@ -1629,7 +1629,7 @@ CREATE POLICY account_managers ON accounts TO managers
<programlisting>
<programlisting>
CREATE POLICY user_policy ON users
CREATE POLICY user_policy ON users
USING (user = current_user);
USING (user_name = current_user);
</programlisting>
</programlisting>
<para>
<para>
@ -1642,7 +1642,7 @@ CREATE POLICY user_policy ON users
<programlisting>
<programlisting>
CREATE POLICY user_policy ON users
CREATE POLICY user_policy ON users
USING (true)
USING (true)
WITH CHECK (user = current_user);
WITH CHECK (user_name = current_user);
</programlisting>
</programlisting>
<para>
<para>
@ -1662,7 +1662,7 @@ CREATE POLICY user_policy ON users
<programlisting>
<programlisting>
-- Simple passwd-file based example
-- Simple passwd-file based example
CREATE TABLE passwd (
CREATE TABLE passwd (
username text UNIQUE NOT NULL,
user_ name text UNIQUE NOT NULL,
pwhash text,
pwhash text,
uid int PRIMARY KEY,
uid int PRIMARY KEY,
gid int NOT NULL,
gid int NOT NULL,
@ -1696,9 +1696,9 @@ CREATE POLICY all_view ON passwd FOR SELECT USING (true);
-- Normal users can update their own records, but
-- Normal users can update their own records, but
-- limit which shells a normal user is allowed to set
-- limit which shells a normal user is allowed to set
CREATE POLICY user_mod ON passwd FOR UPDATE
CREATE POLICY user_mod ON passwd FOR UPDATE
USING (current_user = username)
USING (current_user = user_ name)
WITH CHECK (
WITH CHECK (
current_user = username AND
current_user = user_ name AND
shell IN ('/bin/bash','/bin/sh','/bin/dash','/bin/zsh','/bin/tcsh')
shell IN ('/bin/bash','/bin/sh','/bin/dash','/bin/zsh','/bin/tcsh')
);
);
@ -1706,7 +1706,7 @@ CREATE POLICY user_mod ON passwd FOR UPDATE
GRANT SELECT, INSERT, UPDATE, DELETE ON passwd TO admin;
GRANT SELECT, INSERT, UPDATE, DELETE ON passwd TO admin;
-- Users only get select access on public columns
-- Users only get select access on public columns
GRANT SELECT
GRANT SELECT
(username, uid, gid, real_name, home_phone, extra_info, home_dir, shell)
(user_ name, uid, gid, real_name, home_phone, extra_info, home_dir, shell)
ON passwd TO public;
ON passwd TO public;
-- Allow users to update certain columns
-- Allow users to update certain columns
GRANT UPDATE
GRANT UPDATE
@ -1725,11 +1725,11 @@ GRANT UPDATE
postgres=> set role admin;
postgres=> set role admin;
SET
SET
postgres=> table passwd;
postgres=> table passwd;
username | pwhash | uid | gid | real_name | home_phone | extra_info | home_dir | shell
user_ name | pwhash | uid | gid | real_name | home_phone | extra_info | home_dir | shell
----------+--------+-----+-----+-----------+--------------+------------+-------------+-----------
----------- +--------+-----+-----+-----------+--------------+------------+-------------+-----------
admin | xxx | 0 | 0 | Admin | 111-222-3333 | | /root | /bin/dash
admin | xxx | 0 | 0 | Admin | 111-222-3333 | | /root | /bin/dash
bob | xxx | 1 | 1 | Bob | 123-456-7890 | | /home/bob | /bin/zsh
bob | xxx | 1 | 1 | Bob | 123-456-7890 | | /home/bob | /bin/zsh
alice | xxx | 2 | 1 | Alice | 098-765-4321 | | /home/alice | /bin/zsh
alice | xxx | 2 | 1 | Alice | 098-765-4321 | | /home/alice | /bin/zsh
(3 rows)
(3 rows)
-- Test what Alice is able to do
-- Test what Alice is able to do
@ -1737,26 +1737,26 @@ postgres=> set role alice;
SET
SET
postgres=> table passwd;
postgres=> table passwd;
ERROR: permission denied for relation passwd
ERROR: permission denied for relation passwd
postgres=> select username,real_name,home_phone,extra_info,home_dir,shell from passwd;
postgres=> select user_ name,real_name,home_phone,extra_info,home_dir,shell from passwd;
