From: Bruce Momjian <bruce@momjian.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Michael Banck <mbanck@gmx.net>
Cc: David Burns <david.burns@fedex.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
Date: Mon, 6 Nov 2023 10:55:55 -0500
Message-ID: <ZUkMi9UhnfHyIQMf@momjian.us> (raw)
In-Reply-To: <ceac8e2df89a5eb1335ad8ce39c6ba0beaeddde3.camel@cybertec.at>
References: <a6671d5651e64fceff340c68dbdc41a9c5098748.camel@cybertec.at>
<653b841d.a70a0220.17f72.2c12@mx.google.com>
<7de5f33f49a91d7b30b8c01fe46fc280713ebae1.camel@cybertec.at>
<653cce08.050a0220.a10fb.7878@mx.google.com>
<ZUUlmpxzsZMSZ7N_@momjian.us>
<b227432f87266b680fd6f31e37b202b2fae5d9b6.camel@cybertec.at>
<ZUaLgyKdfWeh6nlj@momjian.us>
<244e0f9e3300f165ff578302e942fa3145dedfc7.camel@cybertec.at>
<ZUbsWcPypVORlYCg@momjian.us>
<ceac8e2df89a5eb1335ad8ce39c6ba0beaeddde3.camel@cybertec.at>
On Mon, Nov 6, 2023 at 09:44:14AM +0100, Laurenz Albe wrote:
> On Sat, 2023-11-04 at 21:14 -0400, Bruce Momjian wrote:
> > > It is not the role that is modified. Perhaps:
> > >
> > > [...]; if omitted, the current role is used.
> >
> > Sure, attached. Here is the issue I have though, we are really not
> > changing default privileges for objects created in the future, we are
> > changing the role _now_ so future objects will have different default
> > privileges, right? I think wording like the above is kind of odd.
>
> I see what you mean. The alternative is to be precise, at the risk of
> repeating ourselves:
>
> if omitted, default privileges will be changed for objects created by
> the current role.
Okay, I think I have good wording for this. I didn't like the wording
of other roles, so I restructured that in the attached patch too.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
Attachments:
[text/x-diff] role.diff (4.4K, ../ZUkMi9UhnfHyIQMf@momjian.us/2-role.diff)
download | inline diff:diff --git a/doc/src/sgml/ref/alter_default_privileges.sgml b/doc/src/sgml/ref/alter_default_privileges.sgmlnew file mode 100644index 8a60061..a868779
*** a/doc/src/sgml/ref/alter_default_privileges.sgml
--- b/doc/src/sgml/ref/alter_default_privileges.sgml
*************** REVOKE [ GRANT OPTION FOR ]
*** 90,112 ****
<para>
<command>ALTER DEFAULT PRIVILEGES</command> allows you to set the privileges
that will be applied to objects created in the future. (It does not
! affect privileges assigned to already-existing objects.) Currently,
! only the privileges for schemas, tables (including views and foreign
! tables), sequences, functions, and types (including domains) can be
! altered. For this command, functions include aggregates and procedures.
! The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are
! equivalent in this command. (<literal>ROUTINES</literal> is preferred
! going forward as the standard term for functions and procedures taken
! together. In earlier PostgreSQL releases, only the
! word <literal>FUNCTIONS</literal> was allowed. It is not possible to set
! default privileges for functions and procedures separately.)
</para>
<para>
! You can change default privileges only for objects that will be created by
! yourself or by roles that you are a member of. The privileges can be set
! globally (i.e., for all objects created in the current database),
! or just for objects created in specified schemas.
</para>
<para>
--- 90,113 ----
<para>
<command>ALTER DEFAULT PRIVILEGES</command> allows you to set the privileges
that will be applied to objects created in the future. (It does not
! affect privileges assigned to already-existing objects.) Privileges can be
! set globally (i.e., for all objects created in the current database), or
! just for objects created in specified schemas.
</para>
<para>
! Default privileges apply only to the active role; the default
! privileges of member roles have no affect on object permissions.
! <command>SET ROLE</command> can be used to change the active user and
! apply their default privileges.
! </para>
!
! <para>
! As a non-superuser, you can change your own default privileges and
! the defauls of roles that you are a member of. There is no way to
! set default privileges for a role and all its members with a single
! command; individual <command>ALTER DEFAULT PRIVILEGES</command>
! commands must be run to achieve this.
</para>
<para>
*************** REVOKE [ GRANT OPTION FOR ]
*** 119,124 ****
--- 120,138 ----
</para>
<para>
+ Currently,+ only the privileges for schemas, tables (including views and foreign+ tables), sequences, functions, and types (including domains) can be+ altered. For this command, functions include aggregates and procedures.+ The words <literal>FUNCTIONS</literal> and <literal>ROUTINES</literal> are+ equivalent in this command. (<literal>ROUTINES</literal> is preferred+ going forward as the standard term for functions and procedures taken+ together. In earlier PostgreSQL releases, only the+ word <literal>FUNCTIONS</literal> was allowed. It is not possible to set+ default privileges for functions and procedures separately.)+ </para>+ + <para>
Default privileges that are specified per-schema are added to whatever
the global default privileges are for the particular object type.
This means you cannot revoke privileges per-schema if they are granted
*************** REVOKE [ GRANT OPTION FOR ]
*** 136,147 ****
<term><replaceable>target_role</replaceable></term>
<listitem>
<para>
! The name of an existing role of which the current role is a member.
! Default access privileges are not inherited, so member roles
! must use <command>SET ROLE</command> to access these privileges,
! or <command>ALTER DEFAULT PRIVILEGES</command> must be run for
! each member role. If <literal>FOR ROLE</literal> is omitted,
! the current role is assumed.
</para>
</listitem>
</varlistentry>
--- 150,158 ----
<term><replaceable>target_role</replaceable></term>
<listitem>
<para>
! Change default privileges for objects created by the
! <replaceable>target_role</replaceable>, or the current
! role if unspecified.
</para>
</listitem>
</varlistentry>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: bruce@momjian.us, laurenz.albe@cybertec.at, mbanck@gmx.net, david.burns@fedex.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
In-Reply-To: <ZUkMi9UhnfHyIQMf@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox