X-Original-To: pgsql-sql@postgresql.org Received: from localhost (postgresql.org [64.49.215.8]) by postgresql.org (Postfix) with ESMTP id 91D7947613C for ; Fri, 31 Jan 2003 23:10:32 -0500 (EST) Received: from sss.pgh.pa.us (unknown [192.204.191.242]) by postgresql.org (Postfix) with ESMTP id 2F6B247618B for ; Fri, 31 Jan 2003 23:09:42 -0500 (EST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.12.6/8.12.6) with ESMTP id h1149V5u004110; Fri, 31 Jan 2003 23:09:32 -0500 (EST) To: Matthew Horoschun Cc: pgsql-sql@postgresql.org Subject: Re: Controlling access to Sequences In-reply-to: <2759DB60-351A-11D7-92E5-000393B3A702@canprint.com.au> References: <2759DB60-351A-11D7-92E5-000393B3A702@canprint.com.au> Comments: In-reply-to Matthew Horoschun message dated "Fri, 31 Jan 2003 23:47:27 +1100" Date: Fri, 31 Jan 2003 23:09:31 -0500 Message-ID: <4109.1044072571@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by AMaViS new-20020517 X-Archive-Number: 200301/531 X-Sequence-Number: 11396 Matthew Horoschun writes: > My understanding is that I need to GRANT the UPDATE privilege on the > SEQUENCE if I want a user to be able to to use nextval() on it. The > trouble is, if they can do a nextval() they can also do a setval() So? With enough time on your hands, you can apply nextval() often enough to get from any point A to any point B. It seems illusory to think that forbidding setval() makes things more secure. regards, tom lane