mirror of https://github.com/postgres/postgres
the privileges that will be applied to subsequently-created objects. Such adjustments are always per owning role, and can be restricted to objects created in particular schemas too. A notable benefit is that users can override the traditional default privilege settings, eg, the PUBLIC EXECUTE privilege traditionally granted by default for functions. Petr JelinekREL8_5_ALPHA2_BRANCH
Tom Lane
16 years ago
parent
41f89e3bbc
commit
249724cb01
@ -0,0 +1,211 @@ |
||||
<!-- |
||||
$PostgreSQL: pgsql/doc/src/sgml/ref/alter_default_privileges.sgml,v 1.1 2009/10/05 19:24:33 tgl Exp $ |
||||
PostgreSQL documentation |
||||
--> |
||||
|
||||
<refentry id="SQL-ALTERDEFAULTPRIVILEGES"> |
||||
<refmeta> |
||||
<refentrytitle id="SQL-ALTERDEFAULTPRIVILEGES-TITLE">ALTER DEFAULT PRIVILEGES</refentrytitle> |
||||
<manvolnum>7</manvolnum> |
||||
<refmiscinfo>SQL - Language Statements</refmiscinfo> |
||||
</refmeta> |
||||
|
||||
<refnamediv> |
||||
<refname>ALTER DEFAULT PRIVILEGES</refname> |
||||
<refpurpose>define default access privileges</refpurpose> |
||||
</refnamediv> |
||||
|
||||
<indexterm zone="sql-alterdefaultprivileges"> |
||||
<primary>ALTER DEFAULT PRIVILEGES</primary> |
||||
</indexterm> |
||||
|
||||
<refsynopsisdiv> |
||||
<synopsis> |
||||
ALTER DEFAULT PRIVILEGES |
||||
[ FOR { ROLE | USER } <replaceable>target_role</replaceable> [, ...] ] |
||||
[ IN SCHEMA <replaceable>schema_name</replaceable> [, ...] ] |
||||
<replaceable class="parameter">abbreviated_grant_or_revoke</replaceable> |
||||
|
||||
<phrase>where <replaceable class="parameter">abbreviated_grant_or_revoke</replaceable> is one of:</phrase> |
||||
|
||||
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } |
||||
[,...] | ALL [ PRIVILEGES ] } |
||||
ON TABLE |
||||
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ] |
||||
|
||||
GRANT { { USAGE | SELECT | UPDATE } |
||||
[,...] | ALL [ PRIVILEGES ] } |
||||
ON SEQUENCE |
||||
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ] |
||||
|
||||
GRANT { EXECUTE | ALL [ PRIVILEGES ] } |
||||
ON FUNCTION |
||||
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ] |
||||
|
||||
REVOKE [ GRANT OPTION FOR ] |
||||
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } |
||||
[,...] | ALL [ PRIVILEGES ] } |
||||
ON TABLE |
||||
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] |
||||
[ CASCADE | RESTRICT ] |
||||
|
||||
REVOKE [ GRANT OPTION FOR ] |
||||
{ { USAGE | SELECT | UPDATE } |
||||
[,...] | ALL [ PRIVILEGES ] } |
||||
ON SEQUENCE |
||||
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] |
||||
[ CASCADE | RESTRICT ] |
||||
|
||||
REVOKE [ GRANT OPTION FOR ] |
||||
{ EXECUTE | ALL [ PRIVILEGES ] } |
||||
ON FUNCTION |
||||
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] |
||||
[ CASCADE | RESTRICT ] |
||||
</synopsis> |
||||
</refsynopsisdiv> |
||||
|
||||
<refsect1 id="sql-alterdefaultprivileges-description"> |
||||
<title>Description</title> |
||||
|
||||
<para> |
||||
<command>ALTER DEFAULT PRIVILEGES</> allows you to set the privileges |
||||
that will be applied to objects created in the future. (It does not |
||||
affect privileges assigned to already-existing objects.) Currently, |
||||
only the privileges for tables (including views), sequences, and |
||||
functions can be altered. |
||||
</para> |
||||
|
||||
<para> |
||||
You can change default privileges only for objects that will be created by |
||||
yourself or by roles that you are a member of. The privileges can be set |
||||
globally (i.e., for all objects created in the current database), |
||||
or just for objects created in specified schemas. Default privileges |
