Обсуждение: Re: [QUESTIONS] Trouble creating view\

Moved to pgsql-hackers@postgresql.org


On Mon, 16 Feb 1998, Bruce Momjian wrote:

> Sure doesn't, but I think it is the same problem with pg_database.  The
> problem is that there is no permission control over tables finer than
> insert/delete/update permissions.  That is, if you say someone can add
> and delete views by inserting/deleting in pg_rewrite, there is no way to
> prevent him from deleting other people's views, at least as it is now
> set up.
>
> With pg_database, people used to be able to create databases, but not
> delete them, that is, we gave them insert permission, but no delete
> permission.  But that meant people could create databases, but not
> delete them.  In 6.3, I enabled normal users with create database
> permission to delete databases, but now they can delete anyone's
> database, or at least the record in pg_database if they directly modify
> pg_database rather than trying the 'drop database' command.
>
> No way around that as the current system is configured, and I am not
> sure how to fix this.
>
> With pg_rewrite, the problem is harder because we don't have a 'is able
> to create views' permission that we can give permission to certain
> people.

    Every database/table/view has an owner associated with them, no?
Can a check not be put in that checks the owner of the database/table/view
against who is trying to delete it, with pg_superuser having "override"
privileges? Obviously, the security level of the database itself comes
into play, but we have most (if not all?) of those in place and settable
by the administrator...

Marc G. Fournier
Systems Administrator @ hub.org
primary: scrappy@hub.org           secondary: scrappy@{freebsd|postgresql}.org

> > With pg_rewrite, the problem is harder because we don't have a 'is able
> > to create views' permission that we can give permission to certain
> > people.
>
>     Every database/table/view has an owner associated with them, no?
> Can a check not be put in that checks the owner of the database/table/view
> against who is trying to delete it, with pg_superuser having "override"
> privileges? Obviously, the security level of the database itself comes
> into play, but we have most (if not all?) of those in place and settable
> by the administrator...

I think the simple answer is no.  We don't look at the DATA in the table
to determine if the person can delete a particular row, and that is what
we would require.  The way the 'drop database' does it is to check the
owner of the database, then issue the deletes only if they match or if
it is the superuser.  However, there is not restriction on the user
accessing pg_database directly.  We would need some kind of access
checking filter inside the executor that would look at each row about to
be modified, and determine if it is legal.

--
Bruce Momjian
maillist@candle.pha.pa.us