv_du+Nu23Z17nLLhhSYtY9H7pBfLgNm0AHg@mail.gmail.com>
On 26/01/2018 16:42, David G. Johnston wrote:
> On Fri, Jan 26, 2018 at 7:32 AM, Achilleas Mantzios <achill@matrix.gatewaynet.com <mailto:achill@matrix.gatewaynet.com>>wrote:
>
> In fact, there is no way on earth I can regain access to view fuser.testforfu for any user (postgres included) unless I change its ownership (or make fuser a superuser).
>
> is this normal? documented? Am I missing anything?
>
>
> When dealing with views the owner of the view is performing all of the queries. So if you make the view owner lack permission to access the underlying tables the view isn't going to work no matter
> the permissions of the view caller.
Thanks a lot!
>
> Documented here:
>
> https://www.postgresql.org/docs/10/static/sql-createview.html
>
> "Access to tables referenced in the view is determined by permissions of the view owner."
>
> David J.
>
>
--
Achilleas Mantzios
IT DEV Lead
IT DEPT
Dynacom Tankers Mgmt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: achill@matrix.gatewaynet.com, pgsql-admin@lists.postgresql.org
Subject: Re: permission denied (even when run as postgres) for views after making their owner nosuperuser
In-Reply-To: <3b4e1884-e2df-0152-e258-8adb984a2252@matrix.gatewaynet.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox