X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (neptune.hub.org [200.46.204.2]) by svr1.postgresql.org (Postfix) with ESMTP id 5299FD1E7FE for ; Mon, 19 Jan 2004 05:41:06 +0000 (GMT) Received: from svr1.postgresql.org ([200.46.204.71]) by localhost (neptune.hub.org [200.46.204.2]) (amavisd-new, port 10024) with ESMTP id 21075-09 for ; Mon, 19 Jan 2004 01:40:35 -0400 (AST) Received: from sss.pgh.pa.us (unknown [192.204.191.242]) by svr1.postgresql.org (Postfix) with ESMTP id 3B708D1E810 for ; Mon, 19 Jan 2004 01:40:34 -0400 (AST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.12.10/8.12.10) with ESMTP id i0J5eYpH020957; Mon, 19 Jan 2004 00:40:34 -0500 (EST) To: Paul Hart Cc: pgsql-sql@postgresql.org Subject: Re: Execute permissions for stored functions In-reply-to: <61572386-4A2B-11D8-8678-000393CC268A@redchocolate.ca> References: <61572386-4A2B-11D8-8678-000393CC268A@redchocolate.ca> Comments: In-reply-to Paul Hart message dated "Sun, 18 Jan 2004 21:58:38 -0500" Date: Mon, 19 Jan 2004 00:40:33 -0500 Message-ID: <20956.1074490833@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by amavisd-new at postgresql.org X-Archive-Number: 200401/162 X-Sequence-Number: 16555 Paul Hart writes: > In RDBMSs such as Oracle, stored PL/SQL functions run with the > permissions of the user that creates the function. Users who are given > EXECUTE privileges then call the function with the permissions of the > creator of the function. Use "SECURITY DEFINER" to get this behavior in Postgres. The SQL99 spec punts as to whether SECURITY DEFINER should be the default or not, so unfortunately neither we nor Oracle can be said to be wrong on this point... regards, tom lane