mirror of https://github.com/postgres/postgres
the privileges that will be applied to subsequently-created objects. Such adjustments are always per owning role, and can be restricted to objects created in particular schemas too. A notable benefit is that users can override the traditional default privilege settings, eg, the PUBLIC EXECUTE privilege traditionally granted by default for functions. Petr JelinekREL8_5_ALPHA2_BRANCH
Tom Lane
16 years ago
parent
41f89e3bbc
commit
249724cb01
@ -0,0 +1,211 @@ |
|||||||
|
<!-- |
||||||
|
$PostgreSQL: pgsql/doc/src/sgml/ref/alter_default_privileges.sgml,v 1.1 2009/10/05 19:24:33 tgl Exp $ |
||||||
|
PostgreSQL documentation |
||||||
|
--> |
||||||
|
|
||||||
|
<refentry id="SQL-ALTERDEFAULTPRIVILEGES"> |
||||||
|
<refmeta> |
||||||
|
<refentrytitle id="SQL-ALTERDEFAULTPRIVILEGES-TITLE">ALTER DEFAULT PRIVILEGES</refentrytitle> |
||||||
|
<manvolnum>7</manvolnum> |
||||||
|
<refmiscinfo>SQL - Language Statements</refmiscinfo> |
||||||
|
</refmeta> |
||||||
|
|
||||||
|
<refnamediv> |
||||||
|
<refname>ALTER DEFAULT PRIVILEGES</refname> |
||||||
|
<refpurpose>define default access privileges</refpurpose> |
||||||
|
</refnamediv> |
||||||
|
|
||||||
|
<indexterm zone="sql-alterdefaultprivileges"> |
||||||
|
<primary>ALTER DEFAULT PRIVILEGES</primary> |
||||||
|
</indexterm> |
||||||
|
|
||||||
|
<refsynopsisdiv> |
||||||
|
<synopsis> |
||||||
|
ALTER DEFAULT PRIVILEGES |
||||||
|
[ FOR { ROLE | USER } <replaceable>target_role</replaceable> [, ...] ] |
||||||
|
[ IN SCHEMA <replaceable>schema_name</replaceable> [, ...] ] |
||||||
|
<replaceable class="parameter">abbreviated_grant_or_revoke</replaceable> |
||||||
|
|
||||||
|
<phrase>where <replaceable class="parameter">abbreviated_grant_or_revoke</replaceable> is one of:</phrase> |
||||||
|
|
||||||
|
GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } |
||||||
|
[,...] | ALL [ PRIVILEGES ] } |
||||||
|
ON TABLE |
||||||
|
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ] |
||||||
|
|
||||||
|
GRANT { { USAGE | SELECT | UPDATE } |
||||||
|
[,...] | ALL [ PRIVILEGES ] } |
||||||
|
ON SEQUENCE |
||||||
|
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ] |
||||||
|
|
||||||
|
GRANT { EXECUTE | ALL [ PRIVILEGES ] } |
||||||
|
ON FUNCTION |
||||||
|
TO { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ] |
||||||
|
|
||||||
|
REVOKE [ GRANT OPTION FOR ] |
||||||
|
{ { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } |
||||||
|
[,...] | ALL [ PRIVILEGES ] } |
||||||
|
ON TABLE |
||||||
|
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] |
||||||
|
[ CASCADE | RESTRICT ] |
||||||
|
|
||||||
|
REVOKE [ GRANT OPTION FOR ] |
||||||
|
{ { USAGE | SELECT | UPDATE } |
||||||
|
[,...] | ALL [ PRIVILEGES ] } |
||||||
|
ON SEQUENCE |
||||||
|
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] |
||||||
|
[ CASCADE | RESTRICT ] |
||||||
|
|
||||||
|
REVOKE [ GRANT OPTION FOR ] |
||||||
|
{ EXECUTE | ALL [ PRIVILEGES ] } |
||||||
|
ON FUNCTION |
||||||
|
FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...] |
||||||
|
[ CASCADE | RESTRICT ] |
||||||
|
</synopsis> |
||||||
|
</refsynopsisdiv> |
||||||
|
|
||||||
|
<refsect1 id="sql-alterdefaultprivileges-description"> |
||||||
|
<title>Description</title> |
||||||
|
|
||||||
|
<para> |
||||||
|
<command>ALTER DEFAULT PRIVILEGES</> allows you to set the privileges |
||||||
|
that will be applied to objects created in the future. (It does not |
||||||
|
affect privileges assigned to already-existing objects.) Currently, |
||||||
|
only the privileges for tables (including views), sequences, and |
||||||
|
functions can be altered. |
||||||
|
</para> |
||||||
|
|
||||||
|
<para> |
||||||
|
You can change default privileges only for objects that will be created by |
||||||
|
yourself or by roles that you are a member of. The privileges can be set |
||||||
|
globally (i.e., for all objects created in the current database), |
||||||
|
or just for objects created in specified schemas. Default privileges |
||||||
|
