From 8adf56f77aa0cc8cf4af7a19f0d235fc56fbabc7 Mon Sep 17 00:00:00 2001 From: Peter Eisentraut Date: Mon, 18 Feb 2002 23:11:58 +0000 Subject: Privileges on functions and procedural languages --- doc/src/sgml/catalogs.sgml | 16 ++++++++++++- doc/src/sgml/ref/create_function.sgml | 15 +++++++++++- doc/src/sgml/ref/create_language.sgml | 15 +++++++++--- doc/src/sgml/ref/grant.sgml | 45 +++++++++++++++++++++++++++++------ doc/src/sgml/ref/revoke.sgml | 10 +++++++- doc/src/sgml/release.sgml | 27 ++++++++++++++++++++- 6 files changed, 114 insertions(+), 14 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/catalogs.sgml b/doc/src/sgml/catalogs.sgml index 3e098f75ded..20adc19bab8 100644 --- a/doc/src/sgml/catalogs.sgml +++ b/doc/src/sgml/catalogs.sgml @@ -1,6 +1,6 @@ @@ -1261,6 +1261,13 @@ not currently used + + + lanacl + aclitem[] + + Access permissions + @@ -1699,6 +1706,13 @@ Again, the interpretation is language-specific. + + + proacl + aclitem[] + + Access permissions + diff --git a/doc/src/sgml/ref/create_function.sgml b/doc/src/sgml/ref/create_function.sgml index df643cd8e8b..9e919abba62 100644 --- a/doc/src/sgml/ref/create_function.sgml +++ b/doc/src/sgml/ref/create_function.sgml @@ -1,5 +1,5 @@ @@ -270,6 +270,17 @@ CREATE [ OR REPLACE ] FUNCTION name definition without breaking objects that refer to the function. + + To be able to define a function, the user must have the + USAGE privilege on the language. + + + + By default, only the owner (creator) of the function has the right + to execute it. Other users must be granted the + EXECUTE privilege on the function to be able to + use it. + @@ -369,7 +380,9 @@ Point * complex_to_point (Complex *z) , + , , + , PostgreSQL Programmer's Guide diff --git a/doc/src/sgml/ref/create_language.sgml b/doc/src/sgml/ref/create_language.sgml index 3d2b71198fc..406e8676868 100644 --- a/doc/src/sgml/ref/create_language.sgml +++ b/doc/src/sgml/ref/create_language.sgml @@ -1,5 +1,5 @@ @@ -203,8 +203,8 @@ ERROR: PL handler function funcname @@ -212,6 +212,13 @@ ERROR: PL handler function funcname + + + To be able to use a procedural language, a user must be granted the + USAGE privilege. The + createlang program automatically grants + permissions to everyone if the language is known to be trusted. + @@ -257,6 +264,8 @@ CREATE LANGUAGE plsample + + PostgreSQL Programmer's Guide diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml index 8f07f4adf59..30168f2e65b 100644 --- a/doc/src/sgml/ref/grant.sgml +++ b/doc/src/sgml/ref/grant.sgml @@ -1,5 +1,5 @@ @@ -19,6 +19,14 @@ PostgreSQL documentation GRANT { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,...] | ALL [ PRIVILEGES ] } ON [ TABLE ] objectname [, ...] TO { username | GROUP groupname | PUBLIC } [, ...] + +GRANT { EXECUTE | ALL [ PRIVILEGES ] } + ON FUNCTION funcname ([type, ...]) [, ...] + TO { username | GROUP groupname | PUBLIC } [, ...] + +GRANT { USAGE | ALL [ PRIVILEGES ] } + ON LANGUAGE langname [, ...] + TO { username | GROUP groupname | PUBLIC } [, ...] @@ -27,8 +35,9 @@ GRANT { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,.. The GRANT command gives specific permissions on - an object (table, view, sequence) to one or more users or groups of users. - These permissions are added to those already granted, if any. + an object (table, view, sequence, function, procedural language) to + one or more users or groups of users. These permissions are added + to those already granted, if any. @@ -134,14 +143,36 @@ GRANT { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,.. + + EXECUTE + + + Allows the use of the specified function and the use of any + operators that are implemented on top of the function. This is + the only type of privilege that is applicable to functions. + + + + + + USAGE + + + Allows the use of the specified procedural language for the + creation of functions in that language. This is the only type + of privilege that is applicable to procedural languages. + + + + ALL PRIVILEGES - Grant all of the above privileges at once. The - PRIVILEGES key word is optional in - PostgreSQL, though it is - required by strict SQL. + Grant all of the privileges applicable to the object at once. + The PRIVILEGES key word is optional in + PostgreSQL, though it is required by + strict SQL. diff --git a/doc/src/sgml/ref/revoke.sgml b/doc/src/sgml/ref/revoke.sgml index 6a858c5b3df..c0d03c55344 100644 --- a/doc/src/sgml/ref/revoke.sgml +++ b/doc/src/sgml/ref/revoke.sgml @@ -1,5 +1,5 @@ @@ -19,6 +19,14 @@ PostgreSQL documentation REVOKE { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,...] | ALL [ PRIVILEGES ] } ON [ TABLE ] object [, ...] FROM { username | GROUP groupname | PUBLIC } [, ...] + +REVOKE { EXECUTE | ALL [ PRIVILEGES ] } + ON FUNCTION funcname ([type, ...]) [, ...] + FROM { username | GROUP groupname | PUBLIC } [, ...] + +REVOKE { USAGE | ALL [ PRIVILEGES ] } + ON LANGUAGE langname [, ...] + FROM { username | GROUP groupname | PUBLIC } [, ...] diff --git a/doc/src/sgml/release.sgml b/doc/src/sgml/release.sgml index a4e3bb88672..67a4a7df92e 100644 --- a/doc/src/sgml/release.sgml +++ b/doc/src/sgml/release.sgml @@ -1,10 +1,35 @@ Release Notes + + &version; Development Branch + + + Below is a subset of the changes that have gone into the + development branch of PostgreSQL since version 7.2. For a complete + list of changes, consult the CVS logs. + + + + + + + Release 7.2 -- cgit v1.2.3