Andres Freund <andres@2ndquadrant.com> writes:
> On 2014-01-21 20:00:51 -0500, Stephen Frost wrote:
>> Don't know what folks think of removing those in-the-function checks in
>> favor of trusting the grant/revoke system to not allow those functions
>> to be called unless you have EXECUTE privileges on them..
> Well, they *do* return some information when called without superuser
> privileges. Just not all columns for all sessions. I don't think you can
> achieve that with anything in our permission system.
Yeah. We could replace blanket works-or-throws-error cases with
permission-to-call-the-function (and I see no reason not to).
But there are lots of cases where the current behavior is more
fine-grained than that.
regards, tom lane