From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jaime Casanova <jcasanov@systemguards.com.ec>
Cc: Abhijit Menon-Sen <ams@oryx.com>
Cc: Alvaro Herrera <alvherre@commandprompt.com>
Cc: Jaime Casanova <systemguards@gmail.com>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Extending grant insert on tables to sequences
Date: Sat, 12 Jul 2008 16:06:51 -0400
Message-ID: <23912.1215893211@sss.pgh.pa.us> (raw)
In-Reply-To: <3073cc9b0807121232m6b8e6ae0ycaa78d6b8595d39d@mail.gmail.com>
References: <c2d9e70e0805221118x1411e00crd7d4aae7e6e4ea3d@mail.gmail.com>
<c2d9e70e0805232156p20dbe2b9j2a88d35f951d625e@mail.gmail.com>
<20080708133244.GB4095@alvh.no-ip.org>
<20080709185837.GA27406@toroid.org>
<20080709191125.GK3946@alvh.no-ip.org>
<20080710031140.GA427@toroid.org>
<3073cc9b0807110957w71869487p17fb58cb98abc520@mail.gmail.com>
<20080712113041.GA25112@toroid.org>
<3073cc9b0807121232m6b8e6ae0ycaa78d6b8595d39d@mail.gmail.com>
"Jaime Casanova" <jcasanov@systemguards.com.ec> writes:
> + if (istmt.all_privs)
> + istmt_seq.all_privs = true;
> + else
> + {
> + if (istmt.privileges & ACL_INSERT)
> + istmt_seq.privileges |= ACL_USAGE;
> + if (istmt.privileges & ACL_UPDATE)
> + istmt_seq.privileges |= ACL_UPDATE;
> + if (istmt.privileges & ACL_SELECT)
> + istmt_seq.privileges |= ACL_SELECT;
> + }
This definition of the derived rights seems pretty arbitrary and
unprincipled. If you can't explain it precisely in a few words in the
documentation (and I notice you didn't even attempt to explain it at
all), then you probably need to think harder.
In particular, I don't see why having UPDATE on the parent table should
grant the right to use setval() on the sequence. If you had INSERT and
DELETE as well, implying the right to make arbitrary changes in the
parent table, then maybe setval() would be sensible to allow --- but
this code can't really tell that, since it doesn't have a global view
of the privileges previously granted.
What I think makes sense is just to have parent INSERT privilege lead to
USAGE on the sequence (thus granting nextval/currval rights, which are
what you'd typically need in association with trying to do inserts).
I don't see any need to automatically grant more than that. Selects and
updates on the parent table don't need to touch the sequence, so why are
those privileges granting anything?
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-patches@postgresql.org
Cc: tgl@sss.pgh.pa.us, jcasanov@systemguards.com.ec, ams@oryx.com, alvherre@commandprompt.com, systemguards@gmail.com, pgsql-hackers@postgresql.org
Subject: Re: Extending grant insert on tables to sequences
In-Reply-To: <23912.1215893211@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox