Message-ID: <51152A28.4060303@gmail.com>
Date: Fri, 08 Feb 2013 08:39:04 -0800
From: Adrian Klaver <adrian.klaver@gmail.com>
User-Agent: Mozilla/5.0 (X11; Linux i686;
	rv:17.0) Gecko/20130107 Thunderbird/17.0.2
MIME-Version: 1.0
To: Tom Lane <tgl@sss.pgh.pa.us>
CC: Andreas Kretschmer <andreas@a-kretschmer.de>,
	"pgsql-general@postgresql.org" <pgsql-general@postgresql.org>
Subject: Re: Bug, Feature, or what else?
References: 
 <119745304.24731.1360333559327.JavaMail.open-xchange@ox.ims-firmen.de>
	<51151128.8040807@gmail.com>
	<1568445490.24920.1360335539088.JavaMail.open-xchange@ox.ims-firmen.de>
	<51151764.4090405@gmail.com>
	<609013460.25018.1360337038276.JavaMail.open-xchange@ox.ims-firmen.de>
	<17143.1360340065@sss.pgh.pa.us>
In-Reply-To: <17143.1360340065@sss.pgh.pa.us>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk
Sender: pgsql-general-owner@postgresql.org

On 02/08/2013 08:14 AM, Tom Lane wrote:
> Andreas Kretschmer <andreas@a-kretschmer.de> writes:
>> Adrian Klaver <adrian.klaver@gmail.com> hat am 8. Februar 2013 um 16:19
>>> So what does \dn+ public show?
>
>> db115150=# \dn+ public
>>                               List of schemas
>>    Name  |  Owner   |      Access privileges      |      Description
>> --------+----------+-----------------------------+------------------------
>>   public | postgres | postgres=UC/postgres       +| standard public schema
>>          |          | akretschmer01=U*C*/postgres+|
>>          |          | ak02=UC/akretschmer01       |
>> (1 row)
>
> Ah: this shows that you didn't tell us the whole truth to start with.
> What you've actually got here is that postgres granted ALL WITH GRANT
> OPTION to akretschmer01, and then akretschmer01 used the grant option
> to grant rights to ak02.  (I was wondering how it was that a non
> superuser would be able to grant anything about schema public...)
>
> Only akretschmer01 can directly drop the grant to ak02.  What postgres
> could do is revoke the grant option to akretschmer01, and the cascaded
> effect of that would remove the privileges for ak02.
>
> Of course, postgres has other options besides that, of which "DROP OWNED
> BY ak02" is probably the most appropriate here.  Or if you really want
> to get rid of just that grant, SET ROLE TO akretschmer01 and revoke.

The DROP OWNED was tried further up the thread and did not seem to work:

"
nice idea, but unfortunately no:

db115150=# drop owned by ak02;
DROP OWNED
db115150=# drop user ak02;
FEHLER:  kann Rolle »ak02« nicht löschen, weil andere Objekte davon abhängen
DETAIL:  Privilegien für Schema public

"


>
> 			regards, tom lane
>
>


-- 
Adrian Klaver
adrian.klaver@gmail.com


-- 
Sent via pgsql-general mailing list (pgsql-general@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-general