Re: ALTER DEFAULT PRIVILEGES FOR ROLE is broken

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Stephen Frost <sfrost(at)snowman(dot)net>
Cc: Noah Misch <noah(at)leadboat(dot)com>, Josh Berkus <josh(at)agliodbs(dot)com>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: ALTER DEFAULT PRIVILEGES FOR ROLE is broken
Date: 2013-06-07 16:57:24
Message-ID: 25086.1370624244@sss.pgh.pa.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Stephen Frost <sfrost(at)snowman(dot)net> writes:
> * Tom Lane (tgl(at)sss(dot)pgh(dot)pa(dot)us) wrote:
>> Essentially the argument for allowing this without a permissions check
>> is "I'm not really doing anything to the schema, just preconfiguring the
>> rights that will be attached to a new object if I later (successfully)
>> create one in this schema".

> Makes sense to me; if we were going to do something, I'd say a warning
> would be better, but I'm alright with nothing too.

Hm. Throwing a NOTICE saying "btw, this won't be of any value until the
user has CREATE rights in that schema" might be a reasonable compromise.

regards, tom lane

In response to

Responses

Browse pgsql-hackers by date

  From Date Subject
Next Message Tom Lane 2013-06-07 16:59:42 Re: Hard limit on WAL space used (because PANIC sucks)
Previous Message Greg Smith 2013-06-07 16:55:55 Re: Cost limited statements RFC