From: Bruce Momjian <bruce@momjian.us>
To: Michael Banck <mbanck@gmx.net>
Cc: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: David Burns <david.burns@fedex.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
Date: Fri, 3 Nov 2023 12:53:46 -0400
Message-ID: <ZUUlmpxzsZMSZ7N_@momjian.us> (raw)
In-Reply-To: <653cce08.050a0220.a10fb.7878@mx.google.com>
References: <LV2PR12MB5725F7C1B8EB2FC38829F276E7399@LV2PR12MB5725.namprd12.prod.outlook.com>
<4a6f157edc4ae38a2050a5893e6729cbb98113bc.camel@cybertec.at>
<f898e097dbe5e718ec1a6e977d4dda79a6548abb.camel@cybertec.at>
<a6671d5651e64fceff340c68dbdc41a9c5098748.camel@cybertec.at>
<653b841d.a70a0220.17f72.2c12@mx.google.com>
<7de5f33f49a91d7b30b8c01fe46fc280713ebae1.camel@cybertec.at>
<653cce08.050a0220.a10fb.7878@mx.google.com>
On Sat, Oct 28, 2023 at 11:01:59AM +0200, Michael Banck wrote:
> On Fri, Oct 27, 2023 at 05:49:42PM +0200, Laurenz Albe wrote:
> > True. I have done that in the attached patch.
> > In this patch, it is mentioned *twice* that ALTER DEFAULT PRIVILEGES
> > only affects objects created by the current user. I thought that
> > would not harm, but if it is too redundant, I can remove the second
> > mention.
>
> I think it is fine, and I have marked the patch as ready-for-committer.
>
> I think it should be applied to all branches, not just 14/15 as
> mentioned in the subject.
I have developed the attached patch on top of the alter default patch I
just applied. It is more radical, making FOR ROLE clearer, and also
moving my new FOR ROLE text up to the first paragraph, and reordering
the paragraphs to be clearer.
I think this is too radical for backpatch to 11/12, but I think
16/master makes sense after the minor releases next week.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
Attachments:
[text/x-diff] role.diff (3.7K, ../ZUUlmpxzsZMSZ7N_@momjian.us/2-role.diff)
download | inline diff:diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgmlindex 8a6006188d..43fd2c3888 100644--- a/doc/src/sgml/ref/alter_default_privileges.sgml+++ b/doc/src/sgml/ref/alter_default_privileges.sgml@@ -90,23 +90,14 @@ REVOKE [ GRANT OPTION FOR ]
<para>
<command>ALTER DEFAULT PRIVILEGES</command> allows you to set the privileges
that will be applied to objects created in the future. (It does not
- affect privileges assigned to already-existing objects.) Currently,- only the privileges for schemas, tables (including views and foreign- tables), sequences, functions, and types (including domains) can be- altered. For this command, functions include aggregates and procedures.- The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are- equivalent in this command. (<literal>ROUTINES</literal> is preferred- going forward as the standard term for functions and procedures taken- together. In earlier PostgreSQL releases, only the- word <literal>FUNCTIONS</literal> was allowed. It is not possible to set- default privileges for functions and procedures separately.)- </para>-- <para>- You can change default privileges only for objects that will be created by- yourself or by roles that you are a member of. The privileges can be set- globally (i.e., for all objects created in the current database),- or just for objects created in specified schemas.+ affect privileges assigned to already-existing objects.) + As a non-superuser, you can change default privileges only for yourself+ and for roles that you are a member of. These privileges are not+ inherited, so member roles must use <command>SET ROLE</command> to+ access these privileges, or <command>ALTER DEFAULT PRIVILEGES</command>+ must be run for each member role. Privileges can be set globally+ (i.e., for all objects created in the current database), or just for+ objects created in specified schemas.
</para>
<para>
@@ -118,6 +109,19 @@ REVOKE [ GRANT OPTION FOR ]
<command>ALTER DEFAULT PRIVILEGES</command>.
</para>
+ <para>+ Currently,+ only the privileges for schemas, tables (including views and foreign+ tables), sequences, functions, and types (including domains) can be+ altered. For this command, functions include aggregates and procedures.+ The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are+ equivalent in this command. (<literal>ROUTINES</literal> is preferred+ going forward as the standard term for functions and procedures taken+ together. In earlier PostgreSQL releases, only the+ word <literal>FUNCTIONS</literal> was allowed. It is not possible to set+ default privileges for functions and procedures separately.)+ </para>+
<para>
Default privileges that are specified per-schema are added to whatever
the global default privileges are for the particular object type.
@@ -136,12 +140,9 @@ REVOKE [ GRANT OPTION FOR ]
<term><replaceable>target_role</replaceable></term>
<listitem>
<para>
- The name of an existing role of which the current role is a member.- Default access privileges are not inherited, so member roles- must use <command>SET ROLE</command> to access these privileges,- or <command>ALTER DEFAULT PRIVILEGES</command> must be run for- each member role. If <literal>FOR ROLE</literal> is omitted,- the current role is assumed.+ If <literal>FOR ROLE</literal> is specified, this is the role that+ will be assigned the new default privileges, or the current role+ if not specified.
</para>
</listitem>
</varlistentry>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: bruce@momjian.us, mbanck@gmx.net, laurenz.albe@cybertec.at, david.burns@fedex.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
In-Reply-To: <ZUUlmpxzsZMSZ7N_@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox