Skip to content

Commit 8adf56f

Browse files
peterepetere
committed
Privileges on functions and procedural languages
1 parent 5e03503 commit 8adf56f

35 files changed

+2320
-1529
lines changed

‎doc/src/sgml/catalogs.sgml

+15-1
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<!--
22
Documentation of the system catalogs, directed toward PostgreSQL developers
3-
$Header: /cvsroot/pgsql/doc/src/sgml/catalogs.sgml,v 2.29 2001/11/21 05:53:40 thomas Exp $
3+
$Header: /cvsroot/pgsql/doc/src/sgml/catalogs.sgml,v 2.30 2002/02/18 23:10:59 petere Exp $
44
-->
55

66
<chapter id="catalogs">
@@ -1261,6 +1261,13 @@
12611261
<entry></entry>
12621262
<entry>not currently used</entry>
12631263
</row>
1264+
1265+
<row>
1266+
<entry>lanacl</entry>
1267+
<entry><type>aclitem[]</type></entry>
1268+
<entry></entry>
1269+
<entry>Access permissions</entry>
1270+
</row>
12641271
</tbody>
12651272
</tgroup>
12661273
</table>
@@ -1699,6 +1706,13 @@
16991706
Again, the interpretation is language-specific.
17001707
</entry>
17011708
</row>
1709+
1710+
<row>
1711+
<entry>proacl</entry>
1712+
<entry><type>aclitem[]</type></entry>
1713+
<entry></entry>
1714+
<entry>Access permissions</entry>
1715+
</row>
17021716
</tbody>
17031717
</tgroup>
17041718
</table>

‎doc/src/sgml/ref/create_function.sgml

+14-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$Header: /cvsroot/pgsql/doc/src/sgml/ref/create_function.sgml,v 1.30 2001/12/08 03:24:34 thomas Exp $
2+
$Header: /cvsroot/pgsql/doc/src/sgml/ref/create_function.sgml,v 1.31 2002/02/18 23:11:02 petere Exp $
33
-->
44

55
<refentry id="SQL-CREATEFUNCTION">
@@ -270,6 +270,17 @@ CREATE [ OR REPLACE ] FUNCTION <replaceable class="parameter">name</replaceable>
270270
definition without breaking objects that refer to the function.
271271
</para>
272272

273+
<para>
274+
To be able to define a function, the user must have the
275+
<literal>USAGE</literal> privilege on the language.
276+
</para>
277+
278+
<para>
279+
By default, only the owner (creator) of the function has the right
280+
to execute it. Other users must be granted the
281+
<literal>EXECUTE</literal> privilege on the function to be able to
282+
use it.
283+
</para>
273284
</refsect1>
274285

275286

@@ -369,7 +380,9 @@ Point * complex_to_point (Complex *z)
369380

370381
<para>
371382
<xref linkend="sql-dropfunction">,
383+
<xref linkend="sql-grant">,
372384
<xref linkend="sql-load">,
385+
<xref linkend="sql-revoke">,
373386
<citetitle>PostgreSQL Programmer's Guide</citetitle>
374387
</para>
375388
</refsect1>

‎doc/src/sgml/ref/create_language.sgml

+12-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$Header: /cvsroot/pgsql/doc/src/sgml/ref/create_language.sgml,v 1.20 2001/12/08 03:24:34 thomas Exp $
2+
$Header: /cvsroot/pgsql/doc/src/sgml/ref/create_language.sgml,v 1.21 2002/02/18 23:11:02 petere Exp $
33
PostgreSQL documentation
44
-->
55

@@ -203,15 +203,22 @@ ERROR: PL handler function <replaceable class="parameter">funcname</replaceable
203203
lanname | lanispl | lanpltrusted | lanplcallfoid | lancompiler
204204
-------------+---------+--------------+---------------+-------------
205205
internal | f | f | 0 | n/a
206-
C | f | f | 0 | /bin/cc
207-
sql | f | f | 0 | postgres
206+
c | f | f | 0 | /bin/cc
207+
sql | f | t | 0 | postgres
208208
</screen>
209209
</para>
210210

211211
<para>
212212
At present, the definition of a procedural language cannot be
213213
changed once it has been created.
214214
</para>
215+
216+
<para>
217+
To be able to use a procedural language, a user must be granted the
218+
<literal>USAGE</literal> privilege. The
219+
<command>createlang</command> program automatically grants
220+
permissions to everyone if the language is known to be trusted.
221+
</para>
215222
</refsect1>
216223

217224
<refsect1 id="sql-createlanguage-examples">
@@ -257,6 +264,8 @@ CREATE LANGUAGE plsample
257264
<member><xref linkend="sql-createfunction"></member>
258265
<member><xref linkend="app-droplang"></member>
259266
<member><xref linkend="sql-droplanguage"></member>
267+
<member><xref linkend="sql-grant"></member>
268+
<member><xref linkend="sql-revoke"></member>
260269
<member><citetitle>PostgreSQL Programmer's Guide</citetitle></member>
261270
</simplelist>
262271
</para>

