Add a SET option to the GRANT command. Similar to how the INHERIT option controls whether or not the permissions of the granted role are automatically available to the grantee, the new SET permission controls whether or not the grantee may use the SET ROLE command to assume the privileges of the granted role.
In addition, the new SET permission controls whether or not it is possible to transfer ownership of objects to the target role or to create new objects owned by the target role using commands such as CREATE DATABASE .. OWNER. We could alternatively have made this controlled by the INHERIT option, or allow it when either option is given. An advantage of this approach is that if you are granted a predefined role with INHERIT TRUE, SET FALSE, you can't go and create objects owned by that role. The underlying theory here is that the ability to create objects as a target role is not a privilege per se, and thus does not depend on whether you inherit the target role's privileges. However, it's surely something you could do anyway if you could SET ROLE to the target role, and thus making it contingent on whether you have that ability is reasonable. Design review by Nathan Bossat, Wolfgang Walther, Jeff Davis, Peter Eisentraut, and Stephen Frost. Discussion: http://postgr.es/m/ca+tgmob+zdsrs6jxyrgq0nwdzcxutnzt5ek54dn2hhgt17n...@mail.gmail.com Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/3d14e171e9e2236139e8976f3309a588bcc8683b Modified Files -------------- doc/src/sgml/catalogs.sgml | 11 +++ doc/src/sgml/func.sgml | 9 ++- doc/src/sgml/ref/grant.sgml | 32 ++++++--- doc/src/sgml/ref/revoke.sgml | 8 +-- doc/src/sgml/ref/set_role.sgml | 9 ++- doc/src/sgml/user-manag.sgml | 20 ++++-- src/backend/commands/alter.c | 2 +- src/backend/commands/dbcommands.c | 4 +- src/backend/commands/foreigncmds.c | 2 +- src/backend/commands/publicationcmds.c | 2 +- src/backend/commands/schemacmds.c | 4 +- src/backend/commands/tablecmds.c | 2 +- src/backend/commands/typecmds.c | 2 +- src/backend/commands/user.c | 44 +++++++++++- src/backend/commands/variable.c | 2 +- src/backend/utils/adt/acl.c | 106 +++++++++++++++++++++------- src/bin/pg_dump/pg_dumpall.c | 23 ++++-- src/include/catalog/pg_auth_members.h | 1 + src/include/utils/acl.h | 3 +- src/test/regress/expected/alter_generic.out | 38 +++++----- src/test/regress/expected/foreign_data.out | 2 +- src/test/regress/expected/privileges.out | 41 +++++++++++ src/test/regress/sql/privileges.sql | 39 ++++++++++ 23 files changed, 315 insertions(+), 91 deletions(-)
