X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (av.hub.org [200.46.204.144]) by postgresql.org (Postfix) with ESMTP id 037F39DC99F for ; Tue, 14 Mar 2006 02:02:18 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 46443-09 for ; Tue, 14 Mar 2006 02:02:16 -0400 (AST) X-Greylist: delayed 20:06:45.867185 by SQLgrey- Received: from moon.antora.ru (moon.antora.ru [83.222.21.34]) by postgresql.org (Postfix) with ESMTP id 4F4EC9DC885 for ; Tue, 14 Mar 2006 02:02:11 -0400 (AST) Received: from [217.26.17.26] (helo=[10.0.0.72]) by moon.antora.ru with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256) (Exim 4.60 (FreeBSD)) (envelope-from ) id 1FJ2bi-000Nbq-Pq; Tue, 14 Mar 2006 09:02:11 +0300 Message-ID: <44165BD4.2040005@bankir.ru> Date: Tue, 14 Mar 2006 08:59:48 +0300 From: "Eugene E." User-Agent: Mozilla Thunderbird 1.0.2 (X11/20050517) X-Accept-Language: en-us, en MIME-Version: 1.0 To: Tom Lane CC: pgsql-sql@postgresql.org Subject: Re: Permission to Select References: <441540AA.3090202@bankir.ru> <7412.1142263647@sss.pgh.pa.us> In-Reply-To: <7412.1142263647@sss.pgh.pa.us> Content-Type: text/plain; charset=KOI8-R; format=flowed Content-Transfer-Encoding: 7bit X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, score=0.12 required=5 tests=[AWL=0.120] X-Spam-Score: 0.12 X-Spam-Level: X-Archive-Number: 200603/214 X-Sequence-Number: 24560 Tom Lane wrote: > "Eugene E." writes: > >>db=# REVOKE all ON t FROM u; >>db=# GRANT update,insert,delete ON t TO u; >>db=# \c - u > > >>db=> INSERT INTO t VALUES (1,'x'); >>INSERT >>db=> UPDATE t SET a='y' WHERE i=1; >>ERROR: Permission denied for relation t; >>db=> UPDATE t SET a='y'; >>UPDATE > > > This behavior is correct and as documented in the UPDATE reference page: Good if you have a strange behavior - just document it. quite good. > You must have the UPDATE privilege on the table to update it, as > well as the SELECT privilege to any table whose values are read > in the expressions or condition. This means that some privileges are NOT INDEPENDENT.