From: | mzj1996(at)mail(dot)ustc(dot)edu(dot)cn |
---|---|
To: | pgsql-hackers(at)lists(dot)postgresql(dot)org |
Subject: | why is the permission granted in a non-recursive way and what are the benefits |
Date: | 2021-05-31 07:19:15 |
Message-ID: | 385c4d9a.139b8.179c14a7e06.Coremail.mzj1996@mail.ustc.edu.cn |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Our team uses postgresql as the database, but we have some problem on grant and revoke.
imagine the following sequence of operations:
createuser test;
CREATETABLE sales (trans_id int,datedate, amount int)
PARTITIONBYRANGE(date);
CREATETABLE sales_1 PARTITION OF sales
FORVALUESFROM('2001-01-01')TO('2002-01-01')
PARTITIONBYRANGE(amount);
CREATETABLE sales_1 PARTITION OF sales
FORVALUESFROM('2002-01-01')TO('2003-01-01')
PARTITIONBYRANGE(amount);
GRANTSELECTON sales TO test;
set role test;
SELECT*FROM sales;
-- error, because test don't have select authority on sales_1
SELECT*FROM sales_1;
In this example, the role test only has the select permission for sales and cannot access sales_1, which is very inconvenient.
In most scenarios, we want to assign permissions to a table and partition table to a user, but in postgresql, permissions are not recursive, so we need to spend extra energy to do this. So let's ask the postgresql team, why is the permission granted in a non-recursive way and what are the benefits?
If it is in a recursive way, when I grant select on parent table to user, the user also have permission on child table. It is very convenient.
In postgresql, we already have the Inheritance. If the table child inherits the table parent, every query command to the parent will recurse to the child. If the user does not want to recurse, you can use only keyword to do this, then why the partition is not consistent with the inheritite feature?
From | Date | Subject | |
---|---|---|---|
Next Message | Esteban Zimanyi | 2021-05-31 07:29:42 | How to disable the autovacuum ? |
Previous Message | Masahiko Sawada | 2021-05-31 07:09:19 | Re: Skipping logical replication transactions on subscriber side |