From: Bernd Helmle <mailings@oopsware.de>
To: Peter Eisentraut <peter_e@gmx.net>
To: pgsql-hackers@postgresql.org
Cc: Petr Jelinek <pjmodos@pjmodos.net>
Subject: Re: GRANT ON ALL IN schema
Date: Thu, 18 Jun 2009 11:26:02 +0200
Message-ID: <968B9B6C6E5C937958E5456C@teje> (raw)
In-Reply-To: <200906171644.53717.peter_e@gmx.net>
References: <4A37BF63.50008@pjmodos.net>
<4A37E122.8070303@pjmodos.net>
<4A38A956.8080600@pjmodos.net>
<200906171644.53717.peter_e@gmx.net>
--On Mittwoch, Juni 17, 2009 16:44:53 +0300 Peter Eisentraut
<peter_e@gmx.net> wrote:
> I think you should design this with a bit wider scope. Instead of just
> "all tables in this schema", think "all tables satisfying some
> condition". It has been requested, for example, to be able to grant on
> all tables that match a pattern.
>
My experience shows that having such a thing is often leading to "bad
practices". People tend to grant everything to every login role instead of
using an intelligent role privilege mechanism.
MySQL for example has such wildcards (using '_' and '%' wildcard patterns),
which often confuses people when having such characters in their
table/database names (of course, i forgot to escape them more than once).
The unpredictable results of messing up a complete schema when using a
broken pattern expression is going to reduce the usefulness of such a
feature, i think.
>> Also since this patch introduces VIEWS as object with grantable
>> privileges, I added GRANT ON VIEW foo syntax which is more or less
>> synonymous to GRANT ON TABLE foo syntax. It felt weird to have GRANT ON
>> ALL VIEWS but not GRANT ON VIEW.
>
> As far as GRANT is concerned, a view is a table, so I would omit the
> VIEW/VIEWS stuff completely.
We have ALTER VIEW now, so why don't implement the same synonym for GRANT?
--
Thanks
Bernd
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: mailings@oopsware.de, peter_e@gmx.net, pjmodos@pjmodos.net
Subject: Re: GRANT ON ALL IN schema
In-Reply-To: <968B9B6C6E5C937958E5456C@teje>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox