Re: [HACKERS] REFERENCES privilege should not be symmetric (was Re: [GENERAL] Postgres Permissions Article)

2017-03-31 Thread Tom Lane
"David G. Johnston" writes: > On Fri, Mar 31, 2017 at 10:40 AM, Tom Lane wrote: >> I think the benefit is reduction of user confusion. Admittedly, since >> Paul is the first person I can remember ever having complained about it, >> maybe nobody else is confused. > ​After going back-and-forth on

Re: [HACKERS] REFERENCES privilege should not be symmetric (was Re: [GENERAL] Postgres Permissions Article)

2017-03-31 Thread Magnus Hagander
On Fri, Mar 31, 2017 at 7:40 PM, Tom Lane wrote: > Robert Haas writes: > > On Fri, Mar 31, 2017 at 11:29 AM, Tom Lane wrote: > >> The argument for not back-patching a bug fix usually boils down to > >> fear of breaking existing applications, but it's hard to see how > >> removal of a permission

Re: [HACKERS] REFERENCES privilege should not be symmetric (was Re: [GENERAL] Postgres Permissions Article)

2017-03-31 Thread David G. Johnston
On Fri, Mar 31, 2017 at 10:40 AM, Tom Lane wrote: > Robert Haas writes: > > On Fri, Mar 31, 2017 at 11:29 AM, Tom Lane wrote: > >> The argument for not back-patching a bug fix usually boils down to > >> fear of breaking existing applications, but it's hard to see how > >> removal of a permissio

Re: [HACKERS] REFERENCES privilege should not be symmetric (was Re: [GENERAL] Postgres Permissions Article)

2017-03-31 Thread Tom Lane
Robert Haas writes: > On Fri, Mar 31, 2017 at 11:29 AM, Tom Lane wrote: >> The argument for not back-patching a bug fix usually boils down to >> fear of breaking existing applications, but it's hard to see how >> removal of a permission check could break a working application --- >> especially wh

Re: [HACKERS] REFERENCES privilege should not be symmetric (was Re: [GENERAL] Postgres Permissions Article)

2017-03-31 Thread Robert Haas
On Fri, Mar 31, 2017 at 11:29 AM, Tom Lane wrote: > Robert Haas writes: >> On Thu, Mar 30, 2017 at 4:45 PM, Tom Lane wrote: >>> In short, it seems like this statement in the docs is correctly describing >>> our code's behavior, but said behavior is wrong and should be changed. >>> I'd propose fi

Re: [HACKERS] REFERENCES privilege should not be symmetric (was Re: [GENERAL] Postgres Permissions Article)

2017-03-31 Thread Tom Lane
Robert Haas writes: > On Thu, Mar 30, 2017 at 4:45 PM, Tom Lane wrote: >> In short, it seems like this statement in the docs is correctly describing >> our code's behavior, but said behavior is wrong and should be changed. >> I'd propose fixing it like that in HEAD; I'm not sure if the back branc

Re: [HACKERS] REFERENCES privilege should not be symmetric (was Re: [GENERAL] Postgres Permissions Article)

2017-03-31 Thread Robert Haas
On Thu, Mar 30, 2017 at 4:45 PM, Tom Lane wrote: > In short, it seems like this statement in the docs is correctly describing > our code's behavior, but said behavior is wrong and should be changed. > I'd propose fixing it like that in HEAD; I'm not sure if the back branches > should also be chang

REFERENCES privilege should not be symmetric (was Re: [GENERAL] Postgres Permissions Article)

2017-03-30 Thread Tom Lane
Paul Jungwirth writes: >> Also I don't understand why you wrote “You need the permission on both >> tables”: Only the owner of a table can add constraints to it > Ah, this piece was really helpful for me in making it click. Thanks so > much! I added a couple new paragraphs to my post with a link

Re: [GENERAL] Postgres Permissions Article

2017-03-30 Thread Paul Jungwirth
Also I don't understand why you wrote “You need the permission on both tables”: Only the owner of a table can add constraints to it Ah, this piece was really helpful for me in making it click. Thanks so much! I added a couple new paragraphs to my post with a link back to this thread. I feel li

Re: [GENERAL] Postgres Permissions Article

2017-03-30 Thread Peter J. Holzer
On 2017-03-29 08:05:23 -0700, Paul Jungwirth wrote: > On 03/29/2017 06:36 AM, Tom Lane wrote: > >Karsten Hilbert writes: > >>Being able to create foreign keys may allow to indirectly > >>discover whether certain values exists in a table which I > >>don't otherwise have access to (by means of failu

Re: [GENERAL] Postgres Permissions Article

2017-03-29 Thread Paul Jungwirth
On 03/29/2017 06:36 AM, Tom Lane wrote: Karsten Hilbert writes: Being able to create foreign keys may allow to indirectly discover whether certain values exists in a table which I don't otherwise have access to (by means of failure or success to create a judiciously crafted FK). Aside from th

Re: [GENERAL] Postgres Permissions Article

2017-03-29 Thread Tom Lane
Karsten Hilbert writes: > On Tue, Mar 28, 2017 at 09:47:40AM -0700, Paul Jungwirth wrote: >> I wrote a blog post about the Postgres permissions system, and I thought I'd >> share: >> http://illuminatedcomputing.com/posts/2017/03/postgres-permissions/ > Not that I am an expert in any way but here'

Re: [GENERAL] Postgres Permissions Article

2017-03-29 Thread Karsten Hilbert
On Tue, Mar 28, 2017 at 09:47:40AM -0700, Paul Jungwirth wrote: > I wrote a blog post about the Postgres permissions system, and I thought I'd > share: > > http://illuminatedcomputing.com/posts/2017/03/postgres-permissions/ > I also shared a few opinions amidst the facts (like that `USAGE` for s

[GENERAL] Postgres Permissions Article

2017-03-28 Thread Paul Jungwirth
Hi All, I wrote a blog post about the Postgres permissions system, and I thought I'd share: http://illuminatedcomputing.com/posts/2017/03/postgres-permissions/ The main point I wanted to convey, which I somehow never grasped confidently from reading the docs or other articles, is how permiss