database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-27 12:41:57 +03:00
Code Activity

Doc: fix missing explanation of default object privileges.

Browse Source 
The GRANT reference page, which lists the default privileges for new
objects, failed to mention that USAGE is granted by default for data
types and domains.  As a lesser sin, it also did not specify anything
about the initial privileges for sequences, FDWs, foreign servers,
or large objects.  Fix that, and add a comment to acldefault() in the
probably vain hope of getting people to maintain this list in future.

Noted by Laurenz Albe, though I editorialized on the wording a bit.
Back-patch to all supported branches, since they all have this behavior.

Discussion: https://postgr.es/m/1507620895.4152.1.camel@cybertec.at
This commit is contained in:
Tom Lane
2017-10-11 16:56:23 -04:00
parent 20d210bf5b
commit 2860596832
2 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
doc/src/sgml/ref/grant.sgml
View File

@ -156,12 +156,22 @@ GRANT <replaceable class="parameter">role_name</replaceable> [, ...] TO <replace
<para>
PostgreSQL grants default privileges on some types of objects to
<literal>PUBLIC</literal>. No privileges are granted to
<literal>PUBLIC</literal> by default on tables,
columns, schemas or tablespaces. For other types, the default privileges
<literal>PUBLIC</literal> by default on
tables,
table columns,
sequences,
foreign data wrappers,
foreign servers,
large objects,
schemas,
or tablespaces.
For other types of objects, the default privileges
granted to <literal>PUBLIC</literal> are as follows:
<literal>CONNECT</literal> and <literal>CREATE TEMP TABLE</literal> for
databases; <literal>EXECUTE</literal> privilege for functions; and
<literal>USAGE</literal> privilege for languages.
<literal>CONNECT</literal> and <literal>TEMPORARY</literal> (create
temporary tables) privileges for databases;
<literal>EXECUTE</literal> privilege for functions; and
<literal>USAGE</literal> privilege for languages and data types
(including domains).
The object owner can, of course, <command>REVOKE</command>
both default and expressly granted privileges. (For maximum
security, issue the <command>REVOKE</> in the same transaction that