Re: State of the art re: group default privileges - Mailing list pgsql-general

From Alvaro Herrera
Subject Re: State of the art re: group default privileges
Date
Msg-id 20130320201249.GG3688@alvh.no-ip.org
Whole thread Raw
In response to State of the art re: group default privileges  (Michael Orlitzky <michael@orlitzky.com>)
Responses Re: State of the art re: group default privileges
List pgsql-general
Michael Orlitzky wrote:
> I'm running into this exact situation:
>
> http://www.postgresql.org/message-id/CAG1_KcBFM0e2buUG=o7OjQ_KtadrzDGd45jU7Gke3dUZ0Sz92g@mail.gmail.com
>
> We really need to be able to have a group of developers who can create
> things and modify each others' stuff[1]. Is it still more or less
> impossible?
>
> The workaround that comes to mind is a script to enumerate all
> "developers" and then set the defaults one at a time. This breaks
> however when we add a new developer -- he can't access any of the
> existing stuff.

I don't understand.  Why doesn't alice do a "set role dev_user" before
creating the table?  Then, the table owner is dev_user, not alice, and
default privileges for dev_user apply.  In fact you needn't run ALTER
DEFAULT PRIVILEGES at all, because dev_user will be owner of the
objects, and both alice and bob have that role.

--
Álvaro Herrera                http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services


pgsql-general by date:

Previous
From: Martín Marqués
Date:
Subject: Re: Can't terminate hung COPY
Next
From: Michael Orlitzky
Date:
Subject: Re: State of the art re: group default privileges