NotificationsYou must be signed in to change notification settings
Fork6
Star31

Commit86be645

committed

Doc: improve discussion of object owners' inherent privileges.

In particular, clarify that the role membership mechanism allowsmembers to inherit the ownership privileges of an object's owningrole.Laurenz Albe, with some kibitzing by meDiscussion:https://postgr.es/m/504497aca66bf34bdcdd90bd0bcebdc3a33f577b.camel@cybertec.at

1 parenta28704a commit86be645Copy full SHA for 86be645

File tree

1 file changed

+13

-10

lines changed

doc/src/sgml
- ddl.sgml

1 file changed

+13

-10

lines changed

`‎doc/src/sgml/ddl.sgml‎`

Lines changed: 13 additions & 10 deletions

Original file line number	Diff line number	Diff line change
`@@ -1578,8 +1578,10 @@ ALTER TABLE products RENAME TO items;`
`1578`	`1578`	`</para>`
`1579`	`1579`
`1580`	`1580`	`<para>`
`1581`		`- The right to modify or destroy an object is always the privilege of`
`1582`		`- the owner only.`
	`1581`	`+ The right to modify or destroy an object is inherent in being the`
	`1582`	`+ object's owner, and cannot be granted or revoked in itself.`
	`1583`	`+ (However, like all privileges, that right can be inherited by`
	`1584`	`+ members of the owning role; see <xref linkend="role-membership"/>.)`
`1583`	`1585`	`</para>`
`1584`	`1586`
`1585`	`1587`	`<para>`
`@@ -1614,17 +1616,11 @@ GRANT UPDATE ON accounts TO joe;`
`1614`	`1616`	`</para>`
`1615`	`1617`
`1616`	`1618`	`<para>`
`1617`		`- To revoke a privilege, use the fittingly named`
	`1619`	`+ To revoke apreviously-grantedprivilege, use the fittingly named`
`1618`	`1620`	`<xref linkend="sql-revoke"/> command:`
`1619`	`1621`	`<programlisting>`
`1620`	`1622`	`REVOKE ALL ON accounts FROM PUBLIC;`
`1621`	`1623`	`</programlisting>`
`1622`		`- The special privileges of the object owner (i.e., the right to do`
`1623`		`- <command>DROP</command>, <command>GRANT</command>, <command>REVOKE</command>, etc.)`
`1624`		`- are always implicit in being the owner,`
`1625`		`- and cannot be granted or revoked. But the object owner can choose`
`1626`		`- to revoke their own ordinary privileges, for example to make a`
`1627`		`- table read-only for themselves as well as others.`
`1628`	`1624`	`</para>`
`1629`	`1625`
`1630`	`1626`	`<para>`
`@@ -1638,6 +1634,13 @@ REVOKE ALL ON accounts FROM PUBLIC;`
`1638`	`1634`	`<xref linkend="sql-revoke"/> reference pages.`
`1639`	`1635`	`</para>`
`1640`	`1636`
	`1637`	`+ <para>`
	`1638`	`+ An object's owner can choose to revoke their own ordinary privileges,`
	`1639`	`+ for example to make a table read-only for themselves as well as others.`
	`1640`	`+ But owners are always treated as holding all grant options, so they`
	`1641`	`+ can always re-grant their own privileges.`
	`1642`	`+ </para>`
	`1643`	`+`
`1641`	`1644`	`<para>`
`1642`	`1645`	`The available privileges are:`
`1643`	`1646`
`@@ -4695,7 +4698,7 @@ EXPLAIN SELECT count(*) FROM measurement WHERE logdate >= DATE '2008-01-01';`
`4695`	`4698`	`</itemizedlist>`
`4696`	`4699`	`</para>`
`4697`	`4700`	`</sect2>`
`4698`		`-`
	`4701`	`+`
`4699`	`4702`	`<sect2 id="ddl-partitioning-declarative-best-practices">`
`4700`	`4703`	`<title>Declarative Partitioning Best Practices</title>`
`4701`	`4704`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commit86be645

File tree

1 file changed

1 file changed

`‎doc/src/sgml/ddl.sgml‎`

0 commit comments