From: Petr Jelinek <pjmodos@pjmodos.net>
To: Stephen Frost <sfrost@snowman.net>
Cc: Andrew Dunstan <andrew@dunslane.net>
Cc: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Nikhil Sontakke <nikhil.sontakke@enterprisedb.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: GRANT ON ALL IN schema
Date: Sat, 08 Aug 2009 04:17:01 +0200
Message-ID: <4A7CE01D.7060604@pjmodos.net> (raw)
In-Reply-To: <4A7C77B9.1050008@pjmodos.net>
References: <4A38A956.8080600@pjmodos.net>
<4A4DE104.8090605@pjmodos.net>
<a301bfd90907170254re7dd52es9fedb007376d8055@mail.gmail.com>
<4A6059B4.5010004@pjmodos.net>
<4A607997.3030305@pjmodos.net>
<603c8f070907191628r6929055coe7627726a33ed143@mail.gmail.com>
<a301bfd90907192312s17e1b16cy3bcd6e0876960c04@mail.gmail.com>
<603c8f070908050932m19e7db65u9dab6d8001c5a237@mail.gmail.com>
<20810.1249490458@sss.pgh.pa.us>
<4A79B7E5.1020509@dunslane.net>
<20090806152039.GO23840@tamriel.snowman.net>
<4A7C77B9.1050008@pjmodos.net>
I am sorry I forgot to write my opinion on these.
> Do we want to differentiate views from tables in these commands or not ?
I'd like to have views separate but I don't feel strongly about it.
However having single statement for TABLE, VIEW and SEQUENCE is not a
good idea IMHO, it will add confusion with standard GRANT statement and
I don't think we could call it a TABLE anymore.
> Do we want GRANT ON ALL (or GRANT ON * which is mysql style, btw) in
> SQL form (not functions or client enhancements) at all ? - if we
> decide that we don't want to have this as SQL statement then I'll drop
> the effort.
Well, since I've written the patch I am for it :) Probably with that
GRANT ON * and GRANT ON schema.* as it has indeed very low probability
that something like that will be in standard with different meaning and
also it's mysql compatible (which is the only db currently having this
feature I think), even if that's very little plus. Adding the
possibility of running commands on many objects at once in psql would be
nice addition in the future, especially since we could have more wild
syntax there, but I still feel strongly about having the simplest case
handled by SQL.
> And how do we want to filter default acls ?
My opinion is that the best way to do this would be ALTER DEFAULT
PRIVILEGES GRANT ..., without any additional filters, it would just
affect the role which runs this command. I think this is best solution
because ALTER SCHEMA forces creation of many schemas that might not have
anything to do with structure of the database (if you want different
default privileges for different things). Also having default privileges
per role with filters on various things will IMHO create more confusion
than good. And finally if somebody wants to have different default
privileges for different things than he can just create child roles with
different default privileges and use SET SESSION AUTHORIZATION to switch
between them.
--
Regards
Petr Jelinek (PJMODOS)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pjmodos@pjmodos.net, sfrost@snowman.net, andrew@dunslane.net, tgl@sss.pgh.pa.us, robertmhaas@gmail.com, nikhil.sontakke@enterprisedb.com
Subject: Re: GRANT ON ALL IN schema
In-Reply-To: <4A7CE01D.7060604@pjmodos.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox