🌐 AI搜索 & 代理 主页
Skip to content

Commit 4b2dafc

Browse files
tglsfdctglsfdc
committed
Align GRANT/REVOKE behavior more closely with the SQL spec, per discussion
of bug report #1150. Also, arrange that the object owner's irrevocable grant-option permissions are handled implicitly by the system rather than being listed in the ACL as self-granted rights (which was wrong anyway). I did not take the further step of showing these permissions in an explicit 'granted by _SYSTEM' ACL entry, as that seemed more likely to bollix up existing clients than to do anything really useful. It's still a possible future direction, though.
1 parent f35e8d8 commit 4b2dafc

File tree

7 files changed

+764
-334
lines changed

7 files changed

+764
-334
lines changed

‎doc/src/sgml/ref/grant.sgml‎

Lines changed: 46 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/ref/grant.sgml,v 1.39 2004/03/22 03:38:24 momjian Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/ref/grant.sgml,v 1.40 2004/06/01 21:49:21 tgl Exp $
33
PostgreSQL documentation
44
-->
55

@@ -67,9 +67,10 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
6767

6868
<para>
6969
If <literal>WITH GRANT OPTION</literal> is specified, the recipient
70-
of the privilege may in turn grant it to others. By default this
71-
is not allowed. Grant options can only be granted to individual
72-
users, not to groups or <literal>PUBLIC</literal>.
70+
of the privilege may in turn grant it to others. Without a grant
71+
option, the recipient cannot do that. At present, grant options can
72+
only be granted to individual users, not to groups or
73+
<literal>PUBLIC</literal>.
7374
</para>
7475

7576
<para>
@@ -79,8 +80,8 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
7980
however, choose to revoke some of his own privileges for safety.)
8081
The right to drop an object, or to alter its definition in any way is
8182
not described by a grantable privilege; it is inherent in the owner,
82-
and cannot be granted or revoked. It is not possible for the owner's
83-
grant options to be revoked, either.
83+
and cannot be granted or revoked. The owner implicitly has all grant
84+
options for the object, too.
8485
</para>
8586

8687
<para>
@@ -150,7 +151,7 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
150151
<term>RULE</term>
151152
<listitem>
152153
<para>
153-
Allows the creation of a rule on the table/view. (See <xref
154+
Allows the creation of a rule on the table/view. (See the <xref
154155
linkend="sql-createrule" endterm="sql-createrule-title"> statement.)
155156
</para>
156157
</listitem>
@@ -171,7 +172,7 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
171172
<term>TRIGGER</term>
172173
<listitem>
173174
<para>
174-
Allows the creation of a trigger on the specified table. (See
175+
Allows the creation of a trigger on the specified table. (See the
175176
<xref linkend="sql-createtrigger" endterm="sql-createtrigger-title"> statement.)
176177
</para>
177178
</listitem>
@@ -234,7 +235,7 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
234235
<term>ALL PRIVILEGES</term>
235236
<listitem>
236237
<para>
237-
Grant all of the privileges applicable to the object at once.
238+
Grant all of the available privileges at once.
238239
The <literal>PRIVILEGES</literal> key word is optional in
239240
<productname>PostgreSQL</productname>, though it is required by
240241
strict SQL.
@@ -257,6 +258,20 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
257258
to revoke access privileges.
258259
</para>
259260

261+
<para>
262+
When a non-owner of an object attempts to <command>GRANT</> privileges
263+
on the object, the command will fail outright if the user has no
264+
privileges whatsoever on the object. As long as some privilege is
265+
available, the command will proceed, but it will grant only those
266+
privileges for which the user has grant options. The <command>GRANT ALL
267+
PRIVILEGES</> forms will issue a warning message if no grant options are
268+
held, while the other forms will issue a warning if grant options for
269+
any of the privileges specifically named in the command are not held.
270+
(In principle these statements apply to the object owner as well, but
271+
since the owner is always treated as holding all grant options, the
272+
cases can never occur.)
273+
</para>
274+
260275
<para>
261276
It should be noted that database superusers can access
262277
all objects regardless of object privilege settings. This
@@ -273,10 +288,10 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
273288
</para>
274289

275290
<para>
276-
Currently, to grant privileges in <productname>PostgreSQL</productname>
277-
to only a few columns, you must
278-
create a view having the desired columns and then grant privileges
279-
to that view.
291+
Currently, <productname>PostgreSQL</productname> does not support
292+
granting or revoking privileges for individual columns of a table.
293+
One possible workaround is to create a view having just the desired
294+
columns and then grant privileges to that view.
280295
</para>
281296

282297
<para>
@@ -286,9 +301,9 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
286301
=> \z mytable
287302