‎doc/src/sgml/ref/grant.sgml

+38-7
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$Header: /cvsroot/pgsql/doc/src/sgml/ref/grant.sgml,v 1.19 2002/01/20 22:19:57 petere Exp $
2+
$Header: /cvsroot/pgsql/doc/src/sgml/ref/grant.sgml,v 1.20 2002/02/18 23:11:02 petere Exp $
33
PostgreSQL documentation
44
-->
55

@@ -19,6 +19,14 @@ PostgreSQL documentation
1919
GRANT { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,...] | ALL [ PRIVILEGES ] }
2020
ON [ TABLE ] <replaceable class="PARAMETER">objectname</replaceable> [, ...]
2121
TO { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
22+
23+
GRANT { EXECUTE | ALL [ PRIVILEGES ] }
24+
ON FUNCTION <replaceable>funcname</replaceable> ([<replaceable>type</replaceable>, ...]) [, ...]
25+
TO { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
26+
27+
GRANT { USAGE | ALL [ PRIVILEGES ] }
28+
ON LANGUAGE <replaceable>langname</replaceable> [, ...]
29+
TO { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
2230
</synopsis>
2331
</refsynopsisdiv>
2432

@@ -27,8 +35,9 @@ GRANT { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,..
2735

2836
<para>
2937
The <command>GRANT</command> command gives specific permissions on
30-
an object (table, view, sequence) to one or more users or groups of users.
31-
These permissions are added to those already granted, if any.
38+
an object (table, view, sequence, function, procedural language) to
39+
one or more users or groups of users. These permissions are added
40+
to those already granted, if any.
3241
</para>
3342

3443
<para>
@@ -134,14 +143,36 @@ GRANT { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,..
134143
</listitem>
135144
</varlistentry>
136145

146+
<varlistentry>
147+
<term>EXECUTE</term>
148+
<listitem>
149+
<para>
150+
Allows the use of the specified function and the use of any
151+
operators that are implemented on top of the function. This is
152+
the only type of privilege that is applicable to functions.
153+
</para>
154+
</listitem>
155+
</varlistentry>
156+
157+
<varlistentry>
158+
<term>USAGE</term>
159+
<listitem>
160+
<para>
161+
Allows the use of the specified procedural language for the
162+
creation of functions in that language. This is the only type
163+
of privilege that is applicable to procedural languages.
164+
</para>
165+
</listitem>
166+
</varlistentry>
167+
137168
<varlistentry>
138169
<term>ALL PRIVILEGES</term>
139170
<listitem>
140171
<para>
141-
Grant all of the above privileges at once. The
142-
<literal>PRIVILEGES</literal> key word is optional in
143-
<productname>PostgreSQL</productname>, though it is
144-
required by strict SQL.
172+
Grant all of the privileges applicable to the object at once.
173+
The <literal>PRIVILEGES</literal> key word is optional in
174+
<productname>PostgreSQL</productname>, though it is required by
175+
strict SQL.
145176
</para>
146177
</listitem>
147178
</varlistentry>

‎doc/src/sgml/ref/revoke.sgml

+9-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$Header: /cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.19 2001/12/08 03:24:39 thomas Exp $
2+
$Header: /cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.20 2002/02/18 23:11:03 petere Exp $
33
PostgreSQL documentation
44
-->
55

@@ -19,6 +19,14 @@ PostgreSQL documentation
1919
REVOKE { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,...] | ALL [ PRIVILEGES ] }
2020
ON [ TABLE ] <replaceable class="PARAMETER">object</replaceable> [, ...]
2121
FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
22+
23+
REVOKE { EXECUTE | ALL [ PRIVILEGES ] }
24+
ON FUNCTION <replaceable>funcname</replaceable> ([<replaceable>type</replaceable>, ...]) [, ...]
25+
FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
26+
27+
REVOKE { USAGE | ALL [ PRIVILEGES ] }
28+
ON LANGUAGE <replaceable>langname</replaceable> [, ...]
29+
FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
2230
</synopsis>
2331
</refsynopsisdiv>
2432

‎doc/src/sgml/release.sgml

+26-1
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,35 @@
11
<!--
2-
$Header: /cvsroot/pgsql/doc/src/sgml/release.sgml,v 1.115 2002/01/31 21:20:03 momjian Exp $
2+
$Header: /cvsroot/pgsql/doc/src/sgml/release.sgml,v 1.116 2002/02/18 23:11:00 petere Exp $
33
-->
44

55
<appendix id="release">
66
<title>Release Notes</title>
77

8+
<sect1 id="release-devel">
9+
<title>&version; Development Branch</title>
10+
11+
<para>
12+
Below is a subset of the changes that have gone into the
13+
development branch of PostgreSQL since version 7.2. For a complete
14+
list of changes, consult the CVS logs.
15+
</para>
16+
17+
<!--
18+
Developers: When you add a feature, mention it here. This avoids
19+
lossiness when digging out the information from the CVS logs, and
20+
furthermore it advertises your feature to external parties at the
21+
earliest possible moment.
22+
23+
CDATA means the content is "SGML-free", so you can write without
24+
worries about funny characters.
25+
-->
26+
<literallayout><![CDATA[
27+
Access privileges on functions
28+
Access privileges on procedural languages
29+
]]></literallayout>
30+
31+
</sect1>
32+
833
<sect1 id="release-7-2">
934
<title>Release 7.2</title>
1035

0 commit comments

Comments
 (0)