Received: from localhost (unknown [200.46.204.183]) by postgresql.org (Postfix) with ESMTP id 6836E65087D for ; Thu, 10 Jul 2008 00:15:51 -0300 (ADT) Received: from postgresql.org ([200.46.204.86]) by localhost (mx1.hub.org [200.46.204.183]) (amavisd-maia, port 10024) with ESMTP id 63008-02 for ; Thu, 10 Jul 2008 00:15:01 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.6 Received: from fugue.toroid.org (fugue.toroid.org [85.10.196.113]) by postgresql.org (Postfix) with ESMTP id C1CC4650861 for ; Thu, 10 Jul 2008 00:11:39 -0300 (ADT) Received: from penne.toroid.org (penne-vpn [10.8.0.6]) by fugue.toroid.org (Postfix) with ESMTP id 2D823558342; Thu, 10 Jul 2008 05:11:37 +0200 (CEST) Received: by penne.toroid.org (Postfix, from userid 1000) id CB04CADC364; Thu, 10 Jul 2008 08:41:40 +0530 (IST) Date: Thu, 10 Jul 2008 08:41:40 +0530 From: Abhijit Menon-Sen To: Alvaro Herrera Cc: Jaime Casanova , pgsql-hackers@postgresql.org Subject: Re: Extending grant insert on tables to sequences Message-ID: <20080710031140.GA427@toroid.org> References: <20080708133244.GB4095@alvh.no-ip.org> <20080709185837.GA27406@toroid.org> <20080709191125.GK3946@alvh.no-ip.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20080709191125.GK3946@alvh.no-ip.org> X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200807/498 X-Sequence-Number: 120758 At 2008-07-09 15:11:25 -0400, alvherre@commandprompt.com wrote: > > No, actually I meant having a lone "list = lappend(list, newseq);" in > the loop, so that ExecGrantStmt_oids is called only once. Yes, I understand what you meant. I just phrased my agreement poorly. Here's a more precise phrasing. ;-) (I agree with Robert Treat that there seems to be no point granting SELECT on the sequence. I don't *particularly* care about it, but I tend towards wanting to drop that bit. This patch reflects that.) Jaime: please feel free to use or ignore this, as you wish. -- ams diff --git a/src/backend/catalog/aclchk.c b/src/backend/catalog/aclchk.c index 15f5af0..8664203 100644 --- a/src/backend/catalog/aclchk.c +++ b/src/backend/catalog/aclchk.c @@ -361,6 +361,41 @@ ExecuteGrantStmt(GrantStmt *stmt) } ExecGrantStmt_oids(&istmt); + + /* If INSERT or UPDATE privileges are being granted or revoked on a + * relation, this extends the operation to include any sequences + * owned by the relation. + */ + + if (istmt.objtype == ACL_OBJECT_RELATION && + (istmt.privileges & (ACL_INSERT | ACL_UPDATE))) + { + InternalGrant istmt_seq; + + istmt_seq.is_grant = istmt.is_grant; + istmt_seq.objtype = ACL_OBJECT_SEQUENCE; + istmt_seq.grantees = istmt.grantees; + istmt_seq.grant_option = istmt.grant_option; + istmt_seq.behavior = istmt.behavior; + istmt_seq.all_privs = false; + + istmt_seq.privileges = ACL_NO_RIGHTS; + if (istmt.privileges & ACL_INSERT) + istmt_seq.privileges |= ACL_USAGE; + if (istmt.privileges & ACL_UPDATE) + istmt_seq.privileges |= ACL_UPDATE; + + istmt_seq.objects = NIL; + foreach (cell, istmt.objects) + { + istmt_seq.objects = + list_concat(istmt_seq.objects, + getOwnedSequences(lfirst_oid(cell))); + } + + if (istmt_seq.objects != NIL) + ExecGrantStmt_oids(&istmt_seq); + } } /*