Received: from localhost (unknown [200.46.208.211])
	by mail.postgresql.org (Postfix) with ESMTP id 7EF216333EF
	for <pgsql-hackers-postgresql.org@mail.postgresql.org>;
	Mon, 10 Aug 2009 18:28:54 -0300 (ADT)
Received: from mail.postgresql.org ([200.46.204.86])
	by localhost (mx1.hub.org [200.46.208.211]) (amavisd-maia, port 10024)
	with ESMTP id 24377-02
	for <pgsql-hackers-postgresql.org@mail.postgresql.org>;
	Mon, 10 Aug 2009 21:28:38 +0000 (UTC)
X-Greylist: from auto-whitelisted by SQLgrey-1.7.6
Received: from tamriel.snowman.net (tamriel.snowman.net [72.66.115.51])
	by mail.postgresql.org (Postfix) with ESMTP id D6EDD6333AC
	for <pgsql-hackers@postgresql.org>;
	Mon, 10 Aug 2009 18:28:43 -0300 (ADT)
Received: by tamriel.snowman.net (Postfix, from userid 1000)
	id 30B8E2229B; Mon, 10 Aug 2009 17:28:42 -0400 (EDT)
Date: Mon, 10 Aug 2009 17:28:42 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Josh Berkus <josh@agliodbs.com>
Cc: Heikki Linnakangas <heikki.linnakangas@enterprisedb.com>,
	Tom Lane <tgl@sss.pgh.pa.us>, Andrew Dunstan <andrew@dunslane.net>,
	Kevin Grittner <Kevin.Grittner@wicourts.gov>,
	Peter Eisentraut <peter_e@gmx.net>, pgsql-hackers@postgresql.org,
	Nikhil Sontakke <nikhil.sontakke@enterprisedb.com>,
	Robert Haas <robertmhaas@gmail.com>, Petr Jelinek <pjmodos@pjmodos.net>
Subject: Re: GRANT ON ALL IN schema
Message-ID: <20090810212842.GR23840@tamriel.snowman.net>
References: <4A37BF63.50008@pjmodos.net>
	<603c8f070908050951s3e5df452se4c610f01b80bb7d@mail.gmail.com>
	<21246.1249491592@sss.pgh.pa.us>
	<200908101042.35024.peter_e@gmx.net>
	<4A7FE7F902000025000296E3@gw.wicourts.gov>
	<4A803A89.9020509@dunslane.net> <3285.1249918596@sss.pgh.pa.us>
	<4A808A6C.9060602@enterprisedb.com> <4A808D44.7010600@agliodbs.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
	protocol="application/pgp-signature"; boundary="tTvAEuyWWbMF5UF4"
Content-Disposition: inline
In-Reply-To: <4A808D44.7010600@agliodbs.com>
X-Editor: Vim http://www.vim.org/
X-Info: http://www.snowman.net
X-Operating-System: Linux/2.6.26-1-amd64 (x86_64)
X-Uptime: 17:19:39 up 60 days, 18:46, 20 users,  load average: 0.08, 0.07,
 0.07
User-Agent: Mutt/1.5.18 (2008-05-17)
X-Virus-Scanned: Maia Mailguard 1.0.1
X-Spam-Status: No, hits=-1.352 tagged_above=-10 required=5 tests=AWL=1.247,
	BAYES_00=-2.599
X-Spam-Level: 
X-Archive-Number: 200908/853
X-Sequence-Number: 143496


--tTvAEuyWWbMF5UF4
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

* Josh Berkus (josh@agliodbs.com) wrote:
> I'm not agreeing, though, that we don't need a GRANT ALL/ALTER DEFAULT.
>  We still need that for the simplest cases so that novice-level users
> will use *some* access control.  But it would mean that we wouldn't need
> GRANT ALL/ALTER DEFAULT to support anything other than the simplest cases.

I agree with Josh.  That's also why I feel the schema or namespace-driven
grant/defaults make the most sense.  I feel like it's the most natural
and intuitive option.  Having a default for roles is a neat idea, but I
don't believe they'd be used much and would require having a precedence
or merging them, neither of which I like.

	Thanks,

		Stephen

--tTvAEuyWWbMF5UF4
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkqAkQoACgkQrzgMPqB3kigzywCdHj8D50ODAw8wSfnjKZK6dslk
o/MAnRFAk1r6tL/FYLO6tnh1NGWnHIYC
=uCH+
-----END PGP SIGNATURE-----

--tTvAEuyWWbMF5UF4--