Re: Additional role attributes && superuser review

* Simon Riggs (simon(at)2ndQuadrant(dot)com) wrote:
> On 16 October 2014 20:37, Stephen Frost <sfrost(at)snowman(dot)net> wrote:
>
> >> How about
> >>
> >> GRANT EXECUTE [PRIVILEGES] ON CAPABILITY foo TO bar;
> >>
> >> That is similar to granting execution privs on a function. And I think
> >> gets round the keyword issue?
> >
> > No, it doesn't.. EXECUTE isn't reserved at all.
>
> Yet GRANT EXECUTE is already valid syntax, so that should work.

Yeah, sorry, the issue with the above is that the "ON CAPABILITY" would
mean CAPABILITY needs to be reserved as otherwise we don't know if it's
a function or something else.

The keyword issue is with

GRANT <something> TO <role>;

As <something> could be a role.

Not sure offhand if

GRANT EXECUTE PRIVILEGES ON CAPABILITY foo TO bar;

would work.. In general, I'm not anxious to get involved in the
SQL-specified GRANT syntax though unless there's really good reason to.

Also, these aren't like normally granted privileges which can have an
ADMIN option and which are inheirited through role membership..

Thanks,

Stephen