Thread: "with grant option" for user groups.

"with grant option" for user groups.

From
Potuganti Ramu
Date:
<div class="Section1"><p class="MsoNormal"><font face="Arial" size="2"><span style="font-size:10.0pt;
font-family:Arial">Hi all, </span></font><p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt;
font-family:Arial">We are building security system for a project where the security is modeled based on the sql-92
GRANT/REVOKEstatements.</span></font><p class="MsoNormal"><font face="Arial" size="2"><span style="font-size:10.0pt; 
font-family:Arial">I was going through the documentation of postgresql related to GRANT/REVOKE
statements.</span></font><pclass="MsoNormal"><font face="Arial" size="2"><span style="font-size:10.0pt; 
font-family:Arial"> </span></font><p class="MsoNormal"><font face="Arial" size="2"><span style="font-size:10.0pt;
font-family:Arial">Following statement says that "with grant option" is not allowed to a user group. I would like to
knowwhat the reasons behind not implementing</span></font><p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt;
font-family:Arial">this kind of feature.</span></font><p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size:10.0pt;
font-family:Arial"> </span></font><p class="MsoNormal"><font color="black" face="Times New Roman" size="3"><span
style="font-size:12.0pt;color:black">If</span></font><tt><font color="black" face="Courier New" size="2"><span
style="font-size:10.0pt;color:black">WITHGRANT OPTION</span></font></tt><font color="black"><span style="color:black">
isspecified, the recipient of the privilege may in turn grant it to others. By default this is not allowed. Grant
optionscan only be granted to individual users, not to groups or </span></font><tt><font color="black" face="Courier
New"size="2"><span style="font-size:10.0pt;color:black">PUBLIC</span></font></tt><font color="black"><span
style="color:black">.</span></font><pclass="MsoNormal"><font face="Arial" size="2"><span style="font-size:10.0pt; 
font-family:Arial"> </span></font><p class="MsoNormal"><font face="Arial" size="2"><span style="font-size:10.0pt;
font-family:Arial"><a
href="http://developer.postgresql.org/docs/postgres/sql-grant.html">http://developer.postgresql.org/docs/postgres/sql-grant.html</a></span></font><p
class="MsoNormal"><fontface="Arial" size="2"><span style="font-size:10.0pt; 
font-family:Arial"> </span></font><p class="MsoNormal"><font face="Arial" size="2"><span style="font-size:10.0pt;
font-family:Arial">I looked into ORACLE database also they don't support user groups, but they support roles. But even
forroles "with grant option" is not allowed.</span></font><p class="MsoNormal"><font face="Times New Roman"
size="3"><spanstyle="font-size: 
12.0pt"> </span></font><p class="MsoNormal"><font face="Times New Roman" size="3"><span style="font-size:
12.0pt">Thanks & regards,</span></font><p class="MsoNormal"><font face="Times New Roman" size="3"><span
style="font-size:
12.0pt">Ramu</span></font></div>

Re: "with grant option" for user groups.

From
Peter Eisentraut
Date:
> Following statement says that "with grant option" is not allowed to a user
> group. I would like to know what the reasons behind not implementing
> this kind of feature.

Consider the following sequence of steps:

in database 1:
user A grants privilege to group B with grant option
user C who is in group B grants privilege to user D

in database 2:
superuser removes user C from group B

--> user D still has the privilege, because superuser doesn't have access to  
database 1 from his session

If you can live with this problem, then you can remove the check from the 
source code and it should work.



Re: "with grant option" for user groups.

From
Potuganti Ramu
Date:
Theoretically same kind of problem should arise even if the privilege is
granted to a user also.
To be specific I would like know the answers for the following Q's

Scenario 1:
===========
User A grants privilege to group B with grant option.
User C who is in group B grants privilege to user D

If super user removes the user C from the group, then who is the grantee for
the user D? And who can revoke revoke the privileges from user D?

Scenario 2:
===========
User A grants privilege to group 'B' and 'Z' with grant option.
User C who is in group 'B' and 'Z' grants privilege to user D.

If user C removed from the group 'B' then who will be the grantee for user
'D'? And who can revoke revoke the privileges from user D?

If user C is removed from both the groups then who will be the grantee for
the user? And who can revoke revoke the privileges from user D?

Thanks & Regards,
Ramu


-----Original Message-----
From: Peter Eisentraut [mailto:peter_e@gmx.net] 
Sent: Friday, January 09, 2004 8:11 PM
To: Potuganti Ramu; pgsql-hackers@postgresql.org
Subject: Re: [HACKERS] "with grant option" for user groups.

> Following statement says that "with grant option" is not allowed to a user
> group. I would like to know what the reasons behind not implementing
> this kind of feature.

Consider the following sequence of steps:

in database 1:
user A grants privilege to group B with grant option
user C who is in group B grants privilege to user D

in database 2:
superuser removes user C from group B

--> user D still has the privilege, because superuser doesn't have access to

database 1 from his session

If you can live with this problem, then you can remove the check from the 
source code and it should work.


Re: "with grant option" for user groups.

From
Potuganti Ramu
Date:
Theoretically same kind of problem should arise even if the privilege is
granted to a user also.
To be specific I would like know the answers for the following Q's

Scenario 1:
===========
User A grants privilege to group B with grant option.
User C who is in group B grants privilege to user D

If super user removes the user C from the group, then who is the grantee for
the user D? And who can revoke revoke the privileges from user D?

Scenario 2:
===========
User A grants privilege to group 'B' and 'Z' with grant option.
User C who is in group 'B' and 'Z' grants privilege to user D.

If user C removed from the group 'B' then who will be the grantee for user
'D'? And who can revoke revoke the privileges from user D?

If user C is removed from both the groups then who will be the grantee for
the user? And who can revoke revoke the privileges from user D?

Thanks & Regards,
Ramu


-----Original Message-----
From: Peter Eisentraut [mailto:peter_e@gmx.net] 
Sent: Friday, January 09, 2004 8:11 PM
To: Potuganti Ramu; pgsql-hackers@postgresql.org
Subject: Re: [HACKERS] "with grant option" for user groups.

> Following statement says that "with grant option" is not allowed to a user
> group. I would like to know what the reasons behind not implementing
> this kind of feature.

Consider the following sequence of steps:

in database 1:
user A grants privilege to group B with grant option
user C who is in group B grants privilege to user D

in database 2:
superuser removes user C from group B

--> user D still has the privilege, because superuser doesn't have access to

database 1 from his session

If you can live with this problem, then you can remove the check from the 
source code and it should work.


Re: "with grant option" for user groups.

From
Peter Eisentraut
Date:
Potuganti Ramu wrote:
> Scenario 1:
> ===========
> User A grants privilege to group B with grant option.
> User C who is in group B grants privilege to user D
>
> If super user removes the user C from the group, then who is the
> grantee for the user D? And who can revoke revoke the privileges from
> user D?

The privileges should be revoked from user D automatically in the same 
step that removes the user C from the group.

> Scenario 2:
> ===========
> User A grants privilege to group 'B' and 'Z' with grant option.
> User C who is in group 'B' and 'Z' grants privilege to user D.
>
> If user C removed from the group 'B' then who will be the grantee for
> user 'D'? And who can revoke revoke the privileges from user D?

In strict SQL only one role can be active at one time, so there is no 
problem.  If we didn't want to use that restriction, we'd need to think 
of something else.

> If user C is removed from both the groups then who will be the
> grantee for the user? And who can revoke revoke the privileges from
> user D?

See your scenario 1 above.