||||
that are specified per-schema are added to whatever the global default |
||||
privileges are for the particular object type. |
||||
</para> |
||||
|
||||
<para> |
||||
As explained under <xref linkend="sql-grant" endterm="sql-grant-title">, |
||||
the default privileges for any object type normally grant all grantable |
||||
permissions to the object owner, and may grant some privileges to |
||||
<literal>PUBLIC</> as well. However, this behavior can be changed by |
||||
altering the global default privileges with |
||||
<command>ALTER DEFAULT PRIVILEGES</>. |
||||
</para> |
||||
|
||||
<refsect2> |
||||
<title>Parameters</title> |
||||
|
||||
<variablelist> |
||||
<varlistentry> |
||||
<term><replaceable>target_role</replaceable></term> |
||||
<listitem> |
||||
<para> |
||||
The name of an existing role of which the current role is a member. |
||||
If <literal>FOR ROLE</> is omitted, the current role is assumed. |
||||
</para> |
||||
</listitem> |
||||
</varlistentry> |
||||
|
||||
<varlistentry> |
||||
<term><replaceable>schema_name</replaceable></term> |
||||
<listitem> |
||||
<para> |
||||
The name of an existing schema. Each <replaceable>target_role</> |
||||
must have <literal>CREATE</> privileges for each specified schema. |
||||
If <literal>IN SCHEMA</> is omitted, the global default privileges |
||||
are altered. |
||||
</para> |
||||
</listitem> |
||||
</varlistentry> |
||||
|
||||
<varlistentry> |
||||
<term><replaceable>role_name</replaceable></term> |
||||
<listitem> |
||||
<para> |
||||
The name of an existing role to grant or revoke privileges for. |
||||
This parameter, and all the other parameters in |
||||
<replaceable class="parameter">abbreviated_grant_or_revoke</>, |
||||
act as described under |
||||
<xref linkend="sql-grant" endterm="sql-grant-title"> or |
||||
<xref linkend="sql-revoke" endterm="sql-revoke-title">, |
||||
except that one is setting permissions for a whole class of objects |
||||
rather than specific named objects. |
||||
</para> |
||||
</listitem> |
||||
</varlistentry> |
||||
</variablelist> |
||||
</refsect2> |
||||
</refsect1> |
||||
|
||||
<refsect1 id="sql-alterdefaultprivileges-notes"> |
||||
<title>Notes</title> |
||||
|
||||
<para> |
||||
Use <xref linkend="app-psql">'s <command>\ddp</command> command |
||||
to obtain information about existing assignments of default privileges. |
||||
The meaning of the privilege values is the same as explained for |
||||
<command>\dp</command> under |
||||
<xref linkend="sql-grant" endterm="sql-grant-title">. |
||||
</para> |
||||
|
||||
<para> |
||||
If you wish to drop a role that has had its global default privileges |
||||
altered, it is necessary to use <command>DROP OWNED BY</> first, |
||||
to get rid of the default privileges entry for the role. |
||||
</para> |
||||
</refsect1> |
||||
|
||||
<refsect1 id="sql-alterdefaultprivileges-examples"> |
||||
<title>Examples</title> |
||||
|
||||
<para> |
||||
Grant SELECT privilege to everyone for all tables (and views) you |
||||
subsequently create in schema <literal>myschema</literal>, and allow |
||||
role <literal>webuser</> to INSERT into them too: |
||||
|
||||
<programlisting> |
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT SELECT ON TABLE TO PUBLIC; |
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT INSERT ON TABLE TO webuser; |
||||
</programlisting> |
||||
</para> |
||||
|
||||
<para> |
||||
Undo the above, so that subsequently-created tables won't have any |
||||
more permissions than normal: |
||||
|
||||
<programlisting> |
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema REVOKE SELECT ON TABLE FROM PUBLIC; |
