Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf7126b4

Browse files
committed
Doc: fix missing explanation of default object privileges.
The GRANT reference page, which lists the default privileges for newobjects, failed to mention that USAGE is granted by default for datatypes and domains. As a lesser sin, it also did not specify anythingabout the initial privileges for sequences, FDWs, foreign servers,or large objects. Fix that, and add a comment to acldefault() in theprobably vain hope of getting people to maintain this list in future.Noted by Laurenz Albe, though I editorialized on the wording a bit.Back-patch to all supported branches, since they all have this behavior.Discussion:https://postgr.es/m/1507620895.4152.1.camel@cybertec.at
1 parent7573d12 commitf7126b4

File tree

2 files changed

+18
-6
lines changed

2 files changed

+18
-6
lines changed

‎doc/src/sgml/ref/grant.sgml

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -149,12 +149,22 @@ GRANT <replaceable class="PARAMETER">role_name</replaceable> [, ...] TO <replace
149149
<para>
150150
PostgreSQL grants default privileges on some types of objects to
151151
<literal>PUBLIC</literal>. No privileges are granted to
152-
<literal>PUBLIC</literal> by default on tables,
153-
columns, schemas or tablespaces. For other types, the default privileges
152+
<literal>PUBLIC</literal> by default on
153+
tables,
154+
table columns,
155+
sequences,
156+
foreign data wrappers,
157+
foreign servers,
158+
large objects,
159+
schemas,
160+
or tablespaces.
161+
For other types of objects, the default privileges
154162
granted to <literal>PUBLIC</literal> are as follows:
155-
<literal>CONNECT</literal> and <literal>CREATE TEMP TABLE</literal> for
156-
databases; <literal>EXECUTE</literal> privilege for functions; and
157-
<literal>USAGE</literal> privilege for languages.
163+
<literal>CONNECT</literal> and <literal>TEMPORARY</literal> (create
164+
temporary tables) privileges for databases;
165+
<literal>EXECUTE</literal> privilege for functions; and
166+
<literal>USAGE</literal> privilege for languages and data types
167+
(including domains).
158168
The object owner can, of course, <command>REVOKE</command>
159169
both default and expressly granted privileges. (For maximum
160170
security, issue the <command>REVOKE</> in the same transaction that

‎src/backend/utils/adt/acl.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -722,7 +722,9 @@ hash_aclitem(PG_FUNCTION_ARGS)
722722
* acldefault() --- create an ACL describing default access permissions
723723
*
724724
* Change this routine if you want to alter the default access policy for
725-
* newly-created objects (or any object with a NULL acl entry).
725+
* newly-created objects (or any object with a NULL acl entry). When
726+
* you make a change here, don't forget to update the GRANT man page,
727+
* which explains all the default permissions.
726728
*
727729
* Note that these are the hard-wired "defaults" that are used in the
728730
* absence of any pg_default_acl entry.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp