Re: Wrong security context for deferred triggers? - Mailing list pgsql-hackers

From Joseph Koshakow
Subject Re: Wrong security context for deferred triggers?
Date
Msg-id CAAvxfHcb_Wijv7s6FvqVCeNSDjg+UDNx9MuT=-3ZkMbbwvH=cQ@mail.gmail.com
Whole thread Raw
In response to Re: Wrong security context for deferred triggers?  ("David G. Johnston" <david.g.johnston@gmail.com>)
Responses Re: Wrong security context for deferred triggers?
List pgsql-hackers
On Sat, Jun 22, 2024 at 6:23 PM David G. Johnston <david.g.johnston@gmail.com> wrote:

> except invoker and triggerer are the same entity

Maybe "executor" would have been a better term than 'invoker". In this
specific example they are not the same entity. The trigger is
triggered and queued by one role and executed by a different role,
hence the confusion. Though I agree with Laurenz, special SQL syntax
for this exotic corner case is a little too much.

> Security definer on the function would take precedence as would its set clause.

These trigger options seem a bit redundant with the equivalent options
on the function that is executed by the trigger. What would be the
advantages or differences of setting these options on the trigger
versus the function?

Thanks,
Joe Koshakow

pgsql-hackers by date:

Previous
From: "David G. Johnston"
Date:
Subject: Re: Wrong security context for deferred triggers?
Next
From: "David G. Johnston"
Date:
Subject: Re: Wrong security context for deferred triggers?