Re: New patch for Column-level privileges

Tom, et al,

* Tom Lane (tgl(at)sss(dot)pgh(dot)pa(dot)us) wrote:
> KaiGai Kohei <kaigai(at)ak(dot)jp(dot)nec(dot)com> writes:
> > ExecCheckRTEPerms() checks user's privileges on columns, when he does
> > not have required privileges on the table. When he has proper privileges
> > on all the appeared columns within the table, it is allowed.
> > But, when no columns are used on the table, it applies result of checks
> > on the table.
>
> Surely the SQL spec tells us what to do here (and I cannot believe this
> is it...)

Based on what I see in the SQL spec, we have to allow table references
like this when the user has SELECT rights on at least one column of the
table. If the column is referenced anywhere (SELECT clause, WHERE
clause, JOIN clause, through a NATURAL JOIN, etc) then the user must
have SELECT rights on the mentioned column(s).

I'm open to suggestions about how to handle this. My first thought
would be- add an entry to the cols_sel list for the RTE that is special
and indicates "any column", perhaps by using a '0' for the attrid, as is
done elsewhere. Then modify ExecCheckRTEPerms() to handle it.

Thanks,

Stephen