Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit787b3fd

Browse files
committed
Doc: clarify behavior of ALTER DEFAULT PRIVILEGES ... IN SCHEMA.
The existing text stated that "Default privileges that are specifiedper-schema are added to whatever the global default privileges are forthe particular object type". However, that bare-bones observation isnot quite clear enough, as demonstrated by the complaint in bug #16124.Flesh it out by stating explicitly that you can't revoke built-indefault privileges this way, and by providing an example to drivethe point home.Back-patch to all supported branches, since it's been like thisfrom the beginning.Discussion:https://postgr.es/m/16124-423d8ee4358421bc@postgresql.org
1 parent7f33836 commit787b3fd

File tree

1 file changed

+23
-7
lines changed

1 file changed

+23
-7
lines changed

‎doc/src/sgml/ref/alter_default_privileges.sgml

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -106,9 +106,7 @@ REVOKE [ GRANT OPTION FOR ]
106106
You can change default privileges only for objects that will be created by
107107
yourself or by roles that you are a member of. The privileges can be set
108108
globally (i.e., for all objects created in the current database),
109-
or just for objects created in specified schemas. Default privileges
110-
that are specified per-schema are added to whatever the global default
111-
privileges are for the particular object type.
109+
or just for objects created in specified schemas.
112110
</para>
113111

114112
<para>
@@ -120,6 +118,16 @@ REVOKE [ GRANT OPTION FOR ]
120118
<command>ALTER DEFAULT PRIVILEGES</command>.
121119
</para>
122120

121+
<para>
122+
Default privileges that are specified per-schema are added to whatever
123+
the global default privileges are for the particular object type.
124+
This means you cannot revoke privileges per-schema if they are granted
125+
globally (either by default, or according to a previous <command>ALTER
126+
DEFAULT PRIVILEGES</command> command that did not specify a schema).
127+
Per-schema <literal>REVOKE</literal> is only useful to reverse the
128+
effects of a previous per-schema <literal>GRANT</literal>.
129+
</para>
130+
123131
<refsect2>
124132
<title>Parameters</title>
125133

@@ -142,8 +150,8 @@ REVOKE [ GRANT OPTION FOR ]
142150
are altered for objects later created in that schema.
143151
If <literal>IN SCHEMA</literal> is omitted, the global default privileges
144152
are altered.
145-
<literal>IN SCHEMA</literal> is not allowed whenusing <literal>ON SCHEMAS</literal>
146-
as schemas can't be nested.
153+
<literal>IN SCHEMA</literal> is not allowed whensetting privileges
154+
for schemas, since schemas can't be nested.
147155
</para>
148156
</listitem>
149157
</varlistentry>
@@ -212,10 +220,18 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA myschema REVOKE INSERT ON TABLES FROM webuser
212220
<para>
213221
Remove the public EXECUTE permission that is normally granted on functions,
214222
for all functions subsequently created by role <literal>admin</literal>:
215-
216223
<programlisting>
217224
ALTER DEFAULT PRIVILEGES FOR ROLE admin REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
218-
</programlisting></para>
225+
</programlisting>
226+
Note however that you <emphasis>cannot</emphasis> accomplish that effect
227+
with a command limited to a single schema. This command has no effect,
228+
unless it is undoing a matching <literal>GRANT</literal>:
229+
<programlisting>
230+
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
231+
</programlisting>
232+
That's because per-schema default privileges can only add privileges to
233+
the global setting, not remove privileges granted by it.
234+
</para>
219235
</refsect1>
220236

221237
<refsect1>

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp