On Sat, Nov 8, 2014 at 6:24 PM, Andres Freund <andres@2ndquadrant.com> wrote:
> On 2014-11-08 17:49:30 -0500, Robert Haas wrote:
>> Patch 2 adds support for GRANT and REVOKE to the event trigger
>> mechanism. I wonder if it's a bad idea to make the
>> ddl_command_start/end events fire for DCL. We discussed a lot of
>> these issues when this patch originally went in, and I think it'd be
>> worth revisiting that discussion.
>
> Well, it doesn't generally support it for all GRANT statement, but just
> for ones that are database local. I think that mostly skirts the
> problems from the last round of discussion. But I only vaguely remember
> them.
The issue I was alluding to was terminological: it's not clear that
GRANT and REVOKE should be called DDL rather than DCL, although we do
have precedent in some of the logging settings.
The other issue I remember is that if you have a separate event
trigger for GRANT/REVOKE, you can expose fields like operation/object
type/permission/target. That's much harder to do for an event trigger
that's very broad.
But anyway, I think it would be worth going back and looking at the
previous discussion.
> As I said, there was clear interest at at least two of the cluster
> hackers meetings...
We need to get some better data here.
But again, my core concern is that we have no good way to test this
code for bugs, including of omission, without which I think we will be
very sad.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company