Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit19989d8

Browse files
committed
Doc: fix missing explanation of default object privileges.
The GRANT reference page, which lists the default privileges for newobjects, failed to mention that USAGE is granted by default for datatypes and domains. As a lesser sin, it also did not specify anythingabout the initial privileges for sequences, FDWs, foreign servers,or large objects. Fix that, and add a comment to acldefault() in theprobably vain hope of getting people to maintain this list in future.Noted by Laurenz Albe, though I editorialized on the wording a bit.Back-patch to all supported branches, since they all have this behavior.Discussion:https://postgr.es/m/1507620895.4152.1.camel@cybertec.at
1 parent36c687a commit19989d8

File tree

2 files changed

+18
-6
lines changed

2 files changed

+18
-6
lines changed

‎doc/src/sgml/ref/grant.sgml

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -156,12 +156,22 @@ GRANT <replaceable class="PARAMETER">role_name</replaceable> [, ...] TO <replace
156156
<para>
157157
PostgreSQL grants default privileges on some types of objects to
158158
<literal>PUBLIC</literal>. No privileges are granted to
159-
<literal>PUBLIC</literal> by default on tables,
160-
columns, schemas or tablespaces. For other types, the default privileges
159+
<literal>PUBLIC</literal> by default on
160+
tables,
161+
table columns,
162+
sequences,
163+
foreign data wrappers,
164+
foreign servers,
165+
large objects,
166+
schemas,
167+
or tablespaces.
168+
For other types of objects, the default privileges
161169
granted to <literal>PUBLIC</literal> are as follows:
162-
<literal>CONNECT</literal> and <literal>CREATE TEMP TABLE</literal> for
163-
databases; <literal>EXECUTE</literal> privilege for functions; and
164-
<literal>USAGE</literal> privilege for languages.
170+
<literal>CONNECT</literal> and <literal>TEMPORARY</literal> (create
171+
temporary tables) privileges for databases;
172+
<literal>EXECUTE</literal> privilege for functions; and
173+
<literal>USAGE</literal> privilege for languages and data types
174+
(including domains).
165175
The object owner can, of course, <command>REVOKE</command>
166176
both default and expressly granted privileges. (For maximum
167177
security, issue the <command>REVOKE</> in the same transaction that

‎src/backend/utils/adt/acl.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -722,7 +722,9 @@ hash_aclitem(PG_FUNCTION_ARGS)
722722
* acldefault() --- create an ACL describing default access permissions
723723
*
724724
* Change this routine if you want to alter the default access policy for
725-
* newly-created objects (or any object with a NULL acl entry).
725+
* newly-created objects (or any object with a NULL acl entry). When
726+
* you make a change here, don't forget to update the GRANT man page,
727+
* which explains all the default permissions.
726728
*
727729
* Note that these are the hard-wired "defaults" that are used in the
728730
* absence of any pg_default_acl entry.

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp