* Andrew Dunstan <andrew(at)dunslane(dot)net> [090630 09:08]:
> Aidan Van Dyk wrote:
>> *especially* if those grants remain "by reference", i.e. If I change the
>> GRANTS/REVOKES on sensitive_table, those are automatically "apply" to all
>> tables created with the "WITH GRANTS LIKE sensitive_table"...
> Isn't that exactly what Tom is objecting to, namely that the permissions
> of an object would not be contained entirely in catalog entry for the
> object itself?
Well, it depends on how it's done... If one of the permissions on an
object you can assign is "look at $X", the you don't get the "hidden
permissions" problem. The object itself still contains everything you
need to "trace" the permissions of an object...
I have no idea if it's something that even half-aligns with the internal
Aidan Van Dyk Create like a god,
aidan(at)highrise(dot)ca command like a king,
http://www.highrise.ca/ work like a slave.
In response to
pgsql-hackers by date
|Next:||From: Merlin Moncure||Date: 2009-06-30 13:26:23|
|Subject: Re: use of pg_stat_database|
|Previous:||From: Merlin Moncure||Date: 2009-06-30 13:11:39|
|Subject: Re: 8.5 development schedule|