From: Tom Lane <tgl@sss.pgh.pa.us>
To: David Underhill <dound07@gmail.com>
Cc: pgsql-admin@postgresql.org
Subject: Re: FOR SHARE permissions
Date: Sun, 12 Dec 2010 11:11:19 -0500
Message-ID: <4447.1292170279@sss.pgh.pa.us> (raw)
In-Reply-To: <AANLkTinbdL8RYpv=o+ThMHo23KL-vhDuAbEWx-3oncXH@mail.gmail.com>
References: <AANLkTinbdL8RYpv=o+ThMHo23KL-vhDuAbEWx-3oncXH@mail.gmail.com>
David Underhill <dound07@gmail.com> writes:
> I have two tables. One has a foreign key referencing a serial field in the
> other table. I've given INSERT privilege to a role other than the owner,
> but I still can't insert into the table containing the foreign key unless I
> grant the *owner* of the table UPDATE privilege on the table containing the
> referenced field.
> I don't quite understand why the *owner* needs to have UPDATE permission in
> order for another distinct role (with INSERT privilege) to be able to insert
> a row in this case.
The owner is the one who established the foreign key reference. That
reference is no concern of the third-party user who's been given insert
permission on the referencing table. The design you seem to have in
mind would make management of permissions a lot more complicated, since
instead of just granting insert permission to the third party, you'd
have to think about all the subsidiary permissions that might be needed
to deal with the table's FK linkages.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: tgl@sss.pgh.pa.us, dound07@gmail.com
Subject: Re: FOR SHARE permissions
In-Reply-To: <4447.1292170279@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox