Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf3839ea

Browse files
committed
Remove ALTER DEFAULT PRIVILEGES' requirement of schema CREATE permissions.
Per discussion, this restriction isn't needed for any real security reason,and it seems to confuse people more often than it helps them. It couldalso result in some database states being unrestorable. So just drop it.Back-patch to 9.0, where ALTER DEFAULT PRIVILEGES was introduced.
1 parent007556b commitf3839ea

File tree

2 files changed

+14
-15
lines changed

2 files changed

+14
-15
lines changed

‎doc/src/sgml/ref/alter_default_privileges.sgml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,8 @@ REVOKE [ GRANT OPTION FOR ]
121121
<term><replaceable>schema_name</replaceable></term>
122122
<listitem>
123123
<para>
124-
The name of an existing schema.Each <replaceable>target_role</>
125-
must have <literal>CREATE</> privileges for each specified schema.
124+
The name of an existing schema.If specified, the default privileges
125+
are altered for objects later created in that schema.
126126
If <literal>IN SCHEMA</> is omitted, the global default privileges
127127
are altered.
128128
</para>

‎src/backend/catalog/aclchk.c

Lines changed: 12 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1039,27 +1039,26 @@ SetDefaultACLsInSchemas(InternalDefaultACL *iacls, List *nspnames)
10391039
}
10401040
else
10411041
{
1042-
/* Look up the schema OIDs anddo permissionschecks */
1042+
/* Look up the schema OIDs andset permissionsfor each one */
10431043
ListCell*nspcell;
10441044

10451045
foreach(nspcell,nspnames)
10461046
{
10471047
char*nspname=strVal(lfirst(nspcell));
1048-
AclResultaclresult;
10491048

1050-
/*
1051-
* Note that we must do the permissions check against the target
1052-
* role not the calling user. We require CREATE privileges, since
1053-
* without CREATE you won't be able to do anything using the
1054-
* default privs anyway.
1055-
*/
10561049
iacls->nspid=get_namespace_oid(nspname, false);
10571050

1058-
aclresult=pg_namespace_aclcheck(iacls->nspid,iacls->roleid,
1059-
ACL_CREATE);
1060-
if (aclresult!=ACLCHECK_OK)
1061-
aclcheck_error(aclresult,ACL_KIND_NAMESPACE,
1062-
nspname);
1051+
/*
1052+
* We used to insist that the target role have CREATE privileges
1053+
* on the schema, since without that it wouldn't be able to create
1054+
* an object for which these default privileges would apply.
1055+
* However, this check proved to be more confusing than helpful,
1056+
* and it also caused certain database states to not be
1057+
* dumpable/restorable, since revoking CREATE doesn't cause
1058+
* default privileges for the schema to go away. So now, we just
1059+
* allow the ALTER; if the user lacks CREATE he'll find out when
1060+
* he tries to create an object.
1061+
*/
10631062

10641063
SetDefaultACL(iacls);
10651064
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp