BUG #4537: role

Started by Marco Peixotoover 17 years ago2 messagesbugs
Jump to latest
#1Marco Peixoto
mpeixoto@metrosp.com.br

The following bug has been logged online:

Bug reference: 4537
Logged by: Marco Peixoto
Email address: mpeixoto@metrosp.com.br
PostgreSQL version: 8.2.11
Operating system: debian 4.1
Description: role
Details:

CREATE SCHEMA agd
AUTHORIZATION postgres;
GRANT ALL ON SCHEMA agd TO postgres;
GRANT USAGE ON SCHEMA agd TO agd_select; (group)

CREATE ROLE r227602 LOGIN
ENCRYPTED PASSWORD 'md5a4d27e81e0dc6b9828cf2dc84565fb59'
NOSUPERUSER NOINHERIT NOCREATEDB NOCREATEROLE;
GRANT agd_select TO r227602;

CREATE TABLE agd.clanalis
(
nr_analista numeric(10) NOT NULL DEFAULT
nextval('agd.clanalis_nr_analista_seq'::regclass), -- Analista
funcionario integer NOT NULL, -- Funcionário
CONSTRAINT pk_clanalis PRIMARY KEY (nr_analista),
CONSTRAINT fk_clanalis_funcionario FOREIGN KEY (funcionario)
REFERENCES ahb.funcionario (funcionario) MATCH SIMPLE
ON UPDATE NO ACTION ON DELETE NO ACTION
)
WITH (OIDS=FALSE);
ALTER TABLE agd.clanalis OWNER TO postgres;
GRANT ALL ON TABLE agd.clanalis TO postgres;
GRANT SELECT ON TABLE agd.clanalis TO agd_select;

[postgres@sd5metro1 dados]$ psql -p 5433 tscorp01 -U r227602 -W
Password for user r227602:
Welcome to psql 8.2.11, the PostgreSQL interactive terminal.

Type: \copyright for distribution terms
\h for help with SQL commands
\? for help with psql commands
\g or terminate with semicolon to execute query
\q to quit

tscorp01=> select * from agd.claloclg;
ERROR: permission denied for relation clanalis

#2Tom Lane
tgl@sss.pgh.pa.us
In reply to: Marco Peixoto (#1)
Re: BUG #4537: role

"Marco Peixoto" <mpeixoto@metrosp.com.br> writes:

CREATE ROLE r227602 LOGIN
ENCRYPTED PASSWORD 'md5a4d27e81e0dc6b9828cf2dc84565fb59'
NOSUPERUSER NOINHERIT NOCREATEDB NOCREATEROLE;

GRANT agd_select TO r227602;

You've got the role set to NOINHERIT. This means that it can *become*
agd_select (via SET ROLE) and then use agd_select's privileges, but it
doesn't have use of those privileges without doing SET ROLE.

BTW, when I try this example I get a complaint about schema agd,
not relation clanalis --- so there must be a few more grants you
didn't show us in your system. I'd still guess the NOINHERIT is
the root of your problem though.

regards, tom lane