From: | "intmail01(at)gmail(dot)com" <intmail01(at)gmail(dot)com> |
---|---|
To: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Jayadevan M <maymala(dot)jayadevan(at)gmail(dot)com> |
Cc: | pgsql-sql(at)lists(dot)postgresql(dot)org |
Subject: | Re: Hide some tables |
Date: | 2021-08-09 17:48:56 |
Message-ID: | 0470ef60-6bd9-5b71-c666-f26ab65ef8d1@gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-sql |
Le 09/08/2021 à 13:45, Tom Lane a écrit :
> Jayadevan M <maymala(dot)jayadevan(at)gmail(dot)com> writes:
>> There are some operators who enters data in my database with just one
>>> table. Others tables are updated by triggers, these tables contains
>>> result of calculation. How to do to hide these tables because I do not
>>> want that operators read them ? On help documentation it is said that I
>>> can not block SELECT privilege because it is required for UPDATE.
>>>
>> Can you move them to a different schema, and manage using search_path?
> The thing to use is privileges. Make the tables-that-should-be-hidden
> owned by a different SQL role, and don't give select privilege on them
> to the data entry role. The triggers can be (or call) SECURITY DEFINER
> functions owned by the first role, giving them access that the data entry
> role does not have.
>
> regards, tom lane
It works. Thank you
From | Date | Subject | |
---|---|---|---|
Next Message | Ben Tilly | 2021-08-10 17:41:48 | Is this a security oversight? |
Previous Message | Tom Lane | 2021-08-09 13:45:57 | Re: Hide some tables |