Received: from localhost (postgresql.org [64.49.215.8]) by postgresql.org (Postfix) with ESMTP id 3628D4768D2 for ; Wed, 13 Nov 2002 09:27:07 -0500 (EST) Received: from sss.pgh.pa.us (unknown [192.204.191.242]) by postgresql.org (Postfix) with ESMTP id 967C54768CD for ; Wed, 13 Nov 2002 09:27:06 -0500 (EST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.12.5/8.12.5) with ESMTP id gADER1hR021307; Wed, 13 Nov 2002 09:27:10 -0500 (EST) To: Luis Sousa Cc: Robert Treat , Josh Berkus , pgsql-sql Subject: Re: Permission on insert rules In-reply-to: <3DD22D03.4090505@ualg.pt> References: <1037137215.27220.64.camel@camel> <3DD22D03.4090505@ualg.pt> Comments: In-reply-to Luis Sousa message dated "Wed, 13 Nov 2002 10:44:19 +0000" Date: Wed, 13 Nov 2002 09:27:01 -0500 Message-ID: <21306.1037197621@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by AMaViS new-20020517 X-Archive-Number: 200211/207 X-Sequence-Number: 10349 Luis Sousa writes: > When inserting, using the rule, the insert that's defined on the rule > works fine, but the insert defined inside the function, doesn't (that's > the one that gives permssion denied). Right. As of 7.3 you can fix this by making the function "setuid" (ie, it runs with the permissions of the function owner, not the caller). A rule's permission effects only extend as far as access rights to the tables explicitly named in the rule. Evaluation of functions appearing in the text of the rule is done normally --- ie, as the calling user (unless you use the new setuid-function feature). There's been past discussion about whether that's a good idea, but it would be quite difficult to change it. regards, tom lane