Hi all, 

We are building security system for a project where the security is modeled
based on the sql-92 GRANT/REVOKE statements.

I was going through the documentation of postgresql related to GRANT/REVOKE
statements.

 

Following statement says that "with grant option" is not allowed to a user
group. I would like to know what the reasons behind not implementing

this kind of feature.

 

If WITH GRANT OPTION is specified, the recipient of the privilege may in
turn grant it to others. By default this is not allowed. Grant options can
only be granted to individual users, not to groups or PUBLIC.

 

http://developer.postgresql.org/docs/postgres/sql-grant.html
<http://developer.postgresql.org/docs/postgres/sql-grant.html> 

 

I looked into ORACLE database also they don't support user groups, but they
support roles. But even for roles "with grant option" is not allowed.

 

Thanks & regards,

Ramu










Hi all, 
We are building security system for a project where the
security is modeled based on the sql-92 GRANT/REVOKE statements.
I was going through the documentation of postgresql related
to GRANT/REVOKE statements.
 
Following statement says that "with grant option"
is not allowed to a user group. I would like to know what the reasons behind
not implementing
this kind of feature.
 
If WITH
GRANT OPTION is
specified, the recipient of the privilege may in turn grant it to others. By
default this is not allowed. Grant options can only be granted to individual
users, not to groups or PUBLIC.
 
http://developer.postgresql.org/docs/postgres/sql-grant.html
 
I looked into ORACLE database also they don't support user
groups, but they support roles. But even for roles "with grant
option" is not allowed.
 
Thanks & regards,
Ramu
Fri, 9 Jan 2004 19:44:03 +0530 
Potuganti Ramu <ramup@aztec.soft.net>
"with grant option" for user groups.
> Following statement says that "with grant option" is not allowed to a user
> group. I would like to know what the reasons behind not implementing
> this kind of feature.

Consider the following sequence of steps:

in database 1:
user A grants privilege to group B with grant option
user C who is in group B grants privilege to user D

in database 2:
superuser removes user C from group B

--> user D still has the privilege, because superuser doesn't have access to  
database 1 from his session

If you can live with this problem, then you can remove the check from the 
source code and it should work.


Fri, 9 Jan 2004 15:41:19 +0100
Peter Eisentraut <peter_e@gmx.net>
Re: "with grant option" for user groups.