From: Robert Treat <xzilla@users.sourceforge.net>
To: Bruce Momjian <pgman@candle.pha.pa.us>
Cc: josh@agliodbs.com, Luis Sousa <llsousa@ualg.pt>
Cc: pgsql-sql <pgsql-sql@postgresql.org>
Subject: Re: Permission on insert rules
Date: 11 Nov 2002 11:45:40 -0500
Message-ID: <1037033140.26585.34.camel@camel> (raw)
In-Reply-To: <200211090240.gA92eX412402@candle.pha.pa.us>
References: <200211090240.gA92eX412402@candle.pha.pa.us>
On Fri, 2002-11-08 at 21:40, Bruce Momjian wrote:
> Josh Berkus wrote:
> >
> > Luis,
> >
> > > Just a question.
> > > I'm writing some rules to insert/update some data in my database, and I
> > > gave all the privileges on that view to the user, and only select on the
> > > tables.
> > > When that user inserts data using the view, I thought that was user
> > > postgres that will do the rest ! But I got permission denied on those
> > > tables.
> > > The idea was to create a layer, with the views, giving to that user
> > > permission on views to insert and update, and not to tables.
> > > Is this possible ?
> >
> > This is a known problem.
> >
> > I know that permissions for Functions has been addressed in 7.3. However, I
> > am not sure about permissions for updatable views. Tom, Bruce?
>
> Views have always had their own permissions.
>
If the functions can fire as there creator instead of there caller, then
I would think as long as the creator has insert/update views on the base
table, you should be able to do updateable rules and give only
permissions to the view for the caller. (Though maybe you have to use
triggers rather than rules to do this?) Does that sound right?
Robert Treat
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: xzilla@users.sourceforge.net, pgman@candle.pha.pa.us, llsousa@ualg.pt
Subject: Re: Permission on insert rules
In-Reply-To: <1037033140.26585.34.camel@camel>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox