To: Pallav Kalva <pkalva@deg.cc>
Cc: "scott.marlowe" <scott.marlowe@ihs.com>, pgsql-sql@postgresql.org
Subject: Re: Permissions not working 
In-reply-to: <40925695.8060908@deg.cc> 
References: <Pine.LNX.4.33.0404291522430.10983-100000@css120.ihs.com>
	<40917768.8040107@deg.cc> <17807.1083280047@sss.pgh.pa.us>
	<40925695.8060908@deg.cc>
Comments: In-reply-to Pallav Kalva <pkalva@deg.cc>
	message dated "Fri, 30 Apr 2004 09:37:25 -0400"
Date: Fri, 30 Apr 2004 12:19:39 -0400
Message-ID: <26201.1083341979@sss.pgh.pa.us>
From: Tom Lane <tgl@sss.pgh.pa.us>

Pallav Kalva <pkalva@deg.cc> writes:
> usps=> \z citystate_alias
>                                                       Access privileges 
> for database "usps"
>  Schema |      Table      
> |                                                   Access privileges
> --------+-----------------+-----------------------------------------------------------------------------------------------------------------------
>  public | citystate_alias | 
> {postgres=a*r*w*d*R*x*t*/postgres,=r/postgres,usps=arwdRxt/postgres,"group 
> 100=r/usps","group ea_development=r/usps"}
> (1 row)

It looks to me like (a) this table is owned by postgres not usps, and
(b) postgres has granted SELECT permission to PUBLIC (that's what the
"=r/postgres" part means).  The usps user isn't going to be able to
revoke that because he doesn't own the table.

It does seem like you've found a bug of some kind though: the above
shows that user usps does not have GRANT OPTION rights of any kind
(there are no stars in his privilege list).  So how was he able to grant
SELECT rights to those two groups?  Do you have the exact sequence of
GRANT and REVOKE operations that were performed on this table?  What
PG version is this, exactly?

			regards, tom lane