Received: from malur.postgresql.org ([217.196.149.56])
	by arkaria.postgresql.org with esmtp (Exim 4.84_2)
	(envelope-from
 <pgsql-docs-owner+M9152=pgsql+2Ddocs=arkaria.postgresql.org@postgresql.org>)
	id 1cq9ch-0003tZ-O6
	for pgsql-docs@arkaria.postgresql.org; Tue, 21 Mar 2017 02:34:11 +0000
Received: from localhost ([127.0.0.1] helo=postgresql.org)
	by malur.postgresql.org with smtp (Exim 4.84_2)
	(envelope-from
 <pgsql-docs-owner+M9152=pgsql+2Ddocs=arkaria.postgresql.org@postgresql.org>)
	id 1cq9ch-00052c-Ax
	for pgsql-docs@arkaria.postgresql.org; Tue, 21 Mar 2017 02:34:11 +0000
Received: from makus.postgresql.org ([2001:4800:1501:1::229])
	by malur.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA384:256)
	(Exim 4.84_2)
	(envelope-from <bruce@momjian.us>)
	id 1cq9cJ-000465-Nu
	for pgsql-docs@postgresql.org; Tue, 21 Mar 2017 02:33:47 +0000
Received: from momjian.us ([72.94.173.45])
	by makus.postgresql.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256)
	(Exim 4.84_2)
	(envelope-from <bruce@momjian.us>)
	id 1cq9cD-0001It-5p
	for pgsql-docs@postgresql.org; Tue, 21 Mar 2017 02:33:46 +0000
Received: from bruce by momjian.us with local (Exim 4.84_2)
	(envelope-from <bruce@momjian.us>)
	id 1cq9cC-0000mc-0W; Mon, 20 Mar 2017 22:33:40 -0400
Date: Mon, 20 Mar 2017 22:33:40 -0400
From: Bruce Momjian <bruce@momjian.us>
To: PostgreSQL-documentation <pgsql-docs@postgresql.org>
Cc: Nathan Wagner <nw@hydaspes.if.org>
Subject: Re: Fix for function ownership
Message-ID: <20170321023339.GC2045@momjian.us>
References: <20160924003102.GA20542@momjian.us>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20160924003102.GA20542@momjian.us>
User-Agent: Mutt/1.5.23 (2014-03-12)
X-Pg-Spam-Score: -1.9 (-)
List-Archive: <http://archives.postgresql.org/pgsql-docs>
List-Help: <mailto:majordomo@postgresql.org?body=help>
List-ID: <pgsql-docs.postgresql.org>
List-Owner: <mailto:pgsql-docs-owner@postgresql.org>
List-Post: <mailto:pgsql-docs@postgresql.org>
List-Subscribe: <mailto:majordomo@postgresql.org?body=sub%20pgsql-docs>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-docs>
X-Mailing-List: pgsql-docs
Precedence: bulk
Sender: pgsql-docs-owner@postgresql.org

On Fri, Sep 23, 2016 at 08:31:02PM -0400, Bruce Momjian wrote:
> Nathan Wagner told me that two places in the create function docs say
> permissions are controlled by the function creator, while permissions
> are really controlled by the function owner.
> 
> The attached patch fixes this.

Applied.

---------------------------------------------------------------------------


>  
> -- 
>   Bruce Momjian  <bruce@momjian.us>        http://momjian.us
>   EnterpriseDB                             http://enterprisedb.com
> 
> + As you are, so once was I. As I am, so you will be. +
> +                     Ancient Roman grave inscription +

> diff --git a/doc/src/sgml/ref/create_function.sgml b/doc/src/sgml/ref/create_function.sgml
> new file mode 100644
> index 8108a43..b9d8833
> *** a/doc/src/sgml/ref/create_function.sgml
> --- b/doc/src/sgml/ref/create_function.sgml
> *************** CREATE [ OR REPLACE ] FUNCTION
> *** 401,407 ****
>         is to be executed with the privileges of the user that calls it.
>         That is the default.  <literal>SECURITY DEFINER</literal>
>         specifies that the function is to be executed with the
> !       privileges of the user that created it.
>        </para>
>   
>        <para>
> --- 401,407 ----
>         is to be executed with the privileges of the user that calls it.
>         That is the default.  <literal>SECURITY DEFINER</literal>
>         specifies that the function is to be executed with the
> !       privileges of the user that owns it.
>        </para>
>   
>        <para>
> *************** SELECT * FROM dup(42);
> *** 747,753 ****
>   
>      <para>
>       Because a <literal>SECURITY DEFINER</literal> function is executed
> !     with the privileges of the user that created it, care is needed to
>       ensure that the function cannot be misused.  For security,
>       <xref linkend="guc-search-path"> should be set to exclude any schemas
>       writable by untrusted users.  This prevents
> --- 747,753 ----
>   
>      <para>
>       Because a <literal>SECURITY DEFINER</literal> function is executed
> !     with the privileges of the user that owns it, care is needed to
>       ensure that the function cannot be misused.  For security,
>       <xref linkend="guc-search-path"> should be set to exclude any schemas
>       writable by untrusted users.  This prevents

> 
> -- 
> Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-docs


-- 
  Bruce Momjian  <bruce@momjian.us>        http://momjian.us
  EnterpriseDB                             http://enterprisedb.com

+ As you are, so once was I.  As I am, so you will be. +
+                      Ancient Roman grave inscription +


-- 
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs