From a0b76dc662efde6e02921c2d16e06418483b7534 Mon Sep 17 00:00:00 2001 From: Tom Lane Date: Mon, 8 Sep 2008 00:47:41 +0000 Subject: Create a separate grantable privilege for TRUNCATE, rather than having it be always owner-only. The TRUNCATE privilege works identically to the DELETE privilege so far as interactions with the rest of the system go. Robert Haas --- doc/src/sgml/ddl.sgml | 4 ++-- doc/src/sgml/func.sgml | 4 ++-- doc/src/sgml/information_schema.sgml | 14 +++++++------- doc/src/sgml/ref/grant.sgml | 26 +++++++++++++++++++------- doc/src/sgml/ref/lock.sgml | 5 +++-- doc/src/sgml/ref/revoke.sgml | 4 ++-- doc/src/sgml/ref/truncate.sgml | 5 +++-- doc/src/sgml/user-manag.sgml | 4 ++-- 8 files changed, 40 insertions(+), 26 deletions(-) (limited to 'doc/src') diff --git a/doc/src/sgml/ddl.sgml b/doc/src/sgml/ddl.sgml index 183d1e89f5f..94341df0f4b 100644 --- a/doc/src/sgml/ddl.sgml +++ b/doc/src/sgml/ddl.sgml @@ -1,4 +1,4 @@ - + Data Definition @@ -1356,7 +1356,7 @@ ALTER TABLE products RENAME TO items; There are several different privileges: SELECT, INSERT, UPDATE, DELETE, - REFERENCES, TRIGGER, + TRUNCATE, REFERENCES, TRIGGER, CREATE, CONNECT, TEMPORARY, EXECUTE, and USAGE. The privileges applicable to a particular diff --git a/doc/src/sgml/func.sgml b/doc/src/sgml/func.sgml index c03863af99a..cb4e6f991b1 100644 --- a/doc/src/sgml/func.sgml +++ b/doc/src/sgml/func.sgml @@ -1,4 +1,4 @@ - + Functions and Operators @@ -11369,7 +11369,7 @@ SELECT has_function_privilege('joeuser', 'myfunc(int, text)', 'execute'); The desired access privilege type is specified by a text string, which must evaluate to one of the values SELECT, INSERT, - UPDATE, DELETE, + UPDATE, DELETE, TRUNCATE, REFERENCES, or TRIGGER. (Case of the string is not significant, however.) An example is: diff --git a/doc/src/sgml/information_schema.sgml b/doc/src/sgml/information_schema.sgml index d4d51a34a03..7289e0bd456 100644 --- a/doc/src/sgml/information_schema.sgml +++ b/doc/src/sgml/information_schema.sgml @@ -1,4 +1,4 @@ - + The Information Schema @@ -2820,9 +2820,9 @@ ORDER BY c.ordinal_position; character_data Type of the privilege: SELECT, - DELETE, INSERT, - UPDATE, REFERENCES, - or TRIGGER + INSERT, UPDATE, + DELETE, TRUNCATE, + REFERENCES, or TRIGGER @@ -4406,9 +4406,9 @@ ORDER BY c.ordinal_position; character_data Type of the privilege: SELECT, - DELETE, INSERT, - UPDATE, REFERENCES, - or TRIGGER + INSERT, UPDATE, + DELETE, TRUNCATE, + REFERENCES, or TRIGGER diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml index c80a33c5074..295a7646575 100644 --- a/doc/src/sgml/ref/grant.sgml +++ b/doc/src/sgml/ref/grant.sgml @@ -1,5 +1,5 @@ @@ -20,7 +20,7 @@ PostgreSQL documentation -GRANT { { SELECT | INSERT | UPDATE | DELETE | REFERENCES | TRIGGER } +GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } [,...] | ALL [ PRIVILEGES ] } ON [ TABLE ] tablename [, ...] TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ] @@ -192,6 +192,16 @@ GRANT role [, ...] TO + + TRUNCATE + + + Allows on + the specified table. + + + + REFERENCES @@ -421,8 +431,8 @@ GRANT role [, ...] TO role [, ...] TO role [, ...] TO GRANT or REVOKE on an object will instantiate the default privileges (producing, for example, - {miriam=arwdxt/miriam}) and then modify them per the + {miriam=arwdDxt/miriam}) and then modify them per the specified request. @@ -524,7 +535,8 @@ GRANT admins TO joe; PostgreSQL allows an object owner to revoke his own ordinary privileges: for example, a table owner can make the table - read-only to himself by revoking his own INSERT, UPDATE, and DELETE + read-only to himself by revoking his own INSERT, + UPDATE, DELETE, and TRUNCATE privileges. This is not possible according to the SQL standard. The reason is that PostgreSQL treats the owner's privileges as having been granted by the owner to himself; therefore he diff --git a/doc/src/sgml/ref/lock.sgml b/doc/src/sgml/ref/lock.sgml index 0c2cb8fe2e4..d32e6d364c8 100644 --- a/doc/src/sgml/ref/lock.sgml +++ b/doc/src/sgml/ref/lock.sgml @@ -1,5 +1,5 @@ @@ -155,7 +155,8 @@ where lockmode is one of: LOCK TABLE ... IN ACCESS SHARE MODE requires SELECT privileges on the target table. All other forms of LOCK - require UPDATE and/or DELETE privileges. + require at least one of UPDATE, DELETE, or + TRUNCATE privileges. diff --git a/doc/src/sgml/ref/revoke.sgml b/doc/src/sgml/ref/revoke.sgml index 190300d5339..86cee9d760c 100644 --- a/doc/src/sgml/ref/revoke.sgml +++ b/doc/src/sgml/ref/revoke.sgml @@ -1,5 +1,5 @@ @@ -21,7 +21,7 @@ PostgreSQL documentation REVOKE [ GRANT OPTION FOR ] - { { SELECT | INSERT | UPDATE | DELETE | REFERENCES | TRIGGER } + { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER } [,...] | ALL [ PRIVILEGES ] } ON [ TABLE ] tablename [, ...] FROM { [ GROUP ] rolename | PUBLIC } [, ...] diff --git a/doc/src/sgml/ref/truncate.sgml b/doc/src/sgml/ref/truncate.sgml index 152b6640d8f..f4ef810ce31 100644 --- a/doc/src/sgml/ref/truncate.sgml +++ b/doc/src/sgml/ref/truncate.sgml @@ -1,5 +1,5 @@ @@ -97,7 +97,8 @@ TRUNCATE [ TABLE ] name [, ... ] Notes - Only the owner of a table can TRUNCATE it. + You must have the TRUNCATE privilege on a table + to truncate it. diff --git a/doc/src/sgml/user-manag.sgml b/doc/src/sgml/user-manag.sgml index 871aef702c7..d4d9fcc5150 100644 --- a/doc/src/sgml/user-manag.sgml +++ b/doc/src/sgml/user-manag.sgml @@ -1,4 +1,4 @@ - + Database Roles and Privileges @@ -293,7 +293,7 @@ ALTER ROLE myname SET enable_indexscan TO off; granted. There are several different kinds of privilege: SELECT, INSERT, UPDATE, DELETE, - REFERENCES, TRIGGER, + TRUNCATE, REFERENCES, TRIGGER, CREATE, CONNECT, TEMPORARY, EXECUTE, and USAGE. For more information on the different types of privileges supported by -- cgit v1.2.3