Doc: fix missing explanation of default object privileges.

tglsfdc · tglsfdc · commit 19989d8480d4 · 2017-10-11T16:56:40.000-04:00
The GRANT reference page, which lists the default privileges for new objects, failed to mention that USAGE is granted by default for data types and domains. As a lesser sin, it also did not specify anything about the initial privileges for sequences, FDWs, foreign servers, or large objects. Fix that, and add a comment to acldefault() in the probably vain hope of getting people to maintain this list in future. Noted by Laurenz Albe, though I editorialized on the wording a bit. Back-patch to all supported branches, since they all have this behavior. Discussion: https://postgr.es/m/1507620895.4152.1.camel@cybertec.at
diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml
@@ -156,12 +156,22 @@ GRANT <replaceable class="PARAMETER">role_name</replaceable> [, ...] TO <replace
   <para>
    PostgreSQL grants default privileges on some types of objects to
    <literal>PUBLIC</literal>.  No privileges are granted to
-   <literal>PUBLIC</literal> by default on tables,
-   columns, schemas or tablespaces. For other types, the default privileges
+   <literal>PUBLIC</literal> by default on
+   tables,
+   table columns,
+   sequences,
+   foreign data wrappers,
+   foreign servers,
+   large objects,
+   schemas,
+   or tablespaces.
+   For other types of objects, the default privileges
    granted to <literal>PUBLIC</literal> are as follows:
-   <literal>CONNECT</literal> and <literal>CREATE TEMP TABLE</literal> for
-   databases; <literal>EXECUTE</literal> privilege for functions; and
-   <literal>USAGE</literal> privilege for languages.
+   <literal>CONNECT</literal> and <literal>TEMPORARY</literal> (create
+   temporary tables) privileges for databases;
+   <literal>EXECUTE</literal> privilege for functions; and
+   <literal>USAGE</literal> privilege for languages and data types
+   (including domains).
    The object owner can, of course, <command>REVOKE</command>
    both default and  expressly granted privileges. (For maximum
    security, issue the <command>REVOKE</> in the same transaction that
diff --git a/src/backend/utils/adt/acl.c b/src/backend/utils/adt/acl.c
@@ -722,7 +722,9 @@ hash_aclitem(PG_FUNCTION_ARGS)
  * acldefault()  --- create an ACL describing default access permissions
  *
  * Change this routine if you want to alter the default access policy for
- * newly-created objects (or any object with a NULL acl entry).
+ * newly-created objects (or any object with a NULL acl entry).  When
+ * you make a change here, don't forget to update the GRANT man page,
+ * which explains all the default permissions.
  *
  * Note that these are the hard-wired "defaults" that are used in the
  * absence of any pg_default_acl entry.

Original file line number	Diff line number	Diff line change
`@@ -722,7 +722,9 @@ hash_aclitem(PG_FUNCTION_ARGS)`
`722`	`722`	`* acldefault() --- create an ACL describing default access permissions`
`723`	`723`	`*`
`724`	`724`	`* Change this routine if you want to alter the default access policy for`
`725`		`- * newly-created objects (or any object with a NULL acl entry).`
	`725`	`+ * newly-created objects (or any object with a NULL acl entry). When`
	`726`	`+ * you make a change here, don't forget to update the GRANT man page,`
	`727`	`+ * which explains all the default permissions.`
`726`	`728`	`*`
`727`	`729`	`* Note that these are the hard-wired "defaults" that are used in the`
`728`	`730`	`* absence of any pg_default_acl entry.`