Re: Extending grant insert on tables to sequences
"Jaime Casanova" <[email protected]>
| Newsgroups | gmane.comp.db.postgresql.devel.patches |
|---|---|
| Message-ID | <[email protected]> |
On Thu, May 22, 2008 at 1:18 PM, Jaime Casanova <[email protected]> wrote: > Hi, > > The idea of this patch is to avoid the need to make explicit grants on > sequences owned by tables. > I've noted that the patch i attached is an older version that doesn't compile because of a typo... Re-attaching right patch and fix documentation to indicate the new behaviour... we need an user visible message to indicate this implicit grant on the sequences? -- Atentamente, Jaime Casanova Soporte y capacitación de PostgreSQL Guayaquil - Ecuador Cel. (593) 087171157 -- Sent via pgsql-patches mailing list ([email protected]) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-patches
grant_seq.patch
(text/plain, 3.5 KB)
Index: doc/src/sgml/ref/grant.sgml
===================================================================
RCS file: /projects/cvsroot/pgsql/doc/src/sgml/ref/grant.sgml,v
retrieving revision 1.68
diff -c -r1.68 grant.sgml
*** doc/src/sgml/ref/grant.sgml 5 May 2008 01:21:03 -0000 1.68
--- doc/src/sgml/ref/grant.sgml 24 May 2008 04:46:36 -0000
***************
*** 387,396 ****
</para>
<para>
! Granting permission on a table does not automatically extend
! permissions to any sequences used by the table, including
! sequences tied to <type>SERIAL</> columns. Permissions on
! sequence must be set separately.
</para>
<para>
--- 387,395 ----
</para>
<para>
! Granting permission on a table automatically extend
! permissions to any sequences owned by the table, including
! sequences tied to <type>SERIAL</> columns.
</para>
<para>
Index: src/backend/catalog/aclchk.c
===================================================================
RCS file: /projects/cvsroot/pgsql/src/backend/catalog/aclchk.c,v
retrieving revision 1.146
diff -c -r1.146 aclchk.c
*** src/backend/catalog/aclchk.c 12 May 2008 00:00:46 -0000 1.146
--- src/backend/catalog/aclchk.c 24 May 2008 04:46:45 -0000
***************
*** 360,365 ****
--- 360,402 ----
}
ExecGrantStmt_oids(&istmt);
+
+ /*
+ * If the objtype is a relation and the privileges includes INSERT, UPDATE
+ * or SELECT then extends the GRANT/REVOKE to the sequences owned by the
+ * relation
+ */
+ if ((istmt.objtype == ACL_OBJECT_RELATION) &&
+ (istmt.privileges & (ACL_INSERT | ACL_UPDATE | ACL_SELECT)))
+ {
+ AclMode priv;
+ foreach(cell, istmt.objects)
+ {
+ InternalGrant istmt_seq;
+
+ istmt_seq.is_grant = istmt.is_grant;
+ istmt_seq.objtype = ACL_OBJECT_SEQUENCE;
+ istmt_seq.grantees = istmt.grantees;
+ istmt_seq.grant_option = istmt.grant_option;
+ istmt_seq.behavior = istmt.behavior;
+
+ istmt_seq.all_privs = false;
+ istmt_seq.privileges = ACL_NO_RIGHTS;
+
+ istmt_seq.objects = getOwnedSequences(lfirst_oid(cell));
+ if (istmt_seq.objects != NIL)
+ {
+ if (istmt.privileges & (ACL_INSERT))
+ istmt_seq.privileges |= ACL_USAGE;
+ else if (istmt.privileges & (ACL_UPDATE))
+ istmt_seq.privileges |= ACL_UPDATE;
+ else if (istmt.privileges & (ACL_SELECT))
+ istmt_seq.privileges |= ACL_SELECT;
+
+ ExecGrantStmt_oids(&istmt_seq);
+ }
+ }
+ }
}
/*
Index: src/test/regress/expected/dependency.out
===================================================================
RCS file: /projects/cvsroot/pgsql/src/test/regress/expected/dependency.out,v
retrieving revision 1.6
diff -c -r1.6 dependency.out
*** src/test/regress/expected/dependency.out 5 May 2008 01:21:03 -0000 1.6
--- src/test/regress/expected/dependency.out 24 May 2008 04:46:59 -0000
***************
*** 16,22 ****
DETAIL: access to table deptest
DROP GROUP regression_group;
ERROR: role "regression_group" cannot be dropped because some objects depend on it
! DETAIL: access to table deptest
-- if we revoke the privileges we can drop the group
REVOKE SELECT ON deptest FROM GROUP regression_group;
DROP GROUP regression_group;
--- 16,23 ----
DETAIL: access to table deptest
DROP GROUP regression_group;
ERROR: role "regression_group" cannot be dropped because some objects depend on it
! DETAIL: access to sequence deptest_f1_seq
! access to table deptest
-- if we revoke the privileges we can drop the group
REVOKE SELECT ON deptest FROM GROUP regression_group;
DROP GROUP regression_group;