From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Bruce Momjian <bruce@momjian.us>
Cc: Michael Banck <mbanck@gmx.net>
Cc: David Burns <david.burns@fedex.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
Date: Mon, 06 Nov 2023 21:53:50 +0100
Message-ID: <06bdd234afabd3144ffaf8e95f42af0f3b38082e.camel@cybertec.at> (raw)
In-Reply-To: <ZUkMi9UhnfHyIQMf@momjian.us>
References: <a6671d5651e64fceff340c68dbdc41a9c5098748.camel@cybertec.at>
<653b841d.a70a0220.17f72.2c12@mx.google.com>
<7de5f33f49a91d7b30b8c01fe46fc280713ebae1.camel@cybertec.at>
<653cce08.050a0220.a10fb.7878@mx.google.com>
<ZUUlmpxzsZMSZ7N_@momjian.us>
<b227432f87266b680fd6f31e37b202b2fae5d9b6.camel@cybertec.at>
<ZUaLgyKdfWeh6nlj@momjian.us>
<244e0f9e3300f165ff578302e942fa3145dedfc7.camel@cybertec.at>
<ZUbsWcPypVORlYCg@momjian.us>
<ceac8e2df89a5eb1335ad8ce39c6ba0beaeddde3.camel@cybertec.at>
<ZUkMi9UhnfHyIQMf@momjian.us>
On Mon, 2023-11-06 at 10:55 -0500, Bruce Momjian wrote:
> Okay, I think I have good wording for this. I didn't like the wording
> of other roles, so I restructured that in the attached patch too.
> <para>
> ! Default privileges apply only to the active role; the default
> ! privileges of member roles have no affect on object permissions.
> ! <command>SET ROLE</command> can be used to change the active user and
> ! apply their default privileges.
> ! </para>
You don't mean member roles, but roles that the active role is a member of,
right?
How do you like my version, as attached?
Yours,
Laurenz Albe
Attachments:
[text/x-patch] v3-0001-Improve-ALTER-DEFAULT-PRIVILEGES-documentation.patch (4.7K, ../06bdd234afabd3144ffaf8e95f42af0f3b38082e.camel@cybertec.at/2-v3-0001-Improve-ALTER-DEFAULT-PRIVILEGES-documentation.patch)
download | inline diff:
From eb251f000074ee10eff5cbd30ca9ee038a01b6f3 Mon Sep 17 00:00:00 2001
From: Laurenz Albe <laurenz.albe@cybertec.at>
Date: Mon, 6 Nov 2023 21:44:23 +0100
Subject: [PATCH] Improve ALTER DEFAULT PRIVILEGES documentation
Rewrite the documentation to emphasize two aspects that were
previously missing, which frequently confused users:
- you cannot inherit altered default privileges- you cannot alter the default privileges for any creating
role by omitting FOR ROLE
Author: Bruce Momjian, Laurenz Albe
Reviewed-by: Michael Banck
Discussion: https://postgr.es/m/LV2PR12MB5725F7C1B8EB2FC38829F276E7399%40LV2PR12MB5725.namprd12.prod.outlook.com
---
.../sgml/ref/alter_default_privileges.sgml | 52 ++++++++++++-------
1 file changed, 33 insertions(+), 19 deletions(-)
diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgmlindex f1d54f5aa3..7fab707a0d 100644--- a/doc/src/sgml/ref/alter_default_privileges.sgml+++ b/doc/src/sgml/ref/alter_default_privileges.sgml@@ -90,34 +90,47 @@ REVOKE [ GRANT OPTION FOR ]
<para>
<command>ALTER DEFAULT PRIVILEGES</command> allows you to set the privileges
that will be applied to objects created in the future. (It does not
- affect privileges assigned to already-existing objects.) Currently,- only the privileges for schemas, tables (including views and foreign- tables), sequences, functions, and types (including domains) can be- altered. For this command, functions include aggregates and procedures.- The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are- equivalent in this command. (<literal>ROUTINES</literal> is preferred- going forward as the standard term for functions and procedures taken- together. In earlier PostgreSQL releases, only the- word <literal>FUNCTIONS</literal> was allowed. It is not possible to set- default privileges for functions and procedures separately.)- </para>-- <para>- You can change default privileges only for objects that will be created by- yourself or by roles that you are a member of. The privileges can be set- globally (i.e., for all objects created in the current database),- or just for objects created in specified schemas.+ affect privileges assigned to already-existing objects.) Privileges can be+ set globally (i.e., for all objects created in the current database), or+ just for objects created in specified schemas.
</para>
<para>
As explained in <xref linkend="ddl-priv"/>,
the default privileges for any object type normally grant all grantable
permissions to the object owner, and may grant some privileges to
<literal>PUBLIC</literal> as well. However, this behavior can be changed by
altering the global default privileges with
<command>ALTER DEFAULT PRIVILEGES</command>.
</para>
+ <para>+ As a non-superuser, you can change default privileges only on objects created+ by yourself or by roles that you are a member of. However, you don't inherit+ altered default privileges from roles you are a member of; objects you create+ will receive the default privileges for your current role.+ </para>++ <para>+ There is no way to change the default privileges for objects created by+ arbitrary roles. You have run <command>ALTER DEFAULT PRIVILEGES</command>+ for any role that can create objects whose default privileges should be+ modified.+ </para>++ <para>+ Currently,+ only the privileges for schemas, tables (including views and foreign+ tables), sequences, functions, and types (including domains) can be+ altered. For this command, functions include aggregates and procedures.+ The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are+ equivalent in this command. (<literal>ROUTINES</literal> is preferred+ going forward as the standard term for functions and procedures taken+ together. In earlier PostgreSQL releases, only the+ word <literal>FUNCTIONS</literal> was allowed. It is not possible to set+ default privileges for functions and procedures separately.)+ </para>+
<para>
Default privileges that are specified per-schema are added to whatever
the global default privileges are for the particular object type.
@@ -136,8 +149,9 @@ REVOKE [ GRANT OPTION FOR ]
<term><replaceable>target_role</replaceable></term>
<listitem>
<para>
- The name of an existing role of which the current role is a member.- If <literal>FOR ROLE</literal> is omitted, the current role is assumed.+ Default privileges are changed for objects created by the+ <replaceable>target_role</replaceable>, or the current+ role if unspecified.
</para>
</listitem>
</varlistentry>
--
2.41.0
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: laurenz.albe@cybertec.at, bruce@momjian.us, mbanck@gmx.net, david.burns@fedex.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
In-Reply-To: <06bdd234afabd3144ffaf8e95f42af0f3b38082e.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox