diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml index 70e9d581c83..13e19042f50 100644 --- a/doc/src/sgml/ref/grant.sgml +++ b/doc/src/sgml/ref/grant.sgml @@ -1,5 +1,5 @@ @@ -157,11 +157,10 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] } CREATE - For databases, allows new schemas to be created in the database. + For databases, allows new schemas to be created within the database. - For schemas, allows new objects to be created within the specified - schema. + For schemas, allows new objects to be created within the schema. @@ -196,9 +195,9 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] } of privilege that is applicable to procedural languages. - For schemas, allows the use of objects contained in the specified + For schemas, allows access to objects contained in the specified schema (assuming that the objects' own privilege requirements are - met). Essentially this allows the grantee to look up + also met). Essentially this allows the grantee to look up objects within the schema. @@ -226,6 +225,11 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] } Notes + + The command is used + to revoke access privileges. + + It should be noted that database superusers can access all objects regardless of object privilege settings. This @@ -243,19 +247,19 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] } Use 's \z command - to obtain information about privileges - on existing objects: + to obtain information about existing privileges, for example: - Database = lusitania - +------------------+---------------------------------------------+ - | Relation | Grant/Revoke Permissions | - +------------------+---------------------------------------------+ - | mytable | {"=rw","miriam=arwdRxt","group todos=rw"} | - +------------------+---------------------------------------------+ - Legend: - uname=arwR -- privileges granted to a user - group gname=arwR -- privileges granted to a group - =arwR -- privileges granted to PUBLIC +lusitania=> \z mytable + Access privileges for database "lusitania" + Table | Access privileges +---------+--------------------------------------- + mytable | {=r,miriam=arwdRxt,"group todos=arw"} + + The entries shown by \z are interpreted thus: + + =xxxx -- privileges granted to PUBLIC + uname=xxxx -- privileges granted to a user + group gname=xxxx -- privileges granted to a group r -- SELECT ("read") w -- UPDATE ("write") @@ -269,12 +273,25 @@ GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] } C -- CREATE T -- TEMPORARY arwdRxt -- ALL PRIVILEGES (for tables) + + + The above example display would be seen by user miriam after + creating table mytable and doing + + +GRANT SELECT ON mytable TO PUBLIC; +GRANT SELECT,UPDATE,INSERT ON mytable TO GROUP todos; - The command is used to revoke access - privileges. + If the Access privileges column is empty for a given object, +it means the object has default privileges (that is, its privileges field +is NULL). Currently, default privileges are interpreted the same way +for all object types: all privileges for the owner and no privileges for +anyone else. The first GRANT on an object will instantiate +this default (producing, for example, {=,miriam=arwdRxt}) +and then modify it per the specified request.