pg.ddx.io pgsql-docs@postgresql.org mailing list archive
help / color / mirror / Atom feedDocument target_role param of ALTER DEFAULT PRIVILEGES
7+ messages / 3 participants
[nested] [flat]
* Document target_role param of ALTER DEFAULT PRIVILEGES
@ 2021-02-17 20:08 Jordi Gutiérrez Hermoso <jordigh@octave.org>
0 siblings, 1 reply; 7+ messages in thread
From: Jordi Gutiérrez Hermoso @ 2021-02-17 20:08 UTC (permalink / raw)
To: pgsql-docs@lists.postgresql.org
I just had a confusing moment trying to figure out why my roles
weren't creating tables the way I was expecting them to. I didn't
understand what the `target_role` parameter did. No matter how I try
to read this page, I can't see an explanation for that parameter:
https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
I propose an explanation like the following be added to the
`target_role` parameter:
This is the role that will create objects with altered default
privileges. Note that changes in default privileges aren't
inherited, so altering the default privileges of created objects
for a parent role will not change the default privileges of
objects created by inherited roles.
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Document target_role param of ALTER DEFAULT PRIVILEGES
@ 2021-02-18 07:16 Laurenz Albe <laurenz.albe@cybertec.at>
parent: Jordi Gutiérrez Hermoso <jordigh@octave.org>
0 siblings, 1 reply; 7+ messages in thread
From: Laurenz Albe @ 2021-02-18 07:16 UTC (permalink / raw)
To: Jordi Gutiérrez Hermoso <jordigh@octave.org>; pgsql-docs@lists.postgresql.org
On Wed, 2021-02-17 at 15:08 -0500, Jordi Gutiérrez Hermoso wrote:
> I just had a confusing moment trying to figure out why my roles
> weren't creating tables the way I was expecting them to. I didn't
> understand what the `target_role` parameter did. No matter how I try
> to read this page, I can't see an explanation for that parameter:
>
> https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
>
> I propose an explanation like the following be added to the
> `target_role` parameter:
>
> This is the role that will create objects with altered default
> privileges. Note that changes in default privileges aren't
> inherited, so altering the default privileges of created objects
> for a parent role will not change the default privileges of
> objects created by inherited roles.
+1. I cannot count the number of times I have seen people confused by that.
Suggested patch attached.
Yours,
Laurenz Albe
Attachments:
[text/x-patch] 0001-Clarify-docs-for-ALTER-DEFAULT-PRIVILEGES.patch (1.6K, ../../293903c1f00f9b5053c0aa388ddc2850ae537f33.camel@cybertec.at/2-0001-Clarify-docs-for-ALTER-DEFAULT-PRIVILEGES.patch)
download | inline diff:
From 6ca7ad89b06c65d574a5e9da8192a14458863cb6 Mon Sep 17 00:00:00 2001
From: Laurenz Albe <laurenz.albe@cybertec.at>
Date: Thu, 18 Feb 2021 08:14:55 +0100
Subject: [PATCH] Clarify docs for ALTER DEFAULT PRIVILEGES
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
Since this is often a cause of confusion, document that the
default privileges will only be applied to objects created
by the target role.
Suggested by Jordi Gutiérrez Hermoso.
Discussion: https://postgr.es/m/72652d72e1816bfc3c05d40f9e0e0373d07823c8.camel@octave.org
---
doc/src/sgml/ref/alter_default_privileges.sgml | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgml
index f1d54f5aa3..048dbc9fe2 100644
--- a/doc/src/sgml/ref/alter_default_privileges.sgml
+++ b/doc/src/sgml/ref/alter_default_privileges.sgml
@@ -138,6 +138,13 @@ REVOKE [ GRANT OPTION FOR ]
<para>
The name of an existing role of which the current role is a member.
If <literal>FOR ROLE</literal> is omitted, the current role is assumed.
+
+ The privileges defined in
+ <replaceable class="parameter">abbreviated_grant_or_revoke</replaceable>
+ will only be set on objects created by <replaceable>target_role</replaceable>.
+ This does not extend to role members. If there are several roles that could
+ create objects, you may have to run <command>ALTER DEFAULT PRIVILEGES</command>
+ for each of them.
</para>
</listitem>
</varlistentry>
--
2.26.2
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Document target_role param of ALTER DEFAULT PRIVILEGES
@ 2023-11-01 17:09 Bruce Momjian <bruce@momjian.us>
parent: Laurenz Albe <laurenz.albe@cybertec.at>
0 siblings, 1 reply; 7+ messages in thread
From: Bruce Momjian @ 2023-11-01 17:09 UTC (permalink / raw)
To: Laurenz Albe <laurenz.albe@cybertec.at>; +Cc: Jordi Gutiérrez Hermoso <jordigh@octave.org>; pgsql-docs@lists.postgresql.org
On Thu, Feb 18, 2021 at 08:16:13AM +0100, Laurenz Albe wrote:
> On Wed, 2021-02-17 at 15:08 -0500, Jordi Gutiérrez Hermoso wrote:
> > I just had a confusing moment trying to figure out why my roles
> > weren't creating tables the way I was expecting them to. I didn't
> > understand what the `target_role` parameter did. No matter how I try
> > to read this page, I can't see an explanation for that parameter:
> >
> > https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
> >
> > I propose an explanation like the following be added to the
> > `target_role` parameter:
> >
> > This is the role that will create objects with altered default
> > privileges. Note that changes in default privileges aren't
> > inherited, so altering the default privileges of created objects
> > for a parent role will not change the default privileges of
> > objects created by inherited roles.
