On 11/08/2013 11:03 PM, Robert Haas wrote:
>> > Separate "READ DELETE" etc would only be interesting if we wanted to let
>> > someone DELETE rows they cannot SELECT. Since we have DELETE ...
>> > RETURNING, and since users can write a predicate function for DELETE
>> > that leaks the information even if we didn't, in practice if you give
>> > the user any READ right you've given them all of them. So I don't think
>> > we can support that (except maybe by column RLS down the track).
>
> Well, we could require SELECT privilege when a a RETURNING clause is present...
Absolutely could. Wouldn't stop them grabbing the data via a predicate
function on the update/delete, though, and we can't sanely (IMO) require
SELECT rights if they want to use non-LEAKPROOF functions/operators either.
I do think this needs looking at further, but I suspect it's an area
where Pg's flexibility will make life harder.
-- Craig Ringer http://www.2ndQuadrant.com/PostgreSQL Development, 24x7 Support, Training & Services