username | real_name | home_phone | extra_info | home_dir | shell
user_ name | real_name | home_phone | extra_info | home_dir | shell
----------+-----------+--------------+------------+-------------+-----------
----------- +-----------+--------------+------------+-------------+-----------
admin | Admin | 111-222-3333 | | /root | /bin/dash
admin | Admin | 111-222-3333 | | /root | /bin/dash
bob | Bob | 123-456-7890 | | /home/bob | /bin/zsh
bob | Bob | 123-456-7890 | | /home/bob | /bin/zsh
alice | Alice | 098-765-4321 | | /home/alice | /bin/zsh
alice | Alice | 098-765-4321 | | /home/alice | /bin/zsh
(3 rows)
(3 rows)
postgres=> update passwd set username = 'joe';
postgres=> update passwd set user_ name = 'joe';
ERROR: permission denied for relation passwd
ERROR: permission denied for relation passwd
-- Alice is allowed to change her own real_name, but no others
-- Alice is allowed to change her own real_name, but no others
postgres=> update passwd set real_name = 'Alice Doe';
postgres=> update passwd set real_name = 'Alice Doe';
UPDATE 1
UPDATE 1
postgres=> update passwd set real_name = 'John Doe' where username = 'admin';
postgres=> update passwd set real_name = 'John Doe' where user_ name = 'admin';
UPDATE 0
UPDATE 0
postgres=> update passwd set shell = '/bin/xx';
postgres=> update passwd set shell = '/bin/xx';
ERROR: new row violates WITH CHECK OPTION for "passwd"
ERROR: new row violates WITH CHECK OPTION for "passwd"
postgres=> delete from passwd;
postgres=> delete from passwd;
ERROR: permission denied for relation passwd
ERROR: permission denied for relation passwd
postgres=> insert into passwd (username) values ('xxx');
postgres=> insert into passwd (user_ name) values ('xxx');
ERROR: permission denied for relation passwd
ERROR: permission denied for relation passwd
-- Alice can change her own password; RLS silently prevents updating other rows
-- Alice can change her own password; RLS silently prevents updating other rows
postgres=> update passwd set pwhash = 'abc';
postgres=> update passwd set pwhash = 'abc';
@ -2055,7 +2055,7 @@ DROP SCHEMA myschema CASCADE;
(since this is one of the ways to restrict the activities of your
(since this is one of the ways to restrict the activities of your
users to well-defined namespaces). The syntax for that is:
users to well-defined namespaces). The syntax for that is:
<programlisting>
<programlisting>
CREATE SCHEMA <replaceable>schemaname</replaceable> AUTHORIZATION <replaceable>username</replaceable>;
CREATE SCHEMA <replaceable>schema_ name</replaceable> AUTHORIZATION <replaceable>user_ name</replaceable>;
</programlisting>
</programlisting>
You can even omit the schema name, in which case the schema name
You can even omit the schema name, in which case the schema name
will be the same as the user name. See <xref
will be the same as the user name. See <xref
@ -2344,7 +2344,7 @@ REVOKE CREATE ON SCHEMA public FROM PUBLIC;
implements only the basic schema support specified in the
implements only the basic schema support specified in the
standard. Therefore, many users consider qualified names to
standard. Therefore, many users consider qualified names to
really consist of
really consist of
<literal><replaceable>username</>.<replaceable>tablename</></literal>.
<literal><replaceable>user_ name</>.<replaceable>table_ name</></literal>.
This is how <productname>PostgreSQL</productname> will effectively
This is how <productname>PostgreSQL</productname> will effectively
behave if you create a per-user schema for every user.
behave if you create a per-user schema for every user.
</para>
</para>