From: Abhijit Menon-Sen <ams@oryx.com>
To: Alvaro Herrera <alvherre@commandprompt.com>
Cc: Jaime Casanova <systemguards@gmail.com>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Extending grant insert on tables to sequences
Date: Thu, 10 Jul 2008 08:41:40 +0530
Message-ID: <20080710031140.GA427@toroid.org> (raw)
In-Reply-To: <20080709191125.GK3946@alvh.no-ip.org>
References: <c2d9e70e0805221118x1411e00crd7d4aae7e6e4ea3d@mail.gmail.com>
<c2d9e70e0805232156p20dbe2b9j2a88d35f951d625e@mail.gmail.com>
<20080708133244.GB4095@alvh.no-ip.org>
<20080709185837.GA27406@toroid.org>
<20080709191125.GK3946@alvh.no-ip.org>
At 2008-07-09 15:11:25 -0400, alvherre@commandprompt.com wrote:
>
> No, actually I meant having a lone "list = lappend(list, newseq);" in
> the loop, so that ExecGrantStmt_oids is called only once.
Yes, I understand what you meant. I just phrased my agreement poorly.
Here's a more precise phrasing. ;-)
(I agree with Robert Treat that there seems to be no point granting
SELECT on the sequence. I don't *particularly* care about it, but I
tend towards wanting to drop that bit. This patch reflects that.)
Jaime: please feel free to use or ignore this, as you wish.
-- ams
inline patch 1: src/backend/catalog/aclchk.c (+35/-0 lines) download inline-1.patchdiff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.cindex 15f5af0..8664203 100644--- a/src/backend/catalog/aclchk.c+++ b/src/backend/catalog/aclchk.c@@ -361,6 +361,41 @@ ExecuteGrantStmt(GrantStmt *stmt)
}
ExecGrantStmt_oids(&istmt);
++ /* If INSERT or UPDATE privileges are being granted or revoked on a+ * relation, this extends the operation to include any sequences+ * owned by the relation.+ */++ if (istmt.objtype == ACL_OBJECT_RELATION &&+ (istmt.privileges & (ACL_INSERT | ACL_UPDATE)))+ {+ InternalGrant istmt_seq;++ istmt_seq.is_grant = istmt.is_grant;+ istmt_seq.objtype = ACL_OBJECT_SEQUENCE;+ istmt_seq.grantees = istmt.grantees;+ istmt_seq.grant_option = istmt.grant_option;+ istmt_seq.behavior = istmt.behavior;+ istmt_seq.all_privs = false;++ istmt_seq.privileges = ACL_NO_RIGHTS;+ if (istmt.privileges & ACL_INSERT)+ istmt_seq.privileges |= ACL_USAGE;+ if (istmt.privileges & ACL_UPDATE)+ istmt_seq.privileges |= ACL_UPDATE;++ istmt_seq.objects = NIL;+ foreach (cell, istmt.objects)+ {+ istmt_seq.objects =+ list_concat(istmt_seq.objects,+ getOwnedSequences(lfirst_oid(cell)));+ }++ if (istmt_seq.objects != NIL)+ ExecGrantStmt_oids(&istmt_seq);+ }
}
/*
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-patches@postgresql.org
Cc: ams@oryx.com, alvherre@commandprompt.com, systemguards@gmail.com, pgsql-hackers@postgresql.org
Subject: Re: Extending grant insert on tables to sequences
In-Reply-To: <20080710031140.GA427@toroid.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox