Message-ID: <552EA272.1040906@pgmasters.net>
Date: Wed, 15 Apr 2015 13:40:02 -0400
From: David Steele <david@pgmasters.net>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10;
 rv:31.0) Gecko/20100101 Thunderbird/31.6.0
MIME-Version: 1.0
To: Tatsuo Ishii <ishii@postgresql.org>
CC: simon@2ndQuadrant.com, pgsql-hackers@postgresql.org,
 sawada.mshk@gmail.com, ams@2ndQuadrant.com, masao.fujii@gmail.com
Subject: Re: Auditing extension for PostgreSQL (Take 2)
References: <552D2C1A.3060002@pgmasters.net>
	<20150415.081354.1167351714960358354.t-ishii@sraoss.co.jp>
	<552DA959.2010102@pgmasters.net>
 <20150415.093737.74027275338109111.t-ishii@sraoss.co.jp>
In-Reply-To: <20150415.093737.74027275338109111.t-ishii@sraoss.co.jp>
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature";
 boundary="kH6e5vEcvwRb0sq7FUGqJ6k7j9TQCdI6c"
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

This is an OpenPGP/MIME signed message (RFC 4880 and 3156)
--kH6e5vEcvwRb0sq7FUGqJ6k7j9TQCdI6c
Content-Type: text/plain; charset=windows-1252
Content-Transfer-Encoding: quoted-printable

On 4/14/15 8:37 PM, Tatsuo Ishii wrote:
> BTW, in my understanding pg_audit allows to track a table access even
> if it's used in a view. I think this is a nice feature and it would be
> better explicitly stated in the document and the test case is better
> included in the regression test.
>=20
> Here is a sample session:
>=20
> CREATE TABLE test2 (id INT);
> CREATE VIEW vtest2 AS SELECT * FROM test2;
> GRANT SELECT ON TABLE public.test2 TO auditor;
> GRANT SELECT ON TABLE public.vtest2 TO auditor;
> SELECT * FROM vtest2;
> NOTICE:  AUDIT: SESSION,1,1,READ,SELECT,,,SELECT * FROM vtest2;
> NOTICE:  AUDIT: OBJECT,1,1,READ,SELECT,VIEW,public.vtest2,SELECT * FROM=
 vtest2;
> NOTICE:  AUDIT: OBJECT,1,1,READ,SELECT,TABLE,public.test2,SELECT * FROM=
 vtest2;

That's the idea!  In the documentation I throw around the word
"relation" pretty liberally, but you are right that some clarification
would be helpful.

I have added a few parenthetical statements to the docs that should make
them clearer.  I also took your suggestion and added a view regression te=
st.

Both are in patch v9 which I attached to my previous email on this thread=
=2E

Thank you for taking the time to have a look.

--=20
- David Steele
david@pgmasters.net


--kH6e5vEcvwRb0sq7FUGqJ6k7j9TQCdI6c
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJVLqJyAAoJEIA2uIJQ5SFAAkYQALRhat486TCxYiPMTsh5SOes
cRGAsW77WZO7U8wW9gZp9+suCT4K04ZEd4AJ9Djv0zr9vHiEDGfbVtniA3/mnaGj
UciY6MT4vAX8GQM1Kn6USgMbAUqoPIz8SuzWpVkYCzjoo4/aluhfc/qoAIr3SvKx
g3VFg9V99NBDP8azuUtOZmhFwe+w446SUd6xLiW9gatEN3zTcmXqWT7GiDeI8wX+
ylN9om6VmtqbgdCACIIegOhXpKL6chUi8Fq4Qx28g/cRJShi11fd42HeCXwdP4Bn
H68b+og4WRzyOPYJI9zAXf4vg4z2P6xVpxqJMIKL90c0ItJJvo0Hglrvf3yjZRWi
N705KalOR8pgl6li/vsquhXhnCr9fXeWzs2p4WUEHDAuoY5GAnRkT3k2tyH6PPGs
NKZ/jI2w7xZ0JvOSiEzOhZhE/2GDUHOGBv5KqPOihxnVQZz4ch92h9bCws7ac4VF
THQ0jzBbT5xjH9G7CJ4HVBEwljDaxc/hOjkOztk7Calrdx2d2nhqAb9At7qfU4iT
qPIayIejvpaz2V0NKIivz5/YtxEU7EMy+pUx8VSnHfpn9o5HukWrY1g9NKy+Mv2D
lEcQ11gBU/kO05S7q2cya1wpZbVKhjnDekC3jovEnRBSAXXIPGtJUNlEL/xLUV9p
Pnd646VB1XNqWc5+lFig
=qYu3
-----END PGP SIGNATURE-----

--kH6e5vEcvwRb0sq7FUGqJ6k7j9TQCdI6c--