>
> +1. I cannot count the number of times I have seen people confused by that.
>
> Suggested patch attached.
I see how people can be confused. I wrote this patch, which I think is
simpler than the previously posted one.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
Attachments:
[text/x-diff] role.diff (848B, ../../ZUKGZ4BSL0p3Pn4p@momjian.us/2-role.diff)
download | inline diff:
diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgml
index f1d54f5aa3..8a6006188d 100644
--- a/doc/src/sgml/ref/alter_default_privileges.sgml
+++ b/doc/src/sgml/ref/alter_default_privileges.sgml
@@ -137,7 +137,11 @@ REVOKE [ GRANT OPTION FOR ]
<listitem>
<para>
The name of an existing role of which the current role is a member.
- If <literal>FOR ROLE</literal> is omitted, the current role is assumed.
+ Default access privileges are not inherited, so member roles
+ must use <command>SET ROLE</command> to access these privileges,
+ or <command>ALTER DEFAULT PRIVILEGES</command> must be run for
+ each member role. If <literal>FOR ROLE</literal> is omitted,
+ the current role is assumed.
</para>
</listitem>
</varlistentry>
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Document target_role param of ALTER DEFAULT PRIVILEGES
@ 2023-11-01 20:31 Laurenz Albe <laurenz.albe@cybertec.at>
parent: Bruce Momjian <bruce@momjian.us>
0 siblings, 1 reply; 7+ messages in thread
From: Laurenz Albe @ 2023-11-01 20:31 UTC (permalink / raw)
To: Bruce Momjian <bruce@momjian.us>; +Cc: Jordi Gutiérrez Hermoso <jordigh@octave.org>; pgsql-docs@lists.postgresql.org
On Wed, 2023-11-01 at 13:09 -0400, Bruce Momjian wrote:
> On Thu, Feb 18, 2021 at 08:16:13AM +0100, Laurenz Albe wrote:
> > On Wed, 2021-02-17 at 15:08 -0500, Jordi Gutiérrez Hermoso wrote:
> > > I just had a confusing moment trying to figure out why my roles
> > > weren't creating tables the way I was expecting them to. I didn't
> > > understand what the `target_role` parameter did. No matter how I try
> > > to read this page, I can't see an explanation for that parameter:
> > >
> > > https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
> > >
> > > I propose an explanation like the following be added to the
> > > `target_role` parameter:
> > >
> > > This is the role that will create objects with altered default
> > > privileges. Note that changes in default privileges aren't
> > > inherited, so altering the default privileges of created objects
> > > for a parent role will not change the default privileges of
> > > objects created by inherited roles.
> >
> > +1. I cannot count the number of times I have seen people confused by that.
> >
> > Suggested patch attached.
>
> I see how people can be confused. I wrote this patch, which I think is
> simpler than the previously posted one.
Oh, I had forgotten about this patch. I like your version better.
There is another patch in the current commitfest that addresses a similar
problem, triggered by another complaint:
https://commitfest.postgresql.org/45/4633/
That patch does not cover role membership. Perhaps you could adopt that
patch and merge the information from your patch into it.
Yours,
Laurenz Albe
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Document target_role param of ALTER DEFAULT PRIVILEGES
@ 2023-11-03 01:51 Bruce Momjian <bruce@momjian.us>
parent: Laurenz Albe <laurenz.albe@cybertec.at>
0 siblings, 1 reply; 7+ messages in thread
From: Bruce Momjian @ 2023-11-03 01:51 UTC (permalink / raw)
To: Laurenz Albe <laurenz.albe@cybertec.at>; +Cc: Jordi Gutiérrez Hermoso <jordigh@octave.org>; pgsql-docs@lists.postgresql.org
On Wed, Nov 1, 2023 at 09:31:52PM +0100, Laurenz Albe wrote:
> On Wed, 2023-11-01 at 13:09 -0400, Bruce Momjian wrote:
> > On Thu, Feb 18, 2021 at 08:16:13AM +0100, Laurenz Albe wrote:
> > > On Wed, 2021-02-17 at 15:08 -0500, Jordi Gutiérrez Hermoso wrote:
> > > > I just had a confusing moment trying to figure out why my roles
> > > > weren't creating tables the way I was expecting them to. I didn't
> > > > understand what the `target_role` parameter did. No matter how I try
> > > > to read this page, I can't see an explanation for that parameter:
> > > >
> > > > https://www.postgresql.org/docs/current/sql-alterdefaultprivileges.html
> > > >
> > > > I propose an explanation like the following be added to the
> > > > `target_role` parameter:
> > > >
> > > > This is the role that will create objects with altered default
> > > > privileges. Note that changes in default privileges aren't
> > > > inherited, so altering the default privileges of created objects
> > > > for a parent role will not change the default privileges of
> > > > objects created by inherited roles.
