Re: type privileges and default privileges

On Sat, Nov 5, 2011 at 10:35 AM, Peter Eisentraut <peter_e@gmx.net> wrote:
> During the closing days of the 9.1 release, we had discussed that we
> should add privileges on types (and domains), so that owners can prevent
> others from using their types because that would prevent the owners from
> changing them in certain ways.  (Collations have similar issues and work
> quite similar to types, so we could include them in this consideration.)
>
> As I'm plotting to write code for this, I wonder about how to handle
> default privileges.  For compatibility and convenience, we would still
> want to have types with public privileges by default.  Should we
> continue to hardcode this, as we have done in the past with functions,
> for example, or should we use the new default privileges facility to
> register the public default privileges in the template database?

I think it would make sense to follow the model of default privileges,
but I'm a bit confused by the rest of this, because pg_default_acl is
normally empty - you only make an entry there when a schema has
different defaults than the, uh, default defaults.  So you shouldn't
need to "register" anything, I wouldn't think.

--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company