Index: doc/src/sgml/ref/grant.sgml =================================================================== RCS file: /projects/cvsroot/pgsql/doc/src/sgml/ref/grant.sgml,v retrieving revision 1.68 diff -c -r1.68 grant.sgml *** doc/src/sgml/ref/grant.sgml 5 May 2008 01:21:03 -0000 1.68 --- doc/src/sgml/ref/grant.sgml 24 May 2008 04:46:36 -0000 *************** *** 387,396 **** ! Granting permission on a table does not automatically extend ! permissions to any sequences used by the table, including ! sequences tied to SERIAL columns. Permissions on ! sequence must be set separately. --- 387,395 ---- ! Granting permission on a table automatically extend ! permissions to any sequences owned by the table, including ! sequences tied to SERIAL columns. Index: src/backend/catalog/aclchk.c =================================================================== RCS file: /projects/cvsroot/pgsql/src/backend/catalog/aclchk.c,v retrieving revision 1.146 diff -c -r1.146 aclchk.c *** src/backend/catalog/aclchk.c 12 May 2008 00:00:46 -0000 1.146 --- src/backend/catalog/aclchk.c 24 May 2008 04:46:45 -0000 *************** *** 360,365 **** --- 360,402 ---- } ExecGrantStmt_oids(&istmt); + + /* + * If the objtype is a relation and the privileges includes INSERT, UPDATE + * or SELECT then extends the GRANT/REVOKE to the sequences owned by the + * relation + */ + if ((istmt.objtype == ACL_OBJECT_RELATION) && + (istmt.privileges & (ACL_INSERT | ACL_UPDATE | ACL_SELECT))) + { + AclMode priv; + foreach(cell, istmt.objects) + { + InternalGrant istmt_seq; + + istmt_seq.is_grant = istmt.is_grant; + istmt_seq.objtype = ACL_OBJECT_SEQUENCE; + istmt_seq.grantees = istmt.grantees; + istmt_seq.grant_option = istmt.grant_option; + istmt_seq.behavior = istmt.behavior; + + istmt_seq.all_privs = false; + istmt_seq.privileges = ACL_NO_RIGHTS; + + istmt_seq.objects = getOwnedSequences(lfirst_oid(cell)); + if (istmt_seq.objects != NIL) + { + if (istmt.privileges & (ACL_INSERT)) + istmt_seq.privileges |= ACL_USAGE; + else if (istmt.privileges & (ACL_UPDATE)) + istmt_seq.privileges |= ACL_UPDATE; + else if (istmt.privileges & (ACL_SELECT)) + istmt_seq.privileges |= ACL_SELECT; + + ExecGrantStmt_oids(&istmt_seq); + } + } + } } /* Index: src/test/regress/expected/dependency.out =================================================================== RCS file: /projects/cvsroot/pgsql/src/test/regress/expected/dependency.out,v retrieving revision 1.6 diff -c -r1.6 dependency.out *** src/test/regress/expected/dependency.out 5 May 2008 01:21:03 -0000 1.6 --- src/test/regress/expected/dependency.out 24 May 2008 04:46:59 -0000 *************** *** 16,22 **** DETAIL: access to table deptest DROP GROUP regression_group; ERROR: role "regression_group" cannot be dropped because some objects depend on it ! DETAIL: access to table deptest -- if we revoke the privileges we can drop the group REVOKE SELECT ON deptest FROM GROUP regression_group; DROP GROUP regression_group; --- 16,23 ---- DETAIL: access to table deptest DROP GROUP regression_group; ERROR: role "regression_group" cannot be dropped because some objects depend on it ! DETAIL: access to sequence deptest_f1_seq ! access to table deptest -- if we revoke the privileges we can drop the group REVOKE SELECT ON deptest FROM GROUP regression_group; DROP GROUP regression_group;