Re: ACLs versus ALTER OWNER - Mailing list pgsql-hackers

From Christopher Kings-Lynne
Subject Re: ACLs versus ALTER OWNER
Date
Msg-id 40BD936F.1050502@familyhealth.com.au
Whole thread Raw
In response to Re: ACLs versus ALTER OWNER  (Fabien COELHO <coelho@cri.ensmp.fr>)
Responses Re: ACLs versus ALTER OWNER
Re: ACLs versus ALTER OWNER
List pgsql-hackers
> REVOKE ALL ON TABLE foo FROM GRANTOR [USER] alice;
> 
> The super user must really be a *super* user.

I think we need a proper 'effective user' facility.

At the moment, there's breakage if a super user creates a language, then 
drops their superuser privs, then the dump cannot be restored.

All other failure cases also exist.  eg if a gumby user creates a table 
in a schema, then has his permission to create tables in that schema 
revoked.  The dump will be broken.

The solution seems to me that we need to have an 'effective_user' SET 
option so that the superuser doing the restore can still create tables 
owned by the gumby, even though the gumby does not have privileges to do  so.

Chris



pgsql-hackers by date:

Previous
From: Fabien COELHO
Date:
Subject: Re: ACLs versus ALTER OWNER
Next
From: ivan
Date:
Subject: query INSERT OR REPLACE