Re: Role Permissions

"Craig" <postgresql@bryden.co.za> writes:
> I am trying to prevent anyone that inhertis from role1 to not be able to =
> select from any database table, unless they execute a function that I =
> have provided. How do I setup the security for this?=20

You need to mark the function as SECURITY DEFINER, which means that it
runs with its creator's permissions.  By default a function runs with
the caller's permissions.

(Yeah, SECURITY DEFINER is a pretty obscure name for this.  It's what
the SQL spec requires though :-()

            regards, tom lane