pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedAdd remark about column privileges to clarify
2+ messages / 2 participants
[nested] [flat]
* Add remark about column privileges to clarify
@ 2012-02-09 23:22 Josh Berkus <josh@agliodbs.com>
2012-03-17 08:35 ` Re: Add remark about column privileges to clarify Peter Eisentraut <peter_e@gmx.net>
0 siblings, 1 reply; 2+ messages in thread
From: Josh Berkus @ 2012-02-09 23:22 UTC (permalink / raw)
To: pgsql-docs
All,
To avoid confusion, I think we should add the following sentence to
http://www.postgresql.org/docs/current/static/sql-revoke.html:
Current para:
"Note that any particular role will have the sum of privileges granted
directly to it, privileges granted to any role it is presently a member
of, and privileges granted to PUBLIC. Thus, for example, revoking SELECT
privilege from PUBLIC does not necessarily mean that all roles have lost
SELECT privilege on the object: those who have it granted directly or
via another role will still have it. Similarly, revoking SELECT from a
user might not prevent that user from using SELECT if PUBLIC or another
membership role still has SELECT rights."
Suggested improvement:
"Note that any particular role will have the sum of privileges granted
directly to it, privileges granted to any role it is presently a member
of, and privileges granted to PUBLIC. Thus, for example, revoking SELECT
privilege from PUBLIC does not necessarily mean that all roles have lost
SELECT privilege on the object: those who have it granted directly or
via another role will still have it. Similarly, revoking SELECT from a
user might not prevent that user from using SELECT if PUBLIC or another
membership role still has SELECT rights. Similarly, if a role has been
GRANTed privileges on an entire table, REVOKEing the same privileges
from individual columns will have no effect."
A quick poll of #postgresql revealed that most users, even folks who
have been using Postgres for years, are unclear on how REVOKEing
privileges on columns is supposed to work.
--
Josh Berkus
PostgreSQL Experts Inc.
http://pgexperts.com
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Add remark about column privileges to clarify
2012-02-09 23:22 Add remark about column privileges to clarify Josh Berkus <josh@agliodbs.com>
@ 2012-03-17 08:35 ` Peter Eisentraut <peter_e@gmx.net>
0 siblings, 0 replies; 2+ messages in thread
From: Peter Eisentraut @ 2012-03-17 08:35 UTC (permalink / raw)
To: Josh Berkus <josh@agliodbs.com>; +Cc: pgsql-docs
On tor, 2012-02-09 at 15:22 -0800, Josh Berkus wrote:
> To avoid confusion, I think we should add the following sentence to
> http://www.postgresql.org/docs/current/static/sql-revoke.html:
Added, with slight modification.
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2012-03-17 08:35 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2012-02-09 23:22 Add remark about column privileges to clarify Josh Berkus <josh@agliodbs.com>
2012-03-17 08:35 ` Peter Eisentraut <peter_e@gmx.net>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox