Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite3ce2de

Browse files
committed
Allow grant-level control of role inheritance behavior.
The GRANT statement can now specify WITH INHERIT TRUE or WITHINHERIT FALSE to control whether the member inherits the grantedrole's permissions. For symmetry, you can now likewise writeWITH ADMIN TRUE or WITH ADMIN FALSE to turn ADMIN OPTION on or off.If a GRANT does not specify WITH INHERIT, the behavior based onwhether the member role is marked INHERIT or NOINHERIT. This meansthat if all roles are marked INHERIT or NOINHERIT before any rolegrants are performed, the behavior is identical to what we had before;otherwise, it's different, because ALTER ROLE [NO]INHERIT now onlychanges the default behavior of future grants, and has no effect onexisting ones.Patch by me. Reviewed and testing by Nathan Bossart and Tushar Ahuja,with design-level comments from various others.Discussion:http://postgr.es/m/CA+Tgmoa5Sf4PiWrfxA=sGzDKg0Ojo3dADw=wAHOhR9dggV=RmQ@mail.gmail.com
1 parent2059c5e commite3ce2de

File tree

15 files changed

+385
-115
lines changed

15 files changed

+385
-115
lines changed

‎doc/src/sgml/catalogs.sgml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1717,6 +1717,16 @@ SCRAM-SHA-256$<replaceable>&lt;iteration count&gt;</replaceable>:<replaceable>&l
17171717
<structfield>roleid</structfield> to others
17181718
</para></entry>
17191719
</row>
1720+
1721+
<row>
1722+
<entry role="catalog_table_entry"><para role="column_definition">
1723+
<structfield>inherit_option</structfield> <type>bool</type>
1724+
</para>
1725+
<para>
1726+
True if the member automatically inherits the privileges of the
1727+
granted role
1728+
</para></entry>
1729+
</row>
17201730
</tbody>
17211731
</tgroup>
17221732
</table>

‎doc/src/sgml/ref/create_role.sgml

Lines changed: 18 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -133,17 +133,24 @@ in sync when changing the above synopsis!
133133
<term><literal>NOINHERIT</literal></term>
134134
<listitem>
135135
<para>
136-
These clauses determine whether a role <quote>inherits</quote> the
137-
privileges of roles it is a member of.
138-
A role with the <literal>INHERIT</literal> attribute can automatically
139-
use whatever database privileges have been granted to all roles
140-
it is directly or indirectly a member of.
141-
Without <literal>INHERIT</literal>, membership in another role
142-
only grants the ability to <command>SET ROLE</command> to that other role;
143-
the privileges of the other role are only available after having
144-
done so.
145-
If not specified,
146-
<literal>INHERIT</literal> is the default.
136+
When the <literal>GRANT</literal> statement is used to confer
137+
membership in one role to another role, the <literal>GRANT</literal>
138+
may use the <literal>WITH INHERIT</literal> clause to specify whether
139+
the privileges of the granted role should be <quote>inherited</quote>
140+
by the new member. If the <literal>GRANT</literal> statement does not
141+
specify either inheritance behavior, the new <literal>GRANT</literal>
142+
will be created <literal>WITH INHERIT TRUE</literal> if the member
143+
role is set to <literal>INHERIT</literal> and to
144+
<literal>WITH INHERIT FALSE</literal> if it is set to
145+
<literal>NOINHERIT</literal>.
146+
</para>
147+
148+
<para>
149+
In <productname>PostgreSQL</productname> versions before 16,
150+
the <literal>GRANT</literal> statement did not support
151+
<literal>WITH INHERIT</literal>. Therefore, changing this role-level
152+
property would also change the behavior of already-existing grants.
153+
This is no longer the case.
147154
</para>
148155
</listitem>
149156
</varlistentry>

‎doc/src/sgml/ref/grant.sgml

Lines changed: 24 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,7 @@ GRANT { USAGE | ALL [ PRIVILEGES ] }
9898
[ GRANTED BY <replaceable class="parameter">role_specification</replaceable> ]
9999

