function permissions question - Mailing list pgsql-general

From Greg Steffensen
Subject function permissions question
Date
Msg-id 438a23610712082121t7827e47fqcecdce1e9334e202@mail.gmail.com
Whole thread Raw
Responses Re: function permissions question
List pgsql-general
Hey, I'm slightly confused about how the permission checking is done
when executing functions.  Basically, users that I've never granted
execution permissions to are able to execute functions.  Basically,
why does this script (which I've tested on a fresh db, executing via
psql as a superuser) succeed:

--------------
CREATE SCHEMA testschema;

CREATE FUNCTION testschema.testfunc()
  RETURNS character varying AS
$BODY$SELECT 'foobar'::varchar;$BODY$
  LANGUAGE 'sql' VOLATILE;

CREATE USER testuser;

GRANT USAGE ON SCHEMA testschema TO testuser;

SET SESSION AUTHORIZATION testuser;

SELECT testschema.testfunc();
------------------

But permission checking works the way I thought it was supposed to
when dealing with tables, like when I execute this instead, and get a
permissions failure:

-----------------
CREATE SCHEMA testschema;

CREATE TABLE testschema.testtable (testcolumn VARCHAR);

CREATE USER testuser;

GRANT USAGE ON SCHEMA testschema TO testuser;

SET SESSION AUTHORIZATION testuser;

SELECT * FROM testschema.testtable;
----------------

Any help is greatly appreciated.  Thanks,

Greg

pgsql-general by date:

Previous
From: Efraín López
Date:
Subject: Re: libpq messages language
Next
From: Tom Lane
Date:
Subject: Re: function permissions question