From: Bruno Wolff III <bruno@wolff.to>
To: Kathy Smith <ksmith@lanl.gov>
Cc: pgsql-interfaces@postgresql.org
Cc: clittle@lanl.gov
Subject: Re: Execute access on functions
Date: Wed, 23 Mar 2005 14:10:16 -0600
Message-ID: <20050323201016.GA30776@wolff.to> (raw)
In-Reply-To: <6.0.3.0.2.20050323105558.02b80ff8@nis-mail.lanl.gov>
References: <6.0.3.0.2.20050323105558.02b80ff8@nis-mail.lanl.gov>
On Wed, Mar 23, 2005 at 12:35:12 -0700,
Kathy Smith <ksmith@lanl.gov> wrote:
> I want to control access (update, delete) to my tables and have done that
> with other DBMSs using stored procedures. Besides performance, I believe
> that's one of the primary advantages of stored procedures. I grant execute
> on the procedure to a group containing the users with controlled update
> access. Never on the table. I cannot seem to find the equivalent in
> postgres. I had hoped to be able to do this with user-defined functions
> but the following statement implies that if the SECURITY DEFINER is used,
> that *anyone* who can get to that function can execute it. Hardly the
> solution I am looking for. The alternative being that I must grant update
> to the table :(
>
> The CREATE FUNCTION clause SECURITY DEFINER makes the function run with the
> privileges of the user who created it. Otherwise, the INVOKER's privileges
> are used.
>
> Am I missing something here? Is there another way?
You can control who can execute the function. By default 'public' can execute
functions, but you can revoke that access.
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-interfaces@postgresql.org
Cc: bruno@wolff.to, ksmith@lanl.gov, clittle@lanl.gov
Subject: Re: Execute access on functions
In-Reply-To: <20050323201016.GA30776@wolff.to>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox