Re: Privileges and inheritance - Mailing list pgsql-hackers

From Peter Eisentraut
Subject Re: Privileges and inheritance
Date
Msg-id 1254735019.25576.14.camel@fsopti579.F-Secure.com
Whole thread Raw
In response to Re: Privileges and inheritance  (Simon Riggs <simon@2ndQuadrant.com>)
Responses Re: Privileges and inheritance
List pgsql-hackers
On Mon, 2009-10-05 at 09:22 +0100, Simon Riggs wrote:
> On Sat, 2009-10-03 at 09:45 +0300, Peter Eisentraut wrote:
> 
> > We could use a GUC variable to ease the transition, perhaps like
> > sql_inheritance = no | yes_without_privileges | yes
> 
> The original way of doing things was quite useful if you wanted some
> people to be able to see history and others just see recent data. I
> don't think many people are aware of or take advantage of that, so your
> proposal does simplify things for many people.

Wouldn't that look something like

data  -- empty
data_recent INHERITS (data)
data_old INHERITS (data)
data_ancient INHERITS (data)

GRANT ... ON data_recent TO A
GRANT ... ON data_old TO B

I guess you could also do

data  -- recent data
data_old INHERITS (data)
data_ancient INHERITS (data)

GRANT ... ON data TO A
GRANT ... ON data_old TO B

And then A, who has only access to the recent data, would always have to
use ONLY data to be able to do anything.  That would be a pretty weird
setup.  The workaround is to change it to the setup above, which you can
do with a few renames.




pgsql-hackers by date:

Previous
From: KaiGai Kohei
Date:
Subject: Re: Privileges and inheritance
Next
From: Simon Riggs
Date:
Subject: Re: Privileges and inheritance