Skip site navigation (1) Skip section navigation (2)

Re: [GENERAL] column-level update privs + lock table

From: Josh Kupershmidt <schmiddy(at)gmail(dot)com>
To: Robert Haas <robertmhaas(at)gmail(dot)com>
Cc: KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com>, Simon Riggs <simon(at)2ndquadrant(dot)com>, pgsql-hackers <pgsql-hackers(at)postgresql(dot)org>
Subject: Re: [GENERAL] column-level update privs + lock table
Date: 2010-11-28 15:34:21
Message-ID: AANLkTi=tTPo9mddKC8WEzu8Ge23s2+Z10roQm7-kUy_C@mail.gmail.com (view raw or flat)
Thread:
Lists: pgsql-generalpgsql-hackers
On Fri, Nov 26, 2010 at 7:11 PM, Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> I'm not totally convinced that this is the correct behavior.  It seems
> a bit surprising that UPDATE privilege on a single column is enough to
> lock out all SELECT activity from the table.  It's actually a bit
> surprising that even full-table UPDATE privileges are enough to do
> this, but this change would allow people to block access to data they
> can neither see nor modify.  That seems counterintuitive, if not a
> security hole.

The way I see it, it's a Good Thing to encourage people to assign
UPDATE privileges on tables only as minimally as possible. The damage
that a poorly coded or malicious user can do with LOCK TABLE
privileges is insignificant next to the damage they can do with more
UPDATE privileges than they really need.

Right now, we're basically encouraging admins to grant full-table
update privileges when that's not really necessary.

If, in the future, Postgres supports the ability to LOCK TABLE only on
specific columns, I think we could refine this permissions check so
that column-level update privileges only allowed the user to lock
those columns. But I think this patch is a step in the right
direction.

Josh

In response to

pgsql-hackers by date

Next:From: Tom LaneDate: 2010-11-28 16:29:02
Subject: Re: [PATCH] Return command tag 'REPLACE X' for CREATE OR REPLACE statements.
Previous:From: Marti RaudseppDate: 2010-11-28 15:14:53
Subject: [PATCH] Return command tag 'REPLACE X' for CREATE OR REPLACE statements.

pgsql-general by date

Next:From: Simon RiggsDate: 2010-11-28 16:35:13
Subject: Re: [GENERAL] column-level update privs + lock table
Previous:From: Matthew WaldenDate: 2010-11-28 11:54:49
Subject: Re: Question about OID and TCID

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group