that are specified per-schema are added to whatever the global default |
||||||
|
privileges are for the particular object type. |
||||||
|
</para> |
||||||
|
|
||||||
|
<para> |
||||||
|
As explained under <xref linkend="sql-grant" endterm="sql-grant-title">, |
||||||
|
the default privileges for any object type normally grant all grantable |
||||||
|
permissions to the object owner, and may grant some privileges to |
||||||
|
<literal>PUBLIC</> as well. However, this behavior can be changed by |
||||||
|
altering the global default privileges with |
||||||
|
<command>ALTER DEFAULT PRIVILEGES</>. |
||||||
|
</para> |
||||||
|
|
||||||
|
<refsect2> |
||||||
|
<title>Parameters</title> |
||||||
|
|
||||||
|
<variablelist> |
||||||
|
<varlistentry> |
||||||
|
<term><replaceable>target_role</replaceable></term> |
||||||
|
<listitem> |
||||||
|
<para> |
||||||
|
The name of an existing role of which the current role is a member. |
||||||
|
If <literal>FOR ROLE</> is omitted, the current role is assumed. |
||||||
|
</para> |
||||||
|
</listitem> |
||||||
|
</varlistentry> |
||||||
|
|
||||||
|
<varlistentry> |
||||||
|
<term><replaceable>schema_name</replaceable></term> |
||||||
|
<listitem> |
||||||
|
<para> |
||||||
|
The name of an existing schema. Each <replaceable>target_role</> |
||||||
|
must have <literal>CREATE</> privileges for each specified schema. |
||||||
|
If <literal>IN SCHEMA</> is omitted, the global default privileges |
||||||
|
are altered. |
||||||
|
</para> |
||||||
|
</listitem> |
||||||
|
</varlistentry> |
||||||
|
|
||||||
|
<varlistentry> |
||||||
|
<term><replaceable>role_name</replaceable></term> |
||||||
|
<listitem> |
||||||
|
<para> |
||||||
|
The name of an existing role to grant or revoke privileges for. |
||||||
|
This parameter, and all the other parameters in |
||||||
|
<replaceable class="parameter">abbreviated_grant_or_revoke</>, |
||||||
|
act as described under |
||||||
|
<xref linkend="sql-grant" endterm="sql-grant-title"> or |
||||||
|
<xref linkend="sql-revoke" endterm="sql-revoke-title">, |
||||||
|
except that one is setting permissions for a whole class of objects |
||||||
|
rather than specific named objects. |
||||||
|
</para> |
||||||
|
</listitem> |
||||||
|
</varlistentry> |
||||||
|
</variablelist> |
||||||
|
</refsect2> |
||||||
|
</refsect1> |
||||||
|
|
||||||
|
<refsect1 id="sql-alterdefaultprivileges-notes"> |
||||||
|
<title>Notes</title> |
||||||
|
|
||||||
|
<para> |
||||||
|
Use <xref linkend="app-psql">'s <command>\ddp</command> command |
||||||
|
to obtain information about existing assignments of default privileges. |
||||||
|
The meaning of the privilege values is the same as explained for |
||||||
|
<command>\dp</command> under |
||||||
|
<xref linkend="sql-grant" endterm="sql-grant-title">. |
||||||
|
</para> |
||||||
|
|
||||||
|
<para> |
||||||
|
If you wish to drop a role that has had its global default privileges |
||||||
|
altered, it is necessary to use <command>DROP OWNED BY</> first, |
||||||
|
to get rid of the default privileges entry for the role. |
||||||
|
</para> |
||||||
|
</refsect1> |
||||||
|
|
||||||
|
<refsect1 id="sql-alterdefaultprivileges-examples"> |
||||||
|
<title>Examples</title> |
||||||
|
|
||||||
|
<para> |
||||||
|
Grant SELECT privilege to everyone for all tables (and views) you |
||||||
|
subsequently create in schema <literal>myschema</literal>, and allow |
||||||
|
role <literal>webuser</> to INSERT into them too: |
||||||
|
|
||||||
|
<programlisting> |
||||||
|
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT SELECT ON TABLE TO PUBLIC; |
||||||
|
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema GRANT INSERT ON TABLE TO webuser; |
||||||
|
</programlisting> |
||||||
|
</para> |
||||||
|
|
||||||
|
<para> |
||||||
|
Undo the above, so that subsequently-created tables won't have any |
||||||
|
more permissions than normal: |
||||||
|
|
||||||
|
<programlisting> |
||||||
|
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema REVOKE SELECT ON TABLE FROM PUBLIC; |
||||||
|
