> As for the pg_privileges relation and whatnot...is this something we want
> for v6.3 (can it be done in 2weeks?) or wait until after v6.3 is released?

I don't think (realistically) that such a task could be done in two weeks.  No.
Rather, we should wait until after release 6.3, and then maybe spend some time
debating on what the pg_privileges table should look like.  After the table is
created (the easy part), then it becomes a hunt to find all the places where
privileges are checked and change to the code in these spot (not too bad really).
Finally, we have to develop the code for governing column permissions (this is
the most difficult part of the project).  The query processor must be changed
to check the permissions of each column in all commands.

This would be a tall order for two weeks.  Especially, to be certain that we
had a consensus among the hacker community that what was being done was being
done in the best way possible.

Todd A. Brandys
brandys@eng3.hep.uiuc.edu

Thu, 15 Jan 1998 14:41:51 -0600
todd brandys <brandys@eng3.hep.uiuc.edu>
Re: New pg_pwd patch and stuff
> 
> > As for the pg_privileges relation and whatnot...is this something we want
> > for v6.3 (can it be done in 2weeks?) or wait until after v6.3 is released?
> 
> I don't think (realistically) that such a task could be done in two weeks.  No.
> Rather, we should wait until after release 6.3, and then maybe spend some time
> debating on what the pg_privileges table should look like.  After the table is
> created (the easy part), then it becomes a hunt to find all the places where
> privileges are checked and change to the code in these spot (not too bad really).
> Finally, we have to develop the code for governing column permissions (this is
> the most difficult part of the project).  The query processor must be changed
> to check the permissions of each column in all commands.
> 
> This would be a tall order for two weeks.  Especially, to be certain that we
> had a consensus among the hacker community that what was being done was being
> done in the best way possible.


I believe doing permissions on VIEWS would be much simpler than
column-level permissions.  That way, you create the view with the
columns you need, and give that to the user.

-- 
Bruce Momjian
maillist@candle.pha.pa.us

Thu, 15 Jan 1998 16:05:54 -0500 (EST)
Bruce Momjian <maillist@candle.pha.pa.us>
Re: [HACKERS] Re: New pg_pwd patch and stuff