Thread: ACL-related adt functions: aclcontains vs aclcheck

Hi -

Is there a good reason why the aclcontains() UDF in utils/adt/acl.c is
defined as it is, instead of calling over to aclcheck() in
catalog/aclchk.c?  With that, aclcontains('{"group foo=r"}',"user bar=r")
would return true if bar is in foo.

- FChE

fche@redhat.com (Frank Ch. Eigler) writes:
> Is there a good reason why the aclcontains() UDF in utils/adt/acl.c is
> defined as it is, instead of calling over to aclcheck() in
> catalog/aclchk.c?

Backwards compatibility?

> With that, aclcontains('{"group foo=r"}',"user bar=r")
> would return true if bar is in foo.

I suspect what you are really after is a function that tests "is
privilege x available to user y given this ACL?"  That would be a
good thing to have, but I'd say make a new function for it; don't
arbitrarily redefine old functions, no matter how useless you might
think they are as-is.
        regards, tom lane