Strange security behaviour!

From: "Lotus Luby-Loo" <lotuslubyloo(at)hotmail(dot)com>
To: pgsql-admin(at)postgresql(dot)org, pgsql-bugs(at)postgresql(dot)org
Subject: Strange security behaviour!
Date: 2001-06-22 15:59:08
Message-ID: F66dMNFmWAFsTmIClmp000094ea@hotmail.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-admin pgsql-bugs

Hello to all,

Currently I'm using version 7.1

I got a strange security behaviour. Please find attached my init.sql script
for my tables:

>psql -d test -U admin -c "\dp entry_t"
Access permissions for database "test"
Relation | Access permissions
----------------+---------------------------------------------------------
entry_t | {"=","csczeyka=arwR","admin=arw","anonym=r","helper=r"}
entry_t_id_seq |
(2 rows)

>psql -d test -U admin -c "\d entry_t"
Table "entry_t"
Attribute | Type | Modifier
------------+---------+----------------------------------------------------
id | integer | not null default nextval('"entry_t_id_seq"'::text)
ent_seq | integer |
upd_date | date | not null
upd_txt | text |
upd_author | integer |
chk_date | date | not null
chk_txt | text |
chk_author | integer |
Index: entry_t_pkey

Basically, now "admin" can insert new rows into "entry_t", but not "anonym"
or "helper". So let's see:

>psql -d test -U admin -c "INSERT INTO entry_t (upd_date, chk_date) VALUES
>(CURRENT_DATE, CURRENT_DATE);"
ERROR: entry_t_id_seq.nextval: you don't have permissions to set sequence
entry_t_id_seq

upsy???

>psql -d test -U helper -c "INSERT INTO entry_t (upd_date, chk_date) VALUES
>(CURRENT_DATE , CURRENT_DATE);"
INSERT 1861619 1

upsy??????????

>psql -d test -U anonym -c "INSERT INTO entry_t (upd_date, chk_date) VALUES
>(CURRENT_DATE
, CURRENT_DATE);"
ERROR: entry_t: Permission denied.

finally this is okay.

I just wonder, what is the DBs behaviour on your system?

I hope it's just a stupid beginners fault.

ThX for helping,
Chris (lotuslubyloo(at)---no-spam---hotmail(dot)com)
_________________________________________________________________________
Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com.

Attachment Content-Type Size
init.sql text/plain 23.5 KB
destroy.sql text/plain 2.1 KB

Browse pgsql-admin by date

  From Date Subject
Next Message Dave Cramer 2001-06-22 19:09:40 RE: Re: [ADMIN] High memory usage [PATCH]
Previous Message Lotus Luby-Loo 2001-06-22 15:46:20

Browse pgsql-bugs by date

  From Date Subject
Next Message Hiroshi Inoue 2001-06-23 02:53:33 RE: Truncation Problems
Previous Message Lotus Luby-Loo 2001-06-22 15:46:20