From: Bruce Momjian <bruce@momjian.us>
To: Laurenz Albe <laurenz.albe@cybertec.at>
Cc: Michael Banck <mbanck@gmx.net>
Cc: David Burns <david.burns@fedex.com>
Cc: pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
Date: Wed, 8 Nov 2023 12:42:02 -0500
Message-ID: <ZUvIauBmrx30E6XQ@momjian.us> (raw)
In-Reply-To: <d3dcd30164a4f86588d33013e3bd41d7f576f17f.camel@cybertec.at>
References: <ZUUlmpxzsZMSZ7N_@momjian.us>
<b227432f87266b680fd6f31e37b202b2fae5d9b6.camel@cybertec.at>
<ZUaLgyKdfWeh6nlj@momjian.us>
<244e0f9e3300f165ff578302e942fa3145dedfc7.camel@cybertec.at>
<ZUbsWcPypVORlYCg@momjian.us>
<ceac8e2df89a5eb1335ad8ce39c6ba0beaeddde3.camel@cybertec.at>
<ZUkMi9UhnfHyIQMf@momjian.us>
<06bdd234afabd3144ffaf8e95f42af0f3b38082e.camel@cybertec.at>
<ZUq6fAsQZsyUAySx@momjian.us>
<d3dcd30164a4f86588d33013e3bd41d7f576f17f.camel@cybertec.at>
On Wed, Nov 8, 2023 at 01:12:24PM +0100, Laurenz Albe wrote:
> On Tue, 2023-11-07 at 17:30 -0500, Bruce Momjian wrote:
> > You didn't seem to like my SET ROLE suggestion so I removed it.
>
> I thought that the information that you can use SET ROLE to assume
> the identity of another role is correct, but leads a bit too far
> in the manual page of ALTER DEFAULT PRIVILEGES.
Agreed, it was a stretch.
> > > + <para>
> > > + There is no way to change the default privileges for objects created by
> > > + arbitrary roles. You have run <command>ALTER DEFAULT PRIVILEGES</command>
> >
> > I find the above sentence odd. What is its purpose?
>
> I cannot count how many times I have seen the complaint "I have run ALTER DEFAULT
> PRIVILEGES, and now when some other user creates a table, the permissions are
> unchanged". People tend to think that if you omit FOR ROLE, the change applies to
> PUBLIC.
I agree we have to be clear, and this is complex, which is why we are
struggling. I feel we have to be clear about who is allowed to modify
which default privileges, and what default privileges are active during
object creation. I ended up basically saying you can modify the default
privileges of roles you are member of, but they don't apply at creation
time for your own role. I am open to better wording.
> Your improved documentation of "target_role" already covers that somewhat, so if
> you don't like the repetition, I'm alright with that. I just thought it might
> be worth stating it explicitly.
>
> I think your patch is fine and ready to go.
Thanks.
--
Bruce Momjian <bruce@momjian.us> https://momjian.us
EDB https://enterprisedb.com
Only you can decide what is important to you.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: bruce@momjian.us, laurenz.albe@cybertec.at, mbanck@gmx.net, david.burns@fedex.com, pgsql-hackers@lists.postgresql.org
Subject: Re: Version 14/15 documentation Section "Alter Default Privileges"
In-Reply-To: <ZUvIauBmrx30E6XQ@momjian.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox