Thread: Separating function privileges from tables
Hi all, It's nice that privileges on views are separate from the privileges on its underlying tables. For example, if view V queries tables A and B, I only need to grant SELECT on the view to another user; tables A and B can have that privilege revoked and the view works. Are there plans to extend similar behavior to functions? That is, can I simply grant EXECUTE on the function and not have to worry about granting the appropriate privileges to the tables used by the function? Thanks. -B
Barry Brown <barry@cs.sierracollege.edu> writes: > It's nice that privileges on views are separate from the privileges > on its underlying tables. For example, if view V queries tables A and > B, I only need to grant SELECT on the view to another user; tables A > and B can have that privilege revoked and the view works. > Are there plans to extend similar behavior to functions? That is, can > I simply grant EXECUTE on the function and not have to worry about > granting the appropriate privileges to the tables used by the function? I think you are looking for SECURITY DEFINER function option. regards, tom lane