> > >
> > > +1. I cannot count the number of times I have seen people confused by that.
> > >
> > > Suggested patch attached.
> >
> > I see how people can be confused. I wrote this patch, which I think is
> > simpler than the previously posted one.
>
> Oh, I had forgotten about this patch. I like your version better.
>
> There is another patch in the current commitfest that addresses a similar
> problem, triggered by another complaint:
> https://commitfest.postgresql.org/45/4633/
>
> That patch does not cover role membership. Perhaps you could adopt that
> patch and merge the information from your patch into it.
Agreed. I found this doc report from 2020 with the same confusion about
what target_role means:
https://www.postgresql.org/message-id/flat/160003085417.31338.6391977653235501273%40wrigleys.postgre...
I will apply my patch tomorrow/Friday and then work on the commitfest
one.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Document target_role param of ALTER DEFAULT PRIVILEGES
@ 2023-11-03 13:53 Bruce Momjian <bruce@momjian.us>
parent: Bruce Momjian <bruce@momjian.us>
0 siblings, 1 reply; 7+ messages in thread
From: Bruce Momjian @ 2023-11-03 13:53 UTC (permalink / raw)
To: Laurenz Albe <laurenz.albe@cybertec.at>; +Cc: Jordi Gutiérrez Hermoso <jordigh@octave.org>; pgsql-docs@lists.postgresql.org
On Thu, Nov 2, 2023 at 09:51:58PM -0400, Bruce Momjian wrote:
> On Wed, Nov 1, 2023 at 09:31:52PM +0100, Laurenz Albe wrote:
> > There is another patch in the current commitfest that addresses a similar
> > problem, triggered by another complaint:
> > https://commitfest.postgresql.org/45/4633/
> >
> > That patch does not cover role membership. Perhaps you could adopt that
> > patch and merge the information from your patch into it.
>
> Agreed. I found this doc report from 2020 with the same confusion about
> what target_role means:
>
> https://www.postgresql.org/message-id/flat/160003085417.31338.6391977653235501273%40wrigleys.postgre...
>
> I will apply my patch tomorrow/Friday and then work on the commitfest
> one.
Okay, patch applied to all supported version. I will now work on the
similar commitfest item.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
^ permalink raw reply [nested|flat] 7+ messages in thread
* Re: Document target_role param of ALTER DEFAULT PRIVILEGES
@ 2023-11-03 15:23 Laurenz Albe <laurenz.albe@cybertec.at>
parent: Bruce Momjian <bruce@momjian.us>
0 siblings, 0 replies; 7+ messages in thread
From: Laurenz Albe @ 2023-11-03 15:23 UTC (permalink / raw)
To: Bruce Momjian <bruce@momjian.us>; +Cc: Jordi Gutiérrez Hermoso <jordigh@octave.org>; pgsql-docs@lists.postgresql.org
On Fri, 2023-11-03 at 09:53 -0400, Bruce Momjian wrote:
> On Thu, Nov 2, 2023 at 09:51:58PM -0400, Bruce Momjian wrote:
> > On Wed, Nov 1, 2023 at 09:31:52PM +0100, Laurenz Albe wrote:
> > > There is another patch in the current commitfest that addresses a similar
> > > problem, triggered by another complaint:
> > > https://commitfest.postgresql.org/45/4633/
> > >
> > > That patch does not cover role membership. Perhaps you could adopt that
> > > patch and merge the information from your patch into it.
> >
> > Agreed. I found this doc report from 2020 with the same confusion about
> > what target_role means:
> >
> > https://www.postgresql.org/message-id/flat/160003085417.31338.6391977653235501273%40wrigleys.postgre...
> >
> > I will apply my patch tomorrow/Friday and then work on the commitfest
> > one.
>
> Okay, patch applied to all supported version. I will now work on the
> similar commitfest item.
Thanks!
Laurenz Albe
^ permalink raw reply [nested|flat] 7+ messages in thread
end of thread, other threads:[~2023-11-03 15:23 UTC | newest]
Thread overview: 7+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2021-02-17 20:08 Document target_role param of ALTER DEFAULT PRIVILEGES Jordi Gutiérrez Hermoso <jordigh@octave.org>
2021-02-18 07:16 ` Laurenz Albe <laurenz.albe@cybertec.at>
2023-11-01 17:09 ` Bruce Momjian <bruce@momjian.us>
2023-11-01 20:31 ` Laurenz Albe <laurenz.albe@cybertec.at>
2023-11-03 01:51 ` Bruce Momjian <bruce@momjian.us>
2023-11-03 13:53 ` Bruce Momjian <bruce@momjian.us>
2023-11-03 15:23 ` Laurenz Albe <laurenz.albe@cybertec.at>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox