Skip site navigation (1) Skip section navigation (2)

Re: BUG #1150: grant options not properly checked

From: Fabien COELHO <coelho(at)cri(dot)ensmp(dot)fr>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: pgsql-bugs(at)postgresql(dot)org, Peter Eisentraut <peter_e(at)gmx(dot)net>
Subject: Re: BUG #1150: grant options not properly checked
Date: 2004-05-11 14:17:23
Message-ID: Pine.LNX.4.58.0405111606380.21629@sablons.cri.ensmp.fr (view raw or flat)
Thread:
Lists: pgsql-bugs
Dear Tom,

> > It seems that GRANT ALL ON SCHEMA does not properly
> > check for grantor rights.
>
> What's happening is that pg_namespace_aclcheck() allows the operation
> if you have GRANT OPTION for *any* of the rights to be granted.  The
> same problem exists for all object types.

I did not had time to go to the source code, but I thought it was likely
to be a generic bug.

> I am not sure whether we should refuse the operation or just narrow
> the set of privileges to those that are grantable per GRANT OPTION.
> Peter, any thoughts?

I'm not Peter, but I have an answer anyway: the standard says it should be
narrowed.

ISO/IEC 9075-2:2003 (E)
12.3 <privileges>
...
Syntax Rules
1) ALL PRIVILEGES is equivalent to the specification of all of the
privileges on <object name> for which the <grantor> has grantable
privilege descriptors.

-- 
Fabien Coelho - coelho(at)cri(dot)ensmp(dot)fr

In response to

Responses

pgsql-bugs by date

Next:From: Tom LaneDate: 2004-05-11 14:54:11
Subject: Re: BUG #1150: grant options not properly checked
Previous:From: Tom LaneDate: 2004-05-11 13:37:09
Subject: Re: BUG #1150: grant options not properly checked

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group