Message-ID: <55A480FE.1050302@2ndquadrant.com>
Date: Tue, 14 Jul 2015 12:24:46 +0900
From: Ian Barwick <ian@2ndquadrant.com>
User-Agent: Mozilla/5.0 (X11; Linux x86_64;
 rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: pgsql-docs@postgresql.org
Subject: Clarification for schema and schema object privileges
Content-Type: multipart/mixed; boundary="------------080909060805060605070605"
Precedence: bulk
Sender: pgsql-docs-owner@postgresql.org

This is a multi-part message in MIME format.
--------------080909060805060605070605
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Hi

One "gotcha" that crops up from time to time is that it's possible to grant
privileges on objects in a particular schema to a user other than the schema
owner, giving the impression that the user now has those privileges, but if usage on
the schema itself hasn't been granted, the privileges are of course
ineffective. I think it would be worth highlighting this in the documentation
as this seems easy to overlook; suggested patch attached.


Regards

Ian Barwick

-- 
 Ian Barwick                   http://www.2ndQuadrant.com/
 PostgreSQL Development, 24x7 Support, Training & Services

--------------080909060805060605070605
Content-Type: text/x-patch;
 name="doc-schema-privilege.patch"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="doc-schema-privilege.patch"

diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml
new file mode 100644
index 0aa0c13..c706374
*** a/doc/src/sgml/ddl.sgml
--- b/doc/src/sgml/ddl.sgml
*************** SELECT 3 OPERATOR(pg_catalog.+) 4;
*** 2108,2113 ****
--- 2108,2121 ----
      might need to be granted, as appropriate for the object.
     </para>
=20=20
+    <warning>
+     <para>
+      While it's possible to grant privileges on individual objects
+      within a schema to a user, these privileges will remain ineffective
+      until the <literal>USAGE</literal> privilege on the schema is grante=
d.
+     </para>
+    </warning>
+=20
     <para>
      A user can also be allowed to create objects in someone else's
      schema.  To allow that, the <literal>CREATE</literal> privilege on

--------------080909060805060605070605
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
MIME-Version: 1.0


-- 
Sent via pgsql-docs mailing list (pgsql-docs@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-docs

--------------080909060805060605070605--