public inbox for [email protected]
help / color / mirror / Atom feedFrom: Peter Eisentraut <[email protected]>
To: Robert Haas <[email protected]>
Cc: David G. Johnston <[email protected]>
Cc: Stephen Frost <[email protected]>
Cc: Joshua Brindle <[email protected]>
Cc: Mark Dilger <[email protected]>
Cc: Andrew Dunstan <[email protected]>
Cc: PostgreSQL-development <[email protected]>
Subject: Re: role self-revocation
Date: Thu, 10 Mar 2022 20:05:02 +0100
Message-ID: <[email protected]> (raw)
In-Reply-To: <CA+Tgmobbnro+Z-uFZCGr_y6wq8gANo8EaYSvcZK2kekDdtFaZA@mail.gmail.com>
References: <CAGB+Vh4Qb4+5zrJ2pJio6rxy2+hnt2zhTmonxgzfF3wY4H6WRw@mail.gmail.com>
<CA+Tgmob_rJtHdjMOqiOcGtk0vU6XXjOqQ0LSvVpUJjvdY341rw@mail.gmail.com>
<[email protected]>
<CA+TgmobNfJvG6keNU6YcykJnntDm_-BxN_5JDacakusr5E0hEg@mail.gmail.com>
<CAKFQuwb3=Zdp2-mEPWbTmktt3NLRNdprGi7=DqfG-pxpTQo43w@mail.gmail.com>
<CA+TgmoY9SLMEpCcVFw9gs-9_ihK+3T7P0_4zkMDfXk8DfvheYA@mail.gmail.com>
<CAKFQuwbmx9bSu6iob-k88APFZtzvPVmXFjAjdR0u3MqR3TWzzg@mail.gmail.com>
<CA+TgmobHD6zVgRnNrz-7=Wm6W-76Q4Qrrif4zmhk522G5ay9Fw@mail.gmail.com>
<[email protected]>
<CA+Tgmobbnro+Z-uFZCGr_y6wq8gANo8EaYSvcZK2kekDdtFaZA@mail.gmail.com>
On 09.03.22 14:02, Robert Haas wrote:
> On Wed, Mar 9, 2022 at 7:55 AM Peter Eisentraut
> <[email protected]> wrote:
>> Do we have subtractive permissions today?
>
> Not in the GRANT/REVOKE sense, I think, but you can put a user in a
> group and then mention that group in pg_hba.conf. And that line might
> be "reject" or whatever.
Well, you can always build an external system that looks at roles and
does nonsensical things with it. But the privilege system itself seems
to be additive only. Personally, I agree with the argument that there
should not be any subtractive permissions. The mental model where
permissions are sort of keys to doors or boxes just doesn't work for that.
view thread (37+ messages) latest in thread
reply
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: [email protected]
Cc: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Subject: Re: role self-revocation
In-Reply-To: <[email protected]>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by agora; see mirroring instructions
for how to clone and mirror all data and code used for this inbox