database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-05 09:19:17 +03:00
Code

Add note about access permission checks by inherited TRUNCATE and LOCK TABLE.

Browse Source 
Inherited queries perform access permission checks on the parent
table only. But there are two exceptions to this rule in v12 or before;
TRUNCATE and LOCK TABLE commands through a parent table check
the permissions on not only the parent table but also the children
tables. Previously these exceptions were not documented.

This commit adds the note about these exceptions, into the document.

Back-patch to v9.4. But we don't apply this commit to the master
because commit e6f1e560e4 already got rid of the exception about
inherited TRUNCATE and upcoming commit will do for the exception
about inherited LOCK TABLE.

Author: Amit Langote
Reviewed-by: Fujii Masao
Discussion: https://postgr.es/m/CA+HiwqHfTnMU6SUkyHxCmpHUKk7ERLHCR3vZVq19ZOQBjPBLmQ@mail.gmail.com
This commit is contained in:
Fujii Masao 2020-02-07 00:33:11 +09:00
parent 18e1233fce
commit ebf273000a
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
doc/src/sgml/ddl.sgml
View File

@ -2757,7 +2757,15 @@ VALUES ('Albany', NULL, NULL, 'NY');
accessed through <structname>cities</>. This preserves the appearance accessed through <structname>cities</>. This preserves the appearance
that the data is (also) in the parent table. But that the data is (also) in the parent table. But
the <structname>capitals</structname> table could not be updated directly the <structname>capitals</structname> table could not be updated directly
without an additional grant. In a similar way, the parent table's row without an additional grant. Two exceptions to this rule are
<command>TRUNCATE</command> and <command>LOCK TABLE</command>,
where permissions on the child tables are always checked,
whether they are processed directly or recursively via those commands
performed on the parent table.
</para>
<para>
In a similar way, the parent table's row
security policies (see <xref linkend="ddl-rowsecurity">) are applied to security policies (see <xref linkend="ddl-rowsecurity">) are applied to
rows coming from child tables during an inherited query. A child table's rows coming from child tables during an inherited query. A child table's
policies, if any, are applied only when it is the table explicitly named policies, if any, are applied only when it is the table explicitly named