Re: fixing CREATEROLE

Поиск
Список
Период
Сортировка
От David G. Johnston
Тема Re: fixing CREATEROLE
Дата
Msg-id CAKFQuwZYsfKKBEFUZhZ8FrKPHooscVuMXUYAMohgpe5nJeTKvw@mail.gmail.com
обсуждение исходный текст
Ответ на Re: fixing CREATEROLE  (Robert Haas <robertmhaas@gmail.com>)
Список pgsql-hackers
On Wed, Nov 23, 2022 at 2:01 PM Robert Haas <robertmhaas@gmail.com> wrote:
 
In the latter case there are two, one with
grantor=bootstrap_supeuser/admin_option=true/set_option=false/inherit_option=false
and a second with
grantor=alice/admin_option=false/set_option=true/inherit_option=true.

This, IMO, is preferable.  And I'd probably typically want to hide the first grant from the user in typical cases - it is an implementation detail.

We have to grant the creating role membership in the created role, with admin option, as a form of bookkeeping.

If the creating role really wants to be a member of the created role for other reasons that should be done explicitly and granted by the creating role.

This patch series need not be concerned about how easy or difficult it is to get the additional grant entry into the database.  The ability to refine the permissions in the data model is there so there should be no complaints that "it is impossible to set up this combination of permissions".  We've provided a detailed model and commands to alter it - the users can build their scripts to glue those things together.

David J.

В списке pgsql-hackers по дате отправления:

Предыдущее
От: Tom Lane
Дата:
Сообщение: Re: fixing CREATEROLE
Следующее
От: samay sharma
Дата:
Сообщение: Re: Documentation for building with meson