Re: Directory/File Access Permissions for COPY and Generic File Access Functions - Mailing list pgsql-hackers

From Alvaro Herrera
Subject Re: Directory/File Access Permissions for COPY and Generic File Access Functions
Date
Msg-id 20141029141447.GE1791@alvin.alvh.no-ip.org
Whole thread Raw
In response to Re: Directory/File Access Permissions for COPY and Generic File Access Functions  (Robert Haas <robertmhaas@gmail.com>)
Responses Re: Directory/File Access Permissions for COPY and Generic File Access Functions
List pgsql-hackers
Robert Haas wrote:

> To articular my own concerns perhaps a bit better, there are two major
> things I don't like about the whole DIRALIAS proposal.  Number one,
> you're creating this SQL object whose name is not actually used for
> anything other than manipulating the alias you created.  The users are
> still operating on pathnames.  That's awfully strange.

I think it would make more sense if the file-accessing command specified
the DIRALIAS (or DIRECTORY, whatever we end up calling this) and a
pathname relative to the base one.  Something like

postgres=# CREATE DIRECTORY logdir ALIAS FOR '/pgsql/data/pg_log';
postgres=# GRANT READ ON DIRECTORY logdir TO logscanner;

logscanner=> COPY logtable FROM 'postgresql-2014-10-28.csv' IN DIRECTORY logdir;

The ALTER ROLE GRANT READ idea proposed downthread is nice also, but one
advantage of this is not having absolute path names in the COPY command.

-- 
Álvaro Herrera                http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services



pgsql-hackers by date:

Previous
From: Kevin Grittner
Date:
Subject: Re: Trailing comma support in SELECT statements
Next
From: Alvaro Herrera
Date:
Subject: Re: Validating CHECK constraints with SPI