From: Laurenz Albe <laurenz.albe@cybertec.at>
To: Jordi Gutiérrez Hermoso <jordigh@octave.org>
To: pgsql-docs@lists.postgresql.org
Subject: Re: Document target_role param of ALTER DEFAULT PRIVILEGES
Date: Thu, 18 Feb 2021 08:16:13 +0100
Message-ID: <293903c1f00f9b5053c0aa388ddc2850ae537f33.camel@cybertec.at> (raw)
In-Reply-To: <72652d72e1816bfc3c05d40f9e0e0373d07823c8.camel@octave.org>
References: <72652d72e1816bfc3c05d40f9e0e0373d07823c8.camel@octave.org>
On Wed, 2021-02-17 at 15:08 -0500, Jordi Gutiérrez Hermoso wrote:
> I just had a confusing moment trying to figure out why my roles
> weren't creating tables the way I was expecting them to. I didn't
> understand what the `target_role` parameter did. No matter how I try
> to read this page, I can't see an explanation for that parameter:
>
> https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
>
> I propose an explanation like the following be added to the
> `target_role` parameter:
>
> This is the role that will create objects with altered default
> privileges. Note that changes in default privileges aren't
> inherited, so altering the default privileges of created objects
> for a parent role will not change the default privileges of
> objects created by inherited roles.
+1. I cannot count the number of times I have seen people confused by that.
Suggested patch attached.
Yours,
Laurenz Albe
Attachments:
[text/x-patch] 0001-Clarify-docs-for-ALTER-DEFAULT-PRIVILEGES.patch (1.6K, ../293903c1f00f9b5053c0aa388ddc2850ae537f33.camel@cybertec.at/2-0001-Clarify-docs-for-ALTER-DEFAULT-PRIVILEGES.patch)
download | inline diff:
From 6ca7ad89b06c65d574a5e9da8192a14458863cb6 Mon Sep 17 00:00:00 2001
From: Laurenz Albe <laurenz.albe@cybertec.at>
Date: Thu, 18 Feb 2021 08:14:55 +0100
Subject: [PATCH] Clarify docs for ALTER DEFAULT PRIVILEGES
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Since this is often a cause of confusion, document that the
default privileges will only be applied to objects created
by the target role.
Suggested by Jordi Gutiérrez Hermoso.
Discussion: https://postgr.es/m/72652d72e1816bfc3c05d40f9e0e0373d07823c8.camel@octave.org
---
doc/src/sgml/ref/alter_default_privileges.sgml | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgmlindex f1d54f5aa3..048dbc9fe2 100644--- a/doc/src/sgml/ref/alter_default_privileges.sgml+++ b/doc/src/sgml/ref/alter_default_privileges.sgml@@ -138,6 +138,13 @@ REVOKE [ GRANT OPTION FOR ]
<para>
The name of an existing role of which the current role is a member.
If <literal>FOR ROLE</literal> is omitted, the current role is assumed.
++ The privileges defined in+ <replaceable class="parameter">abbreviated_grant_or_revoke</replaceable>+ will only be set on objects created by <replaceable>target_role</replaceable>.+ This does not extend to role members. If there are several roles that could+ create objects, you may have to run <command>ALTER DEFAULT PRIVILEGES</command>+ for each of them.
</para>
</listitem>
</varlistentry>
--
2.26.2
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: laurenz.albe@cybertec.at, jordigh@octave.org, pgsql-docs@lists.postgresql.org
Subject: Re: Document target_role param of ALTER DEFAULT PRIVILEGES
In-Reply-To: <293903c1f00f9b5053c0aa388ddc2850ae537f33.camel@cybertec.at>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox