Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit 620ac28

Browse files
committed
docs: Fix up some out-of-date references to INHERIT/NOINHERIT.
Commit e3ce2de should have updated these sections of the documentation, but failed to do so. Patch by me, reviewed by Nathan Bossart. Discussion: http://postgr.es/m/CA+TgmoaKMnde2W_=u7CqeCKi=FKnfbNQPwOR=c_3c8qD7b2nhQ@mail.gmail.com
1 parent df0f4fe commit 620ac28

File tree

2 files changed

+26
-21
lines changed

2 files changed

+26
-21
lines changed

doc/src/sgml/ref/set_role.sgml

+10-9
Original file line numberDiff line numberDiff line change
@@ -71,15 +71,16 @@ RESET ROLE
7171

7272
<para>
7373
Using this command, it is possible to either add privileges or restrict
74-
one's privileges. If the session user role has the <literal>INHERIT</literal>
75-
attribute, then it automatically has all the privileges of every role that
76-
it could <command>SET ROLE</command> to; in this case <command>SET ROLE</command>
77-
effectively drops all the privileges assigned directly to the session user
78-
and to the other roles it is a member of, leaving only the privileges
79-
available to the named role. On the other hand, if the session user role
80-
has the <literal>NOINHERIT</literal> attribute, <command>SET ROLE</command> drops the
81-
privileges assigned directly to the session user and instead acquires the
82-
privileges available to the named role.
74+
one's privileges. If the session user role has been granted memberships
75+
<literal>WITH INHERIT TRUE</literal>, it automatically has all the
76+
privileges of every such role. In this case, <command>SET ROLE</command>
77+
effectively drops all the privileges except for those which the target role
78+
directly possesses or inherits. On the other hand, if the session user role
79+
has been granted memberships <literal>WITH INHERIT FALSE</literal>, the
80+
privileges of the granted roles can't be accessed by default. However, the
81+
session user can use <command>SET ROLE</command> to drop the privileges
82+
assigned directly to the session user and instead acquire the privileges
83+
available to the named role.
8384
</para>
8485

8586
<para>

doc/src/sgml/user-manag.sgml

+16-12
Original file line numberDiff line numberDiff line change
@@ -241,9 +241,12 @@ CREATE USER <replaceable>name</replaceable>;
241241
<term>inheritance of privileges<indexterm><primary>role</primary><secondary>privilege to inherit</secondary></indexterm></term>
242242
<listitem>
243243
<para>
244-
A role is given permission to inherit the privileges of roles it is a
245-
member of, by default. However, to create a role without the permission,
246-
use <literal>CREATE ROLE <replaceable>name</replaceable> NOINHERIT</literal>.
244+
A role inherits the privileges of roles it is a member of, by default.
245+
However, to create a role which does not inherit privileges by
246+
default, use <literal>CREATE ROLE <replaceable>name</replaceable>
247+
NOINHERIT</literal>. Alternatively, inheritance can be overriden
248+
for individual grants by using <literal>WITH INHERIT TRUE</literal>
249+
or <literal>WITH INHERIT FALSE</literal>.
247250
</para>
248251
</listitem>
249252
</varlistentry>
@@ -357,25 +360,26 @@ REVOKE <replaceable>group_role</replaceable> FROM <replaceable>role1</replaceabl
357360
database session has access to the privileges of the group role rather
358361
than the original login role, and any database objects created are
359362
considered owned by the group role not the login role. Second, member
360-
roles that have the <literal>INHERIT</literal> attribute automatically have use
361-
of the privileges of roles of which they are members, including any
363+
roles that have the been granted membership with the
364+
<literal>INHERIT</literal> option automatically have use
365+
of the privileges of those roles, including any
362366
privileges inherited by those roles.
363367
As an example, suppose we have done:
364368
<programlisting>
365-
CREATE ROLE joe LOGIN INHERIT;
366-
CREATE ROLE admin NOINHERIT;
367-
CREATE ROLE wheel NOINHERIT;
368-
GRANT admin TO joe;
369-
GRANT wheel TO admin;
369+
CREATE ROLE joe LOGIN;
370+
CREATE ROLE admin;
371+
CREATE ROLE wheel;
372+
GRANT admin TO joe WITH INHERIT TRUE;
373+
GRANT wheel TO admin WITH INHERIT FALSE;
370374
</programlisting>
371375
Immediately after connecting as role <literal>joe</literal>, a database
372376
session will have use of privileges granted directly to <literal>joe</literal>
373377
plus any privileges granted to <literal>admin</literal>, because <literal>joe</literal>
374378
<quote>inherits</quote> <literal>admin</literal>'s privileges. However, privileges
375379
granted to <literal>wheel</literal> are not available, because even though
376380
<literal>joe</literal> is indirectly a member of <literal>wheel</literal>, the
377-
membership is via <literal>admin</literal> which has the <literal>NOINHERIT</literal>
378-
attribute. After:
381+
membership is via <literal>admin</literal> which was granted using
382+
<literal>WITH INHERIT FALSE</literal>. After:
379383
<programlisting>
380384
SET ROLE admin;
381385
</programlisting>

0 commit comments

Comments
 (0)