Hi,

    while  writing  the  chapter  about  Rules  and permissions I
    remember that there was a problem with non privileged  users.
    As  soon  as  someone without superuser privs does a GRANT or
    REVOKE on his relations, he must GRANT explicitly to  himself
    too  or  will  get  a  "permission denied". I think since the
    table owner allway  has  the  right  to  change  ACL's,  this
    doesn't  make sense. I'll dig it up and send in a patch soon.

    While doing this, should I exclude RULE permission from GRANT
    ALL?  I think it's dangerous to have it included, because the
    usual way to give full access is  a  GRANT  ALL  and  someone
    might  forget  that  this  includes the right to disable rule
    actions for a moment. The output of pg_rules gives anyone the
    knowledge to reinstall the correct rules after. An explicitly
    required GRANT RULE is better IMHO. And the RULE right  isn't
    standard, is it?


Jan

--

#======================================================================#
# It's easier to get forgiveness for being wrong than for being right. #
# Let's break this rule - forgive me.                                  #
#======================================== jwieck@debis.com (Jan Wieck) #



Wed, 21 Oct 1998 18:13:50 +0200 (MET DST)
jwieck@debis.com (Jan Wieck)
ACL's
I think it should stay that way - being able to deny oneself a privilege is a
good way to make sure that one does what one does consciously. I know the
root password on many machines, but I still do almost everything through a
normal account - that way I have to make a conscious decison to become
dangerous :-) and if I accidentaly try to do something dangerous as an
ordinary user a) it doesn't happen and b) I'm reminded how dangerous it is.
I still have the ability to do dangerous things, I just have to take an extra
step.

I agree with your point regarding RULE permission and GRANT ALL; however,
GRANT ALL really should grant ALL, don't you think? Maybe add a variant
"GRANT NORMAL", where "NORMAL" is a mask of permissions set by the
administrator (of the given database of course).

Regards, K.

Am 21-Oct-98 schrieb Jan Wieck:
> Hi,
> 
>     while  writing  the  chapter  about  Rules  and permissions I
>     remember that there was a problem with non privileged  users.
>     As  soon  as  someone without superuser privs does a GRANT or
>     REVOKE on his relations, he must GRANT explicitly to  himself
>     too  or  will  get  a  "permission denied". I think since the
>     table owner allway  has  the  right  to  change  ACL's,  this
>     doesn't  make sense. I'll dig it up and send in a patch soon.
> 
>     While doing this, should I exclude RULE permission from GRANT
>     ALL?  I think it's dangerous to have it included, because the
>     usual way to give full access is  a  GRANT  ALL  and  someone
>     might  forget  that  this  includes the right to disable rule
>     actions for a moment. The output of pg_rules gives anyone the
>     knowledge to reinstall the correct rules after. An explicitly
>     required GRANT RULE is better IMHO. And the RULE right  isn't
>     standard, is it?
> 
> 
> Jan
> 
> --
> 
>#======================================================================#
># It's easier to get forgiveness for being wrong than for being right. #
># Let's break this rule - forgive me.                                  #
>#======================================== jwieck@debis.com (Jan Wieck) #
> 
> 
> 

---
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Karl Auer (auer@kom.id.ethz.ch)              Geschaeft/work     +41-1-6327531
Kommunikation, ETHZ RZ                          Privat/home     +41-1-4517941
Clausiusstrasse 59                                      Fax     +41-1-6321225
CH-8092 ZUERICH Switzerland

Wed, 21 Oct 1998 23:12:53 +0200 (MET DST)
Karl Auer <auer@kom.id.ethz.ch>
RE: [HACKERS] ACL's
[Charset iso-8859-1 unsupported, filtering to ASCII...]
> I think it should stay that way - being able to deny oneself a privilege is a
> good way to make sure that one does what one does consciously. I know the
> root password on many machines, but I still do almost everything through a
> normal account - that way I have to make a conscious decison to become
> dangerous :-) and if I accidentaly try to do something dangerous as an
> ordinary user a) it doesn't happen and b) I'm reminded how dangerous it is.
> I still have the ability to do dangerous things, I just have to take an extra
> step.

What do other DB's do.  I assume they give the owner permission.


-- 
  Bruce Momjian                        |  http://www.op.net/~candle
  maillist@candle.pha.pa.us            |  (610) 853-3000
  +  If your life is a hard drive,     |  830 Blythe Avenue
  +  Christ can be your backup.        |  Drexel Hill, Pennsylvania 19026

Wed, 21 Oct 1998 17:36:17 -0400 (EDT)
Bruce Momjian <maillist@candle.pha.pa.us>
Re: [HACKERS] ACL's
> 
> [Charset iso-8859-1 unsupported, filtering to ASCII...]
> > I think it should stay that way - being able to deny oneself a privilege is a
> > good way to make sure that one does what one does consciously. I know the
> > root password on many machines, but I still do almost everything through a
> > normal account - that way I have to make a conscious decison to become
> > dangerous :-) and if I accidentaly try to do something dangerous as an
> > ordinary user a) it doesn't happen and b) I'm reminded how dangerous it is.
> > I still have the ability to do dangerous things, I just have to take an extra
> > step.
> 
> What do other DB's do.  I assume they give the owner permission.

    Hmmm... so it's a TODO for 6.5 after beeing discussed.


Jan

-- 

#======================================================================#
# It's easier to get forgiveness for being wrong than for being right. #
# Let's break this rule - forgive me.                                  #
#======================================== jwieck@debis.com (Jan Wieck) #


Thu, 22 Oct 1998 10:50:17 +0200 (MET DST)
jwieck@debis.com (Jan Wieck)
Re: [HACKERS] ACL's