ALTER DEFAULT PRIVILEGES IN SCHEMA myschema REVOKE INSERT ON TABLE FROM webuser; |
||||||
|
</programlisting> |
||||||
|
</para> |
||||||
|
|
||||||
|
<para> |
||||||
|
Remove the public EXECUTE permission that is normally granted on functions, |
||||||
|
for all functions subsequently created by role <literal>admin</>: |
||||||
|
|
||||||
|
<programlisting> |
||||||
|
ALTER DEFAULT PRIVILEGES FOR ROLE admin REVOKE EXECUTE ON FUNCTION FROM PUBLIC; |
||||||
|
</programlisting> |
||||||
|
</para> |
||||||
|
</refsect1> |
||||||
|
|
||||||
|
<refsect1> |
||||||
|
<title>Compatibility</title> |
||||||
|
|
||||||
|
<para> |
||||||
|
There is no <command>ALTER DEFAULT PRIVILEGES</command> statement in the SQL |
||||||
|
standard. |
||||||
|
</para> |
||||||
|
</refsect1> |
||||||
|
|
||||||
|
<refsect1> |
||||||
|
<title>See Also</title> |
||||||
|
|
||||||
|
<simplelist type="inline"> |
||||||
|
<member><xref linkend="sql-grant" endterm="sql-grant-title"></member> |
||||||
|
<member><xref linkend="sql-revoke" endterm="sql-revoke-title"></member> |
||||||
|
</simplelist> |
||||||
|
</refsect1> |
||||||
|
|
||||||
|
</refentry> |
||||||
@ -0,0 +1,75 @@ |
|||||||
|
/*-------------------------------------------------------------------------
|
||||||
|
* |
||||||
|
* pg_default_acl.h |
||||||
|
* definition of default ACLs for new objects. |
||||||
|
* |
||||||
|
* |
||||||
|
* Portions Copyright (c) 1996-2009, PostgreSQL Global Development Group |
||||||
|
* Portions Copyright (c) 1994, Regents of the University of California |
||||||
|
* |
||||||
|
* $PostgreSQL: pgsql/src/include/catalog/pg_default_acl.h,v 1.1 2009/10/05 19:24:48 tgl Exp $ |
||||||
|
* |
||||||
|
* NOTES |
||||||
|
* the genbki.sh script reads this file and generates .bki |
||||||
|
* information from the DATA() statements. |
||||||
|
* |
||||||
|
*------------------------------------------------------------------------- |
||||||
|
*/ |
||||||
|
#ifndef PG_DEFAULT_ACL_H |
||||||
|
#define PG_DEFAULT_ACL_H |
||||||
|
|
||||||
|
#include "catalog/genbki.h" |
||||||
|
|
||||||
|
/* ----------------
|
||||||
|
* pg_default_acl definition. cpp turns this into |
||||||
|
* typedef struct FormData_pg_default_acl |
||||||
|
* ---------------- |
||||||
|
*/ |
||||||
|
#define DefaultAclRelationId 826 |
||||||
|
|
||||||
|
CATALOG(pg_default_acl,826) |
||||||
|
{ |
||||||
|
Oid defaclrole; /* OID of role owning this ACL */ |
||||||
|
Oid defaclnamespace; /* OID of namespace, or 0 for all */ |
||||||
|
char defaclobjtype; /* see DEFACLOBJ_xxx constants below */ |
||||||
|
|
||||||
|
/*
|
||||||
|
* VARIABLE LENGTH FIELDS start here. |
||||||
|
*/ |
||||||
|
|
||||||
|
aclitem defaclacl[1]; /* permissions to add at CREATE time */ |
||||||
|
} FormData_pg_default_acl; |
||||||
|
|
||||||
|
/* ----------------
|
||||||
|
* Form_pg_default_acl corresponds to a pointer to a tuple with |
||||||
|
* the format of pg_default_acl relation. |
||||||
|
* ---------------- |
||||||
|
*/ |
||||||
|
typedef FormData_pg_default_acl *Form_pg_default_acl; |
||||||
|
|
||||||
|
/* ----------------
|
||||||
|
* compiler constants for pg_default_acl |
||||||
|
* ---------------- |
||||||
|
*/ |
||||||
|
|
||||||
|
#define Natts_pg_default_acl 4 |
||||||
|
#define Anum_pg_default_acl_defaclrole 1 |
||||||
|
#define Anum_pg_default_acl_defaclnamespace 2 |
||||||
|
#define Anum_pg_default_acl_defaclobjtype 3 |
||||||
|
#define Anum_pg_default_acl_defaclacl 4 |
||||||
|
|
||||||
|
/* ----------------
|
||||||
|
* pg_default_acl has no initial contents |
||||||
|
* ---------------- |
||||||
|
*/ |
||||||
|
|
||||||
|
/*
|
||||||
|
* Types of objects for which the user is allowed to specify default |
||||||
|
* permissions through pg_default_acl. These codes are used in the |
||||||
|
* defaclobjtype column. |
||||||
|
*/ |
||||||
|
#define DEFACLOBJ_RELATION 'r' /* table, view */ |
||||||
|
#define DEFACLOBJ_SEQUENCE 'S' /* sequence */ |
||||||
|
#define DEFACLOBJ_FUNCTION 'f' /* function */ |
||||||
|
|
||||||
|
#endif /* PG_DEFAULT_ACL_H */ |
||||||
Loading…
Reference in new issue