Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitff6de57

Browse files
committed
Doc: clarify behavior of ALTER DEFAULT PRIVILEGES ... IN SCHEMA.
The existing text stated that "Default privileges that are specifiedper-schema are added to whatever the global default privileges are forthe particular object type". However, that bare-bones observation isnot quite clear enough, as demonstrated by the complaint in bug #16124.Flesh it out by stating explicitly that you can't revoke built-indefault privileges this way, and by providing an example to drivethe point home.Back-patch to all supported branches, since it's been like thisfrom the beginning.Discussion:https://postgr.es/m/16124-423d8ee4358421bc@postgresql.org
1 parentd898edf commitff6de57

File tree

1 file changed

+23
-7
lines changed

1 file changed

+23
-7
lines changed

‎doc/src/sgml/ref/alter_default_privileges.sgml

Lines changed: 23 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -106,9 +106,7 @@ REVOKE [ GRANT OPTION FOR ]
106106
You can change default privileges only for objects that will be created by
107107
yourself or by roles that you are a member of. The privileges can be set
108108
globally (i.e., for all objects created in the current database),
109-
or just for objects created in specified schemas. Default privileges
110-
that are specified per-schema are added to whatever the global default
111-
privileges are for the particular object type.
109+
or just for objects created in specified schemas.
112110
</para>
113111

114112
<para>
@@ -120,6 +118,16 @@ REVOKE [ GRANT OPTION FOR ]
120118
<command>ALTER DEFAULT PRIVILEGES</command>.
121119
</para>
122120

121+
<para>
122+
Default privileges that are specified per-schema are added to whatever
123+
the global default privileges are for the particular object type.
124+
This means you cannot revoke privileges per-schema if they are granted
125+
globally (either by default, or according to a previous <command>ALTER
126+
DEFAULT PRIVILEGES</command> command that did not specify a schema).
127+
Per-schema <literal>REVOKE</literal> is only useful to reverse the
128+
effects of a previous per-schema <literal>GRANT</literal>.
129+
</para>
130+
123131
<refsect2>
124132
<title>Parameters</title>
125133

@@ -142,8 +150,8 @@ REVOKE [ GRANT OPTION FOR ]
142150
are altered for objects later created in that schema.
143151
If <literal>IN SCHEMA</literal> is omitted, the global default privileges
144152
are altered.
145-
<literal>IN SCHEMA</literal> is not allowed whenusing <literal>ON SCHEMAS</literal>
146-
as schemas can't be nested.
153+
<literal>IN SCHEMA</literal> is not allowed whensetting privileges
154+
for schemas, since schemas can't be nested.
147155
</para>
148156
</listitem>
149157
</varlistentry>
@@ -213,10 +221,18 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA myschema REVOKE INSERT ON TABLES FROM webuser
213221
<para>
214222
Remove the public EXECUTE permission that is normally granted on functions,
215223
for all functions subsequently created by role <literal>admin</literal>:
216-
217224
<programlisting>
218225
ALTER DEFAULT PRIVILEGES FOR ROLE admin REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
219-
</programlisting></para>
226+
</programlisting>
227+
Note however that you <emphasis>cannot</emphasis> accomplish that effect
228+
with a command limited to a single schema. This command has no effect,
229+
unless it is undoing a matching <literal>GRANT</literal>:
230+
<programlisting>
231+
ALTER DEFAULT PRIVILEGES IN SCHEMA public REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC;
232+
</programlisting>
233+
That's because per-schema default privileges can only add privileges to
234+
the global setting, not remove privileges granted by it.
235+
</para>
220236
</refsect1>
221237

222238
<refsect1>

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp