Message-ID: <606d8b1c.1c69fb81.3df04.1a99@mx.google.com>
Date: Wed, 7 Apr 2021 12:36:11 +0200
From: Michael Banck <michael.banck@credativ.de>
To: Stephen Frost <sfrost@snowman.net>
Cc: gkokolatos@pm.me, Anastasia Lubennikova <a.lubennikova@postgrespro.ru>,
	"pgsql-hackers@lists.postgresql.org" <pgsql-hackers@lists.postgresql.org>
Subject: Re: New predefined roles- 'pg_read/write_all_data'
References: <20200828003023.GU29590@tamriel.snowman.net>
 <159895771273.18329.10477215354702372718.pgcf@coridan.postgresql.org>
 <160397087449.1204.5186411958611164965.pgcf@coridan.postgresql.org>
 <20201029141959.GK16415@tamriel.snowman.net>
 <5a3e197e-3f6c-50e4-9774-c6b82b7151f1@postgrespro.ru>
 <20201123223147.GQ16415@tamriel.snowman.net>
 <4GHYHFHb6AQyOjxMZ47he7YvJSBAkZr968U31kr8a2GLlNFyXRH_-DJAjcL2Xh6jJ3TumkX44XkoeG3Utj5u8UA4thBUt9m87tv8WIDNoCg=@pm.me>
 <20210401200006.GV20766@tamriel.snowman.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20210401200006.GV20766@tamriel.snowman.net>
User-Agent: Mutt/1.10.1 (2018-07-13)
Archived-At: 
 <https://www.postgresql.org/message-id/606d8b1c.1c69fb81.3df04.1a99%40mx.google.com>
Precedence: bulk

Hi,

On Thu, Apr 01, 2021 at 04:00:06PM -0400, Stephen Frost wrote:
> diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml
> index d171b13236..fe0bdb7599 100644
> --- a/doc/src/sgml/user-manag.sgml
> +++ b/doc/src/sgml/user-manag.sgml
> @@ -518,6 +518,24 @@ DROP ROLE doomed_role;
>        </row>
>       </thead>
>       <tbody>
> +      <row>
> +       <entry>pg_read_all_data</entry>
> +       <entry>Read all data (tables, views, sequences), as if having SELECT
> +       rights on those objects, and USAGE rights on all schemas, even without
> +       having it explicitly.  This role does not have the role attribute
> +       <literal>BYPASSRLS</literal> set.  If RLS is being used, an administrator
> +       may wish to set <literal>BYPASSRLS</literal> on roles which this role is
> +       GRANTed to.</entry>
> +      </row>
> +      <row>
> +       <entry>pg_write_all_data</entry>
> +       <entry>Write all data (tables, views, sequences), as if having INSERT,
> +       UPDATE, and DELETE rights on those objects, and USAGE rights on all
> +       schemas, even without having it explicitly.  This role does not have the
> +       role attribute <literal>BYPASSRLS</literal> set.  If RLS is being used,
> +       an administrator may wish to set <literal>BYPASSRLS</literal> on roles
> +       which this role is GRANTed to.</entry>
> +      </row>

Shouldn't those "SELECT", "INSERT" etc. be wrapped in <command> tags?


Michael

-- 
Michael Banck
Projektleiter / Senior Berater
Tel.: +49 2166 9901-171
Fax:  +49 2166 9901-100
Email: michael.banck@credativ.de

credativ GmbH, HRB Mönchengladbach 12080
USt-ID-Nummer: DE204566209
Trompeterallee 108, 41189 Mönchengladbach
Geschäftsführung: Dr. Michael Meskes, Sascha Heuer

Unser Umgang mit personenbezogenen Daten unterliegt
folgenden Bestimmungen: https://www.credativ.de/datenschutz