288303
Access privileges for database "lusitania"
289-
Schema | Name | Type | Access privileges
290-
--------+---------+-------+-----------------------------------------------------------------
291-
public | mytable | table | {=r/postgres,miriam=arwdRxt/postgres,"group todos=arw/postgres"}
304+
Schema | Name | Type | Access privileges
305+
--------+---------+-------+------------------------------------------------------------
306+
public | mytable | table | {miriam=arwdRxt/miriam,=r/miriam,"group todos=arw/miriam"}
292307
(1 row)
293308
</programlisting>
294309
The entries shown by <command>\z</command> are interpreted thus:
@@ -331,7 +346,14 @@ and may include some privileges for <literal>PUBLIC</> depending on the
331346
object type, as explained above. The first <command>GRANT</> or
332347
<command>REVOKE</> on an object
333348
will instantiate the default privileges (producing, for example,
334-
<literal>{=,miriam=arwdRxt}</>) and then modify them per the specified request.
349+
<literal>{miriam=arwdRxt/miriam}</>) and then modify them per the
350+
specified request.
351+
</para>
352+
353+
<para>
354+
Notice that the owner's implicit grant options are not marked in the
355+
access privileges display. A <literal>*</> will appear only when
356+
grant options have been explicitly granted to someone.
335357
</para>
336358
</refsect1>
337359

@@ -347,11 +369,17 @@ GRANT INSERT ON films TO PUBLIC;
347369
</para>
348370

349371
<para>
350-
Grant all privileges to user <literal>manuel</literal> on view <literal>kinds</literal>:
372+
Grant all available privileges to user <literal>manuel</literal> on view
373+
<literal>kinds</literal>:
351374

352375
<programlisting>
353376
GRANT ALL PRIVILEGES ON kinds TO manuel;
354377
</programlisting>
378+
379+
Note that while the above will indeed grant all privileges if executed by a
380+
superuser or the owner of <literal>kinds</literal>, when executed by someone
381+
else it will only grant those permissions for which the someone else has
382+
grant options.
355383
</para>
356384
</refsect1>
357385

‎doc/src/sgml/ref/revoke.sgml‎

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.29 2003/11/29 19:51:39 pgsql Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.30 2004/06/01 21:49:21 tgl Exp $
33
PostgreSQL documentation
44
-->
55

@@ -81,6 +81,7 @@ REVOKE [ GRANT OPTION FOR ]
8181
<para>
8282
If <literal>GRANT OPTION FOR</literal> is specified, only the grant
8383
option for the privilege is revoked, not the privilege itself.
84+
Otherwise, both the privilege and the grant option are revoked.
8485
</para>
8586

8687
<para>
@@ -103,7 +104,7 @@ REVOKE [ GRANT OPTION FOR ]
103104

104105
<para>
105106
Use <xref linkend="app-psql">'s <command>\z</command> command to
106-
display the privileges granted on existing objects. See also <xref
107+
display the privileges granted on existing objects. See <xref
107108
linkend="sql-grant" endterm="sql-grant-title"> for information about the format.
108109
</para>
109110

@@ -114,9 +115,25 @@ REVOKE [ GRANT OPTION FOR ]
114115
C, then user A cannot revoke the privilege directly from C.
115116
Instead, user A could revoke the grant option from user B and use
116117
the <literal>CASCADE</literal> option so that the privilege is
117-
automatically revoked from user C.
118+
in turn revoked from user C. For another example, if both A and B
119+
have granted the same privilege to C, A can revoke his own grant
120+
but not B's grant, so C will still effectively have the privilege.
118121
</para>
119122

123+
<para>
124+
When a non-owner of an object attempts to <command>REVOKE</> privileges
125+
on the object, the command will fail outright if the user has no
126+
privileges whatsoever on the object. As long as some privilege is
127+
available, the command will proceed, but it will revoke only those
128+
privileges for which the user has grant options. The <command>REVOKE ALL
129+
PRIVILEGES</> forms will issue a warning message if no grant options are
130+
held, while the other forms will issue a warning if grant options for
131+
any of the privileges specifically named in the command are not held.
132+
(In principle these statements apply to the object owner as well, but
133+
since the owner is always treated as holding all grant options, the
134+
cases can never occur.)
135+
</para>
136+
120137
<para>
121138
If a superuser chooses to issue a <command>GRANT</> or <command>REVOKE</>
122139
command, the command is performed as though it were issued by the
@@ -140,11 +157,15 @@ REVOKE INSERT ON films FROM PUBLIC;
140157
</para>
141158

142159
<para>
143-
Revoke all privileges from user <literal>manuel</literal> on view <literal>kinds</literal>:
160+
Revoke all privileges from user <literal>manuel</literal> on view
161+
<literal>kinds</literal>:
144162

145-
<programlisting>
163+
<programlisting>
146164
REVOKE ALL PRIVILEGES ON kinds FROM manuel;
147165
</programlisting>
166+
167+
Note that this actually means <quote>revoke all privileges that I
168+
granted</>.
148169
</para>
149170
</refsect1>
150171

0 commit comments

Comments
 (0)