100100
GRANT <replaceable class="parameter">role_name</replaceable> [, ...] TO <replaceable class="parameter">role_specification</replaceable> [, ...]
101-
[ WITH ADMIN OPTION ]
101+
[ WITH{ADMIN| INHERIT } {OPTION | TRUE | FALSE } ]
102102
[ GRANTED BY <replaceable class="parameter">role_specification</replaceable> ]
103103

104104
<phrase>where <replaceable class="parameter">role_specification</replaceable> can be:</phrase>
@@ -255,7 +255,17 @@ GRANT <replaceable class="parameter">role_name</replaceable> [, ...] TO <replace
255255
</para>
256256

257257
<para>
258-
If <literal>WITH ADMIN OPTION</literal> is specified, the member can
258+
The effect of membership in a role can be modified by specifying the
259+
<literal>ADMIN</literal> or <literal>INHERIT</literal> option, each
260+
of which can be set to either <literal>TRUE</literal> or
261+
<literal>FALSE</literal>. The keyword <literal>OPTION</literal> is accepted
262+
as a synonym for <literal>TRUE</literal>, so that
263+
<literal>WITH ADMIN OPTION</literal>
264+
is a synonym for <literal>WITH ADMIN TRUE</literal>.
265+
</para>
266+
267+
<para>
268+
The <literal>ADMIN</literal> option allows the member to
259269
in turn grant membership in the role to others, and revoke membership
260270
in the role as well. Without the admin option, ordinary users cannot
261271
do that. A role is not considered to hold <literal>WITH ADMIN
@@ -265,6 +275,18 @@ GRANT <replaceable class="parameter">role_name</replaceable> [, ...] TO <replace
265275
in any role that is not a superuser.
266276
</para>
267277

278+
<para>
279+
The <literal>INHERIT</literal> option, if it is set to
280+
<literal>TRUE</literal>, causes the member to inherit the privileges of
281+
the granted role. That is, it can automatically use whatever database
282+
privileges have been granted to that role. If set to
283+
<literal>FALSE</literal>, the member does not inherit the privileges
284+
of the granted role. If this clause is not specified, it defaults to
285+
true if the member role is set to <literal>INHERIT</literal> and to false
286+
if the member role is set to <literal>NOINHERIT</literal>.
287+
See <link linkend="sql-createrole"><command>CREATE ROLE</command></link>.
288+
</para>
289+
268290
<para>
269291
If <literal>GRANTED BY</literal> is specified, the grant is recorded as
270292
having been done by the specified role. A user can only attribute a grant

‎doc/src/sgml/ref/revoke.sgml

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ REVOKE [ GRANT OPTION FOR ]
125125
[ GRANTED BY <replaceable class="parameter">role_specification</replaceable> ]
126126
[ CASCADE | RESTRICT ]
127127

128-
REVOKE [ ADMIN OPTION FOR ]
128+
REVOKE [{ADMIN | INHERIT } OPTION FOR ]
129129
<replaceable class="parameter">role_name</replaceable> [, ...] FROM <replaceable class="parameter">role_specification</replaceable> [, ...]
130130
[ GRANTED BY <replaceable class="parameter">role_specification</replaceable> ]
131131
[ CASCADE | RESTRICT ]
@@ -206,6 +206,13 @@ REVOKE [ ADMIN OPTION FOR ]
206206
allow the noise word <literal>GROUP</literal>
207207
in <replaceable class="parameter">role_specification</replaceable>.
208208
</para>
209+
210+
<para>
211+
Just as <literal>ADMIN OPTION</literal> can be removed from an existing
212+
role grant, it is also possible to revoke <literal>INHERIT OPTION</literal>.
213+
This is equivalent to setting the value of that option to
214+
<literal>FALSE</literal>.
215+
</para>
209216
</refsect1>
210217

211218
<refsect1 id="sql-revoke-notes">

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp