Doc: fix missing explanation of default object privileges.

tglsfdc · tglsfdc · commit bc639d488515 · 2017-10-11T16:57:03.000-04:00
The GRANT reference page, which lists the default privileges for new objects, failed to mention that USAGE is granted by default for data types and domains. As a lesser sin, it also did not specify anything about the initial privileges for sequences, FDWs, foreign servers, or large objects. Fix that, and add a comment to acldefault() in the probably vain hope of getting people to maintain this list in future. Noted by Laurenz Albe, though I editorialized on the wording a bit. Back-patch to all supported branches, since they all have this behavior. Discussion: https://postgr.es/m/1507620895.4152.1.camel@cybertec.at
diff --git a/doc/src/sgml/ref/grant.sgml b/doc/src/sgml/ref/grant.sgml
@@ -149,12 +149,22 @@ GRANT <replaceable class="PARAMETER">role_name</replaceable> [, ...] TO <replace
   <para>
    PostgreSQL grants default privileges on some types of objects to
    <literal>PUBLIC</literal>.  No privileges are granted to
-   <literal>PUBLIC</literal> by default on tables,
-   columns, schemas or tablespaces. For other types, the default privileges
+   <literal>PUBLIC</literal> by default on
+   tables,
+   table columns,
+   sequences,
+   foreign data wrappers,
+   foreign servers,
+   large objects,
+   schemas,
+   or tablespaces.
+   For other types of objects, the default privileges
    granted to <literal>PUBLIC</literal> are as follows:
-   <literal>CONNECT</literal> and <literal>CREATE TEMP TABLE</literal> for
-   databases; <literal>EXECUTE</literal> privilege for functions; and
-   <literal>USAGE</literal> privilege for languages.
+   <literal>CONNECT</literal> and <literal>TEMPORARY</literal> (create
+   temporary tables) privileges for databases;
+   <literal>EXECUTE</literal> privilege for functions; and
+   <literal>USAGE</literal> privilege for languages and data types
+   (including domains).
    The object owner can, of course, <command>REVOKE</command>
    both default and  expressly granted privileges. (For maximum
    security, issue the <command>REVOKE</> in the same transaction that
diff --git a/src/backend/utils/adt/acl.c b/src/backend/utils/adt/acl.c
@@ -720,7 +720,9 @@ hash_aclitem(PG_FUNCTION_ARGS)
  * acldefault()  --- create an ACL describing default access permissions
  *
  * Change this routine if you want to alter the default access policy for
- * newly-created objects (or any object with a NULL acl entry).
+ * newly-created objects (or any object with a NULL acl entry).  When
+ * you make a change here, don't forget to update the GRANT man page,
+ * which explains all the default permissions.
  *
  * Note that these are the hard-wired "defaults" that are used in the
  * absence of any pg_default_acl entry.

Original file line number	Diff line number	Diff line change
`@@ -720,7 +720,9 @@ hash_aclitem(PG_FUNCTION_ARGS)`
`720`	`720`	`* acldefault() --- create an ACL describing default access permissions`
`721`	`721`	`*`
`722`	`722`	`* Change this routine if you want to alter the default access policy for`
`723`		`- * newly-created objects (or any object with a NULL acl entry).`
	`723`	`+ * newly-created objects (or any object with a NULL acl entry). When`
	`724`	`+ * you make a change here, don't forget to update the GRANT man page,`
	`725`	`+ * which explains all the default permissions.`
`724`	`726`	`*`
`725`	`727`	`* Note that these are the hard-wired "defaults" that are used in the`
`726`	`728`	`* absence of any pg_default_acl entry.`