pg.ddx.io pgsql-interfaces@postgresql.org mailing list archive
help / color / mirror / Atom feedExecute access on functions
2+ messages / 2 participants
[nested] [flat]
* Execute access on functions
@ 2005-03-23 19:35 Kathy Smith <ksmith@lanl.gov>
0 siblings, 1 reply; 2+ messages in thread
From: Kathy Smith @ 2005-03-23 19:35 UTC (permalink / raw)
To: pgsql-interfaces; +Cc: clittle@lanl.gov
I want to control access (update, delete) to my tables and have done that
with other DBMSs using stored procedures. Besides performance, I believe
that's one of the primary advantages of stored procedures. I grant execute
on the procedure to a group containing the users with controlled update
access. Never on the table. I cannot seem to find the equivalent in
postgres. I had hoped to be able to do this with user-defined functions
but the following statement implies that if the SECURITY DEFINER is used,
that *anyone* who can get to that function can execute it. Hardly the
solution I am looking for. The alternative being that I must grant update
to the table :(
The CREATE FUNCTION clause SECURITY DEFINER makes the function run with the
privileges of the user who created it. Otherwise, the INVOKER's privileges
are used.
Am I missing something here? Is there another way?
Thanks,
Kathy
*******************************
Kathryn K Smith
Los Alamos National Laboratory
505-699-9330
505-665-0505
The gentlest thing in the world overcomes the hardest thing in the
world. --Tao Te Ching
^ permalink raw reply [nested|flat] 2+ messages in thread
* Re: Execute access on functions
@ 2005-03-23 20:10 Bruno Wolff III <bruno@wolff.to>
parent: Kathy Smith <ksmith@lanl.gov>
0 siblings, 0 replies; 2+ messages in thread
From: Bruno Wolff III @ 2005-03-23 20:10 UTC (permalink / raw)
To: Kathy Smith <ksmith@lanl.gov>; +Cc: pgsql-interfaces; clittle@lanl.gov
On Wed, Mar 23, 2005 at 12:35:12 -0700,
Kathy Smith <ksmith@lanl.gov> wrote:
> I want to control access (update, delete) to my tables and have done that
> with other DBMSs using stored procedures. Besides performance, I believe
> that's one of the primary advantages of stored procedures. I grant execute
> on the procedure to a group containing the users with controlled update
> access. Never on the table. I cannot seem to find the equivalent in
> postgres. I had hoped to be able to do this with user-defined functions
> but the following statement implies that if the SECURITY DEFINER is used,
> that *anyone* who can get to that function can execute it. Hardly the
> solution I am looking for. The alternative being that I must grant update
> to the table :(
>
> The CREATE FUNCTION clause SECURITY DEFINER makes the function run with the
> privileges of the user who created it. Otherwise, the INVOKER's privileges
> are used.
>
> Am I missing something here? Is there another way?
You can control who can execute the function. By default 'public' can execute
functions, but you can revoke that access.
^ permalink raw reply [nested|flat] 2+ messages in thread
end of thread, other threads:[~2005-03-23 20:10 UTC | newest]
Thread overview: 2+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2005-03-23 19:35 Execute access on functions Kathy Smith <ksmith@lanl.gov>
2005-03-23 20:10 ` Bruno Wolff III <bruno@wolff.to>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox