Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SHOW DEFAULT PRIVILEGES/ALTER DEFAULT PRIVILEGES #11942

Merged
merged 2 commits into from
Nov 9, 2021

Conversation

ericharmeling
Copy link
Contributor

@ericharmeling ericharmeling commented Oct 12, 2021

Fixes #11420.
Fixes #11419.
Fixes #11442.
Fixes #11421.
Fixes #11449.
Fixes #11378.
Fixes #11397.
Fixes #11403.

@cockroach-teamcity
Copy link
Member

This change is Reviewable

@github-actions
Copy link

github-actions bot commented Oct 12, 2021

Files changed:

_includes/v21.2/sidebar-data-reference.json
_includes/v21.2/sql/generated/diagrams/alter_default_privileges.html
_includes/v21.2/sql/generated/diagrams/show_default_privileges.html
v21.2/alter-default-privileges.md
v21.2/authorization.md
v21.2/show-default-privileges.md
v21.2/sql-statements.md

@netlify
Copy link

netlify bot commented Oct 12, 2021

✔️ Netlify Preview

🔨 Explore the source changes: 853820c

🔍 Inspect the deploy log: https://app.netlify.com/sites/cockroachdb-docs/deploys/618a9e3c7e45750007a3704f

😎 Browse the preview: https://deploy-preview-11942--cockroachdb-docs.netlify.app

@ericharmeling

This comment has been minimized.

@ericharmeling
Copy link
Contributor Author

@RichardJCai This is good for engineering review.

After the diagram backport is merged and the generated diagrams are propagated to generated-diagrams, I'll update the PR to remote-include the diagrams (they will be identical to the local ones in this PR).

@ericharmeling
Copy link
Contributor Author

@RichardJCai ping on review

Copy link

@RichardJCai RichardJCai left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM nice!

@ericharmeling ericharmeling requested a review from a user November 1, 2021 19:17
@ericharmeling
Copy link
Contributor Author

@RichardJCai TFTR!


`cockroachlabs` created the `tracks` table after revoking default `SELECT` privileges from `max`. As a result, `max` never had `SELECT` privileges on `tracks`.

Note that, because `max` has no default privileges, the user can now be dropped:
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Note that, because `max` has no default privileges, the user can now be dropped:
Because `max` has no default privileges, the user can now be dropped:

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.


To change the default privileges on objects that a user creates, use the [`ALTER DEFAULT PRIVILEGES`](alter-default-privileges.html) statement.

Note that the creator of an object is also the object's [owner](authorization.html#object-ownership). Any roles that are members of the owner role have `ALL` privileges on the object, independent of the default privileges. Altering the default privileges of objects created by a role does not affect that role's privileges as the object's owner. The default privileges granted to other users/roles are always in addition to the ownership (i.e., `ALL`) privileges given to the creator of the object.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
Note that the creator of an object is also the object's [owner](authorization.html#object-ownership). Any roles that are members of the owner role have `ALL` privileges on the object, independent of the default privileges. Altering the default privileges of objects created by a role does not affect that role's privileges as the object's owner. The default privileges granted to other users/roles are always in addition to the ownership (i.e., `ALL`) privileges given to the creator of the object.
The creator of an object is also the object's [owner](authorization.html#object-ownership). Any roles that are members of the owner role have `ALL` privileges on the object, independent of the default privileges. Altering the default privileges of objects created by a role does not affect that role's privileges as the object's owner. The default privileges granted to other users/roles are always in addition to the ownership (i.e., `ALL`) privileges given to the creator of the object.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

Copy link

@ghost ghost left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See comment and suggestions.

Copy link
Contributor Author

@ericharmeling ericharmeling left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

TFTRs!


`cockroachlabs` created the `tracks` table after revoking default `SELECT` privileges from `max`. As a result, `max` never had `SELECT` privileges on `tracks`.

Note that, because `max` has no default privileges, the user can now be dropped:
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.


To change the default privileges on objects that a user creates, use the [`ALTER DEFAULT PRIVILEGES`](alter-default-privileges.html) statement.

Note that the creator of an object is also the object's [owner](authorization.html#object-ownership). Any roles that are members of the owner role have `ALL` privileges on the object, independent of the default privileges. Altering the default privileges of objects created by a role does not affect that role's privileges as the object's owner. The default privileges granted to other users/roles are always in addition to the ownership (i.e., `ALL`) privileges given to the creator of the object.
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

@ericharmeling ericharmeling merged commit 8329317 into master Nov 9, 2021
@ericharmeling ericharmeling deleted the show-alter-default-privileges branch November 9, 2021 17:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment