From: Stephen Frost <sfrost@snowman.net>
To: Michael Banck <michael.banck@credativ.de>
Cc: gkokolatos@pm.me, Anastasia Lubennikova <a.lubennikova@postgrespro.ru>
Cc: pgsql-hackers@lists.postgresql.org <pgsql-hackers@lists.postgresql.org>
Subject: Re: New predefined roles- 'pg_read/write_all_data'
Date: Fri, 27 Aug 2021 18:33:33 -0400
Message-ID: <20210827223333.GW17906@tamriel.snowman.net> (raw)
In-Reply-To: <606d8b1c.1c69fb81.3df04.1a99@mx.google.com>
References: <20200828003023.GU29590@tamriel.snowman.net>
<159895771273.18329.10477215354702372718.pgcf@coridan.postgresql.org>
<160397087449.1204.5186411958611164965.pgcf@coridan.postgresql.org>
<20201029141959.GK16415@tamriel.snowman.net>
<5a3e197e-3f6c-50e4-9774-c6b82b7151f1@postgrespro.ru>
<20201123223147.GQ16415@tamriel.snowman.net>
<4GHYHFHb6AQyOjxMZ47he7YvJSBAkZr968U31kr8a2GLlNFyXRH_-DJAjcL2Xh6jJ3TumkX44XkoeG3Utj5u8UA4thBUt9m87tv8WIDNoCg=@pm.me>
<20210401200006.GV20766@tamriel.snowman.net>
<606d8b1c.1c69fb81.3df04.1a99@mx.google.com>
Greetings,
* Michael Banck (michael.banck@credativ.de) wrote:
> On Thu, Apr 01, 2021 at 04:00:06PM -0400, Stephen Frost wrote:
> > diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml
> > index d171b13236..fe0bdb7599 100644
> > --- a/doc/src/sgml/user-manag.sgml
> > +++ b/doc/src/sgml/user-manag.sgml
> > @@ -518,6 +518,24 @@ DROP ROLE doomed_role;
> > </row>
> > </thead>
> > <tbody>
> > + <row>
> > + <entry>pg_read_all_data</entry>
> > + <entry>Read all data (tables, views, sequences), as if having SELECT
> > + rights on those objects, and USAGE rights on all schemas, even without
> > + having it explicitly. This role does not have the role attribute
> > + <literal>BYPASSRLS</literal> set. If RLS is being used, an administrator
> > + may wish to set <literal>BYPASSRLS</literal> on roles which this role is
> > + GRANTed to.</entry>
> > + </row>
> > + <row>
> > + <entry>pg_write_all_data</entry>
> > + <entry>Write all data (tables, views, sequences), as if having INSERT,
> > + UPDATE, and DELETE rights on those objects, and USAGE rights on all
> > + schemas, even without having it explicitly. This role does not have the
> > + role attribute <literal>BYPASSRLS</literal> set. If RLS is being used,
> > + an administrator may wish to set <literal>BYPASSRLS</literal> on roles
> > + which this role is GRANTed to.</entry>
> > + </row>
>
> Shouldn't those "SELECT", "INSERT" etc. be wrapped in <command> tags?
Yeah, good point, fixed.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, michael.banck@credativ.de, a.lubennikova@postgrespro.ru, pgsql-hackers@lists.postgresql.org
Subject: Re: New predefined roles- 'pg_read/write_all_data'
In-Reply-To: <20210827223333.GW17906@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox