Skip site navigation (1) Skip section navigation (2)

Re: pre-proposal: permissions made easier

From: Aidan Van Dyk <aidan(at)highrise(dot)ca>
To: Andrew Dunstan <andrew(at)dunslane(dot)net>
Cc: Greg Stark <gsstark(at)mit(dot)edu>, Josh Berkus <josh(at)agliodbs(dot)com>,Jeff Davis <pgsql(at)j-davis(dot)com>, David Fetter <david(at)fetter(dot)org>,Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: pre-proposal: permissions made easier
Date: 2009-06-30 13:12:54
Message-ID: 20090630131254.GC8417@yugib.highrise.ca (view raw or flat)
Thread:
Lists: pgsql-hackers
* Andrew Dunstan <andrew(at)dunslane(dot)net> [090630 09:08]:
>
>
> Aidan Van Dyk wrote:
>>
>> *especially* if those grants remain "by reference", i.e. If I change the
>> GRANTS/REVOKES on sensitive_table, those are automatically "apply" to all
>> tables created with the "WITH GRANTS LIKE sensitive_table"...
>>
>>
>>   
>
> Isn't that exactly what Tom is objecting to, namely that the permissions  
> of an object would not be contained entirely in catalog entry for the  
> object itself?

Well, it depends on how it's done... If one of the permissions on an
object you can assign is "look at $X", the you don't get the "hidden
permissions" problem.  The object itself still contains everything you
need to "trace" the permissions of an object...

I have no idea if it's something that even half-aligns with the internal
permission model/code...

a.

-- 
Aidan Van Dyk                                             Create like a god,
aidan(at)highrise(dot)ca                                       command like a king,
http://www.highrise.ca/                                   work like a slave.

In response to

pgsql-hackers by date

Next:From: Merlin MoncureDate: 2009-06-30 13:26:23
Subject: Re: use of pg_stat_database
Previous:From: Merlin MoncureDate: 2009-06-30 13:11:39
Subject: Re: 8.5 development schedule

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group