Re: ACLs versus ALTER OWNER

On Wed, Jun 02, 2004 at 10:54:36PM +0800, Christopher Kings-Lynne wrote:
> >Well, the spec doesn't have create permissions per se, but they do have
> >a "usage" right on domains, and they specify that revoking that results
> >in dropping objects:
> >
> >         7) For every abandoned domain descriptor DO, let S1.DN be the
> >            <domain name> of DO. The following <drop domain statement> is
> >            effectively executed without further Access Rule checking:
> >
> >              DROP DOMAIN S1.DN CASCADE
> 
> Hmmm.  Seems pretty harsh.  But barring us implementing that (I don't 
> see it happening for 7.5), just had an idea :)
> 
> How about pg_dumpall dumps all users as superusers, and then changes 
> them back to what they're supposed to be at the bottom of the script :)

Huh, how about a GUC var, say "creating_user", which would make objects
created by the superuser as created by whoever is mentioned there?  The
dump connects only as superuser and changes creating_user as needed.

Not a pretty idea, but weren't you looking for kludges? :-)

-- 
Alvaro Herrera (<alvherre[a]dcc.uchile.cl>)
"La persona que no quería pecar / estaba obligada a sentarse
en duras y empinadas sillas    / desprovistas, por cierto
de blandos atenuantes"                          (Patricio Vogel)