From: Fujii Masao <masao.fujii@oss.nttdata.com>
To: Amit Langote <amitlangote09@gmail.com>
To: Fujii Masao <masao.fujii@gmail.com>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: table partitioning and access privileges
Date: Thu, 23 Jan 2020 22:14:48 +0900
Message-ID: <3546b691-b744-12c9-fd2f-7dc31c3c030e@oss.nttdata.com> (raw)
In-Reply-To: <CA+HiwqF55uZK6znXq7=qP-LS5HQkcjGEvCHxGUjYhJGq=z9nDg@mail.gmail.com>
References: <CAHGQGwFHdSvifhJE+-GSNqUHSfbiKxaeQQ7HGcYz6SC2n_oDcg@mail.gmail.com>
<6218.1577388354@sss.pgh.pa.us>
<CA+HiwqGCQLKizA+Voyw3GjRv0q8t9adS2YFGmw6GzAbRb+yazg@mail.gmail.com>
<CAHGQGwE+GauyG7POtRfRwwthAGwTjPQYdFHR97+LzA4RHGnJxA@mail.gmail.com>
<CA+HiwqF55uZK6znXq7=qP-LS5HQkcjGEvCHxGUjYhJGq=z9nDg@mail.gmail.com>
On 2020/01/22 16:54, Amit Langote wrote:
> Fujii-san,
>
> Thanks for taking a look.
>
> On Fri, Jan 10, 2020 at 10:29 AM Fujii Masao <masao.fujii@gmail.com> wrote:
>> On Tue, Jan 7, 2020 at 5:15 PM Amit Langote <amitlangote09@gmail.com> wrote:
>>> I tend to agree that TRUNCATE's permission model for inheritance
>>> should be consistent with that for the other commands. How about the
>>> attached patch toward that end?
>>
>> Thanks for the patch!
>>
>> The patch basically looks good to me.
>>
>> +GRANT SELECT (f1, fz), UPDATE (fz) ON atestc TO regress_priv_user2;
>> +REVOKE TRUNCATE ON atestc FROM regress_priv_user2;
>>
>> These seem not to be necessary for the test.
>
> You're right. Removed in the attached updated patch.
Thanks for updating the patch! Barring any objection,
I will commit this fix and backport it to all supported versions.
>> BTW, I found that LOCK TABLE on the parent table checks the permission
>> of its child tables. This also needs to be fixed (as a separate patch)?
>
> Commit ac33c7e2c13 and a past discussion ([1], [2], resp.) appear to
> disagree with that position, but I would like to agree with you
> because the behavior you suggest would be consistent with other
> commands. So, I'm attaching a patch for that too, although it would
> be better to hear more opinions before accepting it.
Yes. I'd like to hear more opinion about this. But
since the document explains "Inherited queries perform access
permission checks on the parent table only." in ddl.sgml,
that also seems a bug to fix...
Regards,
--
Fujii Masao
NTT DATA CORPORATION
Advanced Platform Technology Group
Research and Development Headquarters
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: masao.fujii@oss.nttdata.com, amitlangote09@gmail.com, masao.fujii@gmail.com, tgl@sss.pgh.pa.us
Subject: Re: table partitioning and access privileges
In-Reply-To: <3546b691-b744-12c9-fd2f-7dc31c3c030e@oss.nttdata.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox