Tag: privileges

Waiting for PostgreSQL 16 – Add grantable MAINTAIN privilege and pg_maintain role.

On 14th of December 2022, Jeff Davis committed patch:

Add grantable MAINTAIN privilege and pg_maintain role.
 
Allows VACUUM, ANALYZE, REINDEX, REFRESH MATERIALIZED VIEW, CLUSTER,
and LOCK TABLE.
 
Effectively reverts 4441fc704d. Instead of creating separate
privileges for VACUUM, ANALYZE, and other maintenance commands, group
them together under a single MAINTAIN privilege.
 
Author: Nathan Bossart
Discussion: https://postgr.es/m/20221212210136.GA449764@nathanxps13
Discussion: https://postgr.es/m/45224.1670476523@sss.pgh.pa.us

Continue reading Waiting for PostgreSQL 16 – Add grantable MAINTAIN privilege and pg_maintain role.

Waiting for PostgreSQL 15 – Add support for security invoker views.

On 22nd of March 2022, Dean Rasheed committed patch:

Add support for security invoker views. 
 
A security invoker view checks permissions for accessing its
underlying base relations using the privileges of the user of the
view, rather than the privileges of the view owner. Additionally, if
any of the base relations are tables with RLS enabled, the policies of
the user of the view are applied, rather than those of the view owner.
 
This allows views to be defined without giving away additional
privileges on the underlying base relations, and matches a similar
feature available in other database systems.
 
It also allows views to operate more naturally with RLS, without
affecting the assignments of policies to users.
 
Christoph Heiss, with some additional hacking by me. Reviewed by
Laurenz Albe and Wolfgang Walther.
 
Discussion: https://postgr.es/m/b66dd6d6-ad3e-c6f2-8b90-47be773da240%40cybertec.at

Continue reading Waiting for PostgreSQL 15 – Add support for security invoker views.

Waiting for PostgreSQL 15 – Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner.

On 10th of September 2021, Noah Misch committed patch:

Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner.
 
This switches the default ACL to what the documentation has recommended
since CVE-2018-1058.  Upgrades will carry forward any old ownership and
ACL.  Sites that declined the 2018 recommendation should take a fresh
look.  Recipes for commissioning a new database cluster from scratch may
need to create a schema, grant more privileges, etc.  Out-of-tree test
suites may require such updates.
 
Reviewed by Peter Eisentraut.
 
Discussion: https://postgr.es/m/20201031163518.GB4039133@rfd.leadboat.com

Continue reading Waiting for PostgreSQL 15 – Revoke PUBLIC CREATE from public schema, now owned by pg_database_owner.

Waiting for PostgreSQL 14 – Add “pg_database_owner” default role.

On 26th of March 2021, Noah Misch committed patch:

Add "pg_database_owner" default role.
 
Membership consists, implicitly, of the current database owner.  Expect
use in template databases.  Once pg_database_owner has rights within a
template, each owner of a database instantiated from that template will
exercise those rights.
 
Reviewed by John Naylor.
 
Discussion: https://postgr.es/m/20201228043148.GA1053024@rfd.leadboat.com

Continue reading Waiting for PostgreSQL 14 – Add “pg_database_owner" default role.

Waiting for 8.5 – “GRANT ALL”

One of the most common (or perhaps even the most common) question people have regarding PostgreSQL, is how to change privileges for all tables.

Usually they want something like MySQL's:

GRANT ... ON DATABASE.* TO ...

Which is interesting as it is actually 2 distinct features in one:

  • grant privileges on all existing tables
  • automatically grant privileges on all tables that will be created in this database in the future

Now, thanks to 2 new patches – we have this possibility in PostgreSQL.

Continue reading Waiting for 8.5 – “GRANT ALL"

Waiting for 8.4 – column level privileges.

On 22nd of January, Tom Lane committed patch by Stephen Frost, which adds column level privileges:

Log Message:
-----------
Support column-level privileges, as required by SQL standard.
 
Stephen Frost, with help from KaiGai Kohei and others

Continue reading Waiting for 8.4 – column level privileges.