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema REVOKE INSERT ON TABLE FROM webuser; |
||||
</programlisting> |
||||
</para> |
||||
|
||||
<para> |
||||
Remove the public EXECUTE permission that is normally granted on functions, |
||||
for all functions subsequently created by role <literal>admin</>: |
||||
|
||||
<programlisting> |
||||
ALTER DEFAULT PRIVILEGES FOR ROLE admin REVOKE EXECUTE ON FUNCTION FROM PUBLIC; |
||||
</programlisting> |
||||
</para> |
||||
</refsect1> |
||||
|
||||
<refsect1> |
||||
<title>Compatibility</title> |
||||
|
||||
<para> |
||||
There is no <command>ALTER DEFAULT PRIVILEGES</command> statement in the SQL |
||||
standard. |
||||
</para> |
||||
</refsect1> |
||||
|
||||
<refsect1> |
||||
<title>See Also</title> |
||||
|
||||
<simplelist type="inline"> |
||||
<member><xref linkend="sql-grant" endterm="sql-grant-title"></member> |
||||
<member><xref linkend="sql-revoke" endterm="sql-revoke-title"></member> |
||||
</simplelist> |
||||
</refsect1> |
||||
|
||||
</refentry> |
||||
@ -0,0 +1,75 @@ |
||||
/*-------------------------------------------------------------------------
|
||||
* |
||||
* pg_default_acl.h |
||||
* definition of default ACLs for new objects. |
||||
* |
||||
* |
||||
* Portions Copyright (c) 1996-2009, PostgreSQL Global Development Group |
||||
* Portions Copyright (c) 1994, Regents of the University of California |
||||
* |
||||
* $PostgreSQL: pgsql/src/include/catalog/pg_default_acl.h,v 1.1 2009/10/05 19:24:48 tgl Exp $ |
||||
* |
||||
* NOTES |
||||
* the genbki.sh script reads this file and generates .bki |
||||
* information from the DATA() statements. |
||||
* |
||||
*------------------------------------------------------------------------- |
||||
*/ |
||||
#ifndef PG_DEFAULT_ACL_H |
||||
#define PG_DEFAULT_ACL_H |
||||
|
||||
#include "catalog/genbki.h" |
||||
|
||||
/* ----------------
|
||||
* pg_default_acl definition. cpp turns this into |
||||
* typedef struct FormData_pg_default_acl |
||||
* ---------------- |
||||
*/ |
||||
#define DefaultAclRelationId 826 |
||||
|
||||
CATALOG(pg_default_acl,826) |
||||
{ |
||||
Oid defaclrole; /* OID of role owning this ACL */ |
||||
Oid defaclnamespace; /* OID of namespace, or 0 for all */ |
||||
char defaclobjtype; /* see DEFACLOBJ_xxx constants below */ |
||||
|
||||
/*
|
||||
* VARIABLE LENGTH FIELDS start here. |
||||
*/ |
||||
|
||||
aclitem defaclacl[1]; /* permissions to add at CREATE time */ |
||||
} FormData_pg_default_acl; |
||||
|
||||
/* ----------------
|
||||
* Form_pg_default_acl corresponds to a pointer to a tuple with |
||||
* the format of pg_default_acl relation. |
||||
* ---------------- |
||||
*/ |
||||
typedef FormData_pg_default_acl *Form_pg_default_acl; |
||||
|
||||
/* ----------------
|
||||
* compiler constants for pg_default_acl |
||||
* ---------------- |
||||
*/ |
||||
|
||||
#define Natts_pg_default_acl 4 |
||||
#define Anum_pg_default_acl_defaclrole 1 |
||||
#define Anum_pg_default_acl_defaclnamespace 2 |
||||
#define Anum_pg_default_acl_defaclobjtype 3 |
||||
#define Anum_pg_default_acl_defaclacl 4 |
||||
|
||||
/* ----------------
|
||||
* pg_default_acl has no initial contents |
||||
* ---------------- |
||||
*/ |
||||
|
||||
/*
|
||||
* Types of objects for which the user is allowed to specify default |
||||
* permissions through pg_default_acl. These codes are used in the |
||||
* defaclobjtype column. |
||||
*/ |
||||
#define DEFACLOBJ_RELATION 'r' /* table, view */ |
||||
#define DEFACLOBJ_SEQUENCE 'S' /* sequence */ |
||||
#define DEFACLOBJ_FUNCTION 'f' /* function */ |
||||
|
||||
#endif /* PG_DEFAULT_ACL_H */ |
||||
Loading…
Reference in new issue