Re: Safety/validity of resetting permissions by updating system tables

2021-01-05 Thread Stephen Frost
Greetings, * Tom Lane (t...@sss.pgh.pa.us) wrote: > Andrew Dunstan writes: > > I think there is probably a good case for some sort of "from scratch" > > option on GRANT. > > Maybe my head's not screwed on straight this morning, but it seems > to me that any such action would typically be revokin

Re: Safety/validity of resetting permissions by updating system tables

2021-01-05 Thread Tom Lane
Andrew Dunstan writes: > I think there is probably a good case for some sort of "from scratch" > option on GRANT. Maybe my head's not screwed on straight this morning, but it seems to me that any such action would typically be revoking permissions not adding them, so that it'd be more naturally f

Re: Safety/validity of resetting permissions by updating system tables

2021-01-05 Thread Andrew Dunstan
On 1/4/21 11:15 AM, Isaac Morland wrote: > On Mon, 4 Jan 2021 at 10:12, Andrew Dunstan > wrote: > > > On 1/1/21 11:44 AM, Tom Lane wrote: > > Isaac Morland > writes: > >> Is it safe and valid to reset to default permiss

Re: Safety/validity of resetting permissions by updating system tables

2021-01-04 Thread Isaac Morland
On Mon, 4 Jan 2021 at 10:12, Andrew Dunstan wrote: > > On 1/1/21 11:44 AM, Tom Lane wrote: > > Isaac Morland writes: > >> Is it safe and valid to reset to default permissions by doing > >> UPDATE pg_namespace/pg_class/pg_type/pg_proc > >> SET nspacl/relacl/typacl/proacl = NULL WHERE ... to accom

Re: Safety/validity of resetting permissions by updating system tables

2021-01-04 Thread Andrew Dunstan
On 1/1/21 11:44 AM, Tom Lane wrote: > Isaac Morland writes: >> Is it safe and valid to reset to default permissions by doing >> UPDATE pg_namespace/pg_class/pg_type/pg_proc >> SET nspacl/relacl/typacl/proacl = NULL WHERE ... to accomplish this? > Not terribly; the main objection is you'd fail to

Re: Safety/validity of resetting permissions by updating system tables

2021-01-03 Thread Isaac Morland
On Sun, 3 Jan 2021 at 05:57, Simon Riggs wrote: > Exactly what's wrong with "REVOKE ALL ON ALL TABLES IN SCHEMA test" at > the top of your script? You say there is a problem, but don't describe > the precise problem. Can you give a fully worked example so we can > understand how to resolve? > T

Re: Safety/validity of resetting permissions by updating system tables

2021-01-03 Thread Simon Riggs
On Fri, Jan 1, 2021 at 7:35 PM Isaac Morland wrote: > The use case is to ensure that after doing my GRANTs the permissions are in a > known state, no matter what they were before. Typically, one would follow a > reset command with some GRANTs. So maybe my permissions script contains: > > GRANT

Re: Safety/validity of resetting permissions by updating system tables

2021-01-01 Thread Isaac Morland
On Fri, 1 Jan 2021 at 11:44, Tom Lane wrote: > Isaac Morland writes: > > Is it safe and valid to reset to default permissions by doing > > UPDATE pg_namespace/pg_class/pg_type/pg_proc > > SET nspacl/relacl/typacl/proacl = NULL WHERE ... to accomplish this? > > Not terribly; the main objection is

Re: Safety/validity of resetting permissions by updating system tables

2021-01-01 Thread Tom Lane
Isaac Morland writes: > Is it safe and valid to reset to default permissions by doing > UPDATE pg_namespace/pg_class/pg_type/pg_proc > SET nspacl/relacl/typacl/proacl = NULL WHERE ... to accomplish this? Not terribly; the main objection is you'd fail to update pg_shdepend. > And what do people t