X-Original-To: pgsql-sql-postgresql.org@localhost.postgresql.org Received: from localhost (av.hub.org [200.46.204.144]) by postgresql.org (Postfix) with ESMTP id 646DF9DC843 for ; Mon, 13 Mar 2006 11:27:33 -0400 (AST) Received: from postgresql.org ([200.46.204.71]) by localhost (av.hub.org [200.46.204.144]) (amavisd-new, port 10024) with ESMTP id 67500-10 for ; Mon, 13 Mar 2006 11:27:37 -0400 (AST) X-Greylist: from auto-whitelisted by SQLgrey- Received: from sss.pgh.pa.us (sss.pgh.pa.us [66.207.139.130]) by postgresql.org (Postfix) with ESMTP id 401929DC813 for ; Mon, 13 Mar 2006 11:27:30 -0400 (AST) Received: from sss2.sss.pgh.pa.us (tgl@localhost [127.0.0.1]) by sss.pgh.pa.us (8.13.1/8.13.1) with ESMTP id k2DFRRFE007413; Mon, 13 Mar 2006 10:27:27 -0500 (EST) To: "Eugene E." cc: pgsql-sql@postgresql.org Subject: Re: Permission to Select In-reply-to: <441540AA.3090202@bankir.ru> References: <441540AA.3090202@bankir.ru> Comments: In-reply-to "Eugene E." message dated "Mon, 13 Mar 2006 12:51:38 +0300" Date: Mon, 13 Mar 2006 10:27:27 -0500 Message-ID: <7412.1142263647@sss.pgh.pa.us> From: Tom Lane X-Virus-Scanned: by amavisd-new at hub.org X-Spam-Status: No, score=0.112 required=5 tests=[AWL=0.112] X-Spam-Score: 0.112 X-Spam-Level: X-Archive-Number: 200603/192 X-Sequence-Number: 24538 "Eugene E." writes: > db=# REVOKE all ON t FROM u; > db=# GRANT update,insert,delete ON t TO u; > db=# \c - u > db=> INSERT INTO t VALUES (1,'x'); > INSERT > db=> UPDATE t SET a='y' WHERE i=1; > ERROR: Permission denied for relation t; > db=> UPDATE t SET a='y'; > UPDATE This behavior is correct and as documented in the UPDATE reference page: You must have the UPDATE privilege on the table to update it, as well as the SELECT privilege to any table whose values are read in the expressions or condition. The use of "i" in the WHERE clause is what causes SELECT privilege to be needed. If we had per-column privileges then we could be finer-grained about it, but we don't (yet). > Please examine the following patch and make your judgment: This patch is so wrong it's not even worth discussing :-( regards, tom lane