diff options
| author | Alvaro Herrera <alvherre@alvh.no-ip.org> | 2012-10-23 18:07:26 -0300 |
|---|---|---|
| committer | Alvaro Herrera <alvherre@alvh.no-ip.org> | 2012-10-23 18:24:24 -0300 |
| commit | f4c4335a4aaf5f2ee6e741cdf4f5c8e338d86a2f (patch) | |
| tree | 5367e466c939f55a3bf9dba7275887b309378b16 /doc/src | |
| parent | 4c9d0901f135d724a9f3cfa4140a5afd44b10f08 (diff) | |
| download | postgresql-f4c4335a4aaf5f2ee6e741cdf4f5c8e338d86a2f.tar.gz postgresql-f4c4335a4aaf5f2ee6e741cdf4f5c8e338d86a2f.zip | |
Add context info to OAT_POST_CREATE security hook
... and have sepgsql use it to determine whether to check permissions
during certain operations. Indexes that are being created as a result
of REINDEX, for instance, do not need to have their permissions checked;
they were already checked when the index was created.
Author: KaiGai Kohei, slightly revised by me
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/sepgsql.sgml | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/doc/src/sgml/sepgsql.sgml b/doc/src/sgml/sepgsql.sgml index ff083a06596..522aa8b9903 100644 --- a/doc/src/sgml/sepgsql.sgml +++ b/doc/src/sgml/sepgsql.sgml @@ -450,6 +450,12 @@ UPDATE t1 SET x = 2, y = md5sum(y) WHERE z = 100; </para> <para> + When objects that are subsidiary of other objects (such as a table's indexes + or triggers) are created or dropped, <literal>setattr</> permission will be + checked on the main object, instead of the subsidiary object itself. + </para> + + <para> When <xref linkend="sql-security-label"> is executed, <literal>setattr</> and <literal>relabelfrom</> will be checked on the object being relabeled with its old security label, then <literal>relabelto</> with the supplied |