Bruce Momjian wrote:
>All tables are created with default permissions for SELECT to PUBLIC, so
>views are no different.
Is this not contrary to the SQL standard? I understood that SQL tables
are created with permissions for their creator only; any permissions for
other users must be granted explicitly. According to "SQL The Standard
Handbook" (Cannan & Otten, 1993), the owner of the schema in which a table
is created is given a full set of privileges, and no other user can access
the table or even discover that it exists!
It certainly seems undesirable to give automatic access to data of unknown
sensitivity. Surely the default permission should be for the table's
creator alone or for the owner of the PostgreSQL database (which I suppose
is equivalent to the `schema').
I see that Jan Wieck has posted a method for preventing world readability;
perhaps this should just be flagged as a configurable option.
--
Oliver Elphick Oliver.Elphick@lfix.co.uk
Isle of Wight http://www.lfix.co.uk/oliver
PGP key from public servers; key ID 32B8FAA1
