From: Tom Lane <tgl@sss.pgh.pa.us>
To: Pallav Kalva <pkalva@deg.cc>
Cc: scott.marlowe <scott.marlowe@ihs.com>
Cc: pgsql-sql@postgresql.org
Subject: Re: Permissions not working
Date: Fri, 30 Apr 2004 12:19:39 -0400
Message-ID: <26201.1083341979@sss.pgh.pa.us> (raw)
In-Reply-To: <40925695.8060908@deg.cc>
References: <Pine.LNX.4.33.0404291522430.10983-100000@css120.ihs.com>
<40917768.8040107@deg.cc>
<17807.1083280047@sss.pgh.pa.us>
<40925695.8060908@deg.cc>
Pallav Kalva <pkalva@deg.cc> writes:
> usps=> \z citystate_alias
> Access privileges
> for database "usps"
> Schema | Table
> | Access privileges
> --------+-----------------+-----------------------------------------------------------------------------------------------------------------------
> public | citystate_alias |
> {postgres=a*r*w*d*R*x*t*/postgres,=r/postgres,usps=arwdRxt/postgres,"group
> 100=r/usps","group ea_development=r/usps"}
> (1 row)
It looks to me like (a) this table is owned by postgres not usps, and
(b) postgres has granted SELECT permission to PUBLIC (that's what the
"=r/postgres" part means). The usps user isn't going to be able to
revoke that because he doesn't own the table.
It does seem like you've found a bug of some kind though: the above
shows that user usps does not have GRANT OPTION rights of any kind
(there are no stars in his privilege list). So how was he able to grant
SELECT rights to those two groups? Do you have the exact sequence of
GRANT and REVOKE operations that were performed on this table? What
PG version is this, exactly?
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-sql@postgresql.org
Cc: tgl@sss.pgh.pa.us, pkalva@deg.cc, scott.marlowe@ihs.com
Subject: Re: Permissions not working
In-Reply-To: <26201.1083341979@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox