Re: Directory/File Access Permissions for COPY and Generic File Access Functions

Robert Haas wrote:

> To articular my own concerns perhaps a bit better, there are two major
> things I don't like about the whole DIRALIAS proposal.  Number one,
> you're creating this SQL object whose name is not actually used for
> anything other than manipulating the alias you created.  The users are
> still operating on pathnames.  That's awfully strange.

I think it would make more sense if the file-accessing command specified
the DIRALIAS (or DIRECTORY, whatever we end up calling this) and a
pathname relative to the base one.  Something like

postgres=# CREATE DIRECTORY logdir ALIAS FOR '/pgsql/data/pg_log';
postgres=# GRANT READ ON DIRECTORY logdir TO logscanner;

logscanner=> COPY logtable FROM 'postgresql-2014-10-28.csv' IN DIRECTORY logdir;

The ALTER ROLE GRANT READ idea proposed downthread is nice also, but one
advantage of this is not having absolute path names in the COPY command.

-- 
Álvaro Herrera                http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services