From: | AKACIA <tulio(at)cristorei(dot)com(dot)br> |
---|---|
To: | "'pgsql-admin(at)postgresql(dot)org'" <pgsql-admin(at)postgresql(dot)org> |
Subject: | Rules <-> Functions <-> Permissions |
Date: | 2001-11-16 22:53:31 |
Message-ID: | 31EA84170AEED411B3F70050DAB4037C2CA368@cristorei.cristorei.com.br |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-admin |
Hi,
I'm trying create a SECURE TIER in my DB.
I need "dummys" tables that accept INSERTS from any users, then execute a
RULE that insert the datas into the REAL table. The REAL tables accept
INSERT only from "postgres user".
This work fine !
But when I need the RULE calls a FUNCTION (plpgsql) for more detailed data
manipulating, the FUNCTION runs with the normal user permissions, and not
with the RULE permissions.
Well, if a RULE calls the FUNCTION, the FUNCTION must run with the same
RULEs permissions ...
let-me show you.
----------------------------
\c - postgres
create table teste (codigo int4, nome varchar (30) );
create table teste2 (codigo int4, nome varchar (30) );
grant ALL on teste2 TO joe;
create rule teste2 as on insert to teste2 do insert into teste (codigo,nome)
values (new.codigo,new.nome);
\c - joe
insert into teste (codigo,nome) values (1,'tulio');
--> PERMISSION DENIED ! - OK
insert into teste2 (codigo,nome) values (1,'tulio');
--> INSERTS - OK
select * from teste2;
--> SHOW THE ROWS - OK
\c - postgres
select * from teste;
--> SHOW THE ROWS - OK
------------------------------------------------------------------------
In this example, all is OK, but ...
----------------------------
\c - postgres
create table teste (codigo int4, nome varchar (30) );
create table teste2 (codigo int4, nome varchar (30) );
grant ALL on teste2 TO joe;
create function teste (integer,text) returns integer as '
begin
insert into teste (codigo,nome) values ($1,$2);
end;' language 'plpgsql';
create rule teste2 as on insert to teste2 do select teste
(new.codigo::integer,new.nome::text);
\c - joe
insert into teste (codigo,nome) values (1,'tulio');
--> PERMISSION DENIED ! - OK
insert into teste2 (codigo,nome) values (1,'tulio');
--> PERMISSION DENIED ON TESTE =============================>> NOT OK
------------------------
Sorry my English..... Do you undestand ??
Could you help-me ?
I realy need make HEAVY consistencys, and I need a FUNCTION ...
From | Date | Subject | |
---|---|---|---|
Next Message | Eric Theis | 2001-11-18 16:30:57 | Postmaster will not start??? |
Previous Message | Tom Lane | 2001-11-16 19:51:31 | Re: Are WALs affected by 'duplicate key' errors? |