I'm using 7.0 and have noticed that I need to grant SELECT and UPDATE
permissions on any referentially-related tables. Can/should I get
around this? A somewhat contrived example:
CREATE TABLE emp (
id integer PRIMARY KEY,
salary integer
);
CREATE TABLE proj (
id integer PRIMARY KEY,
emp_id integer REFERENCES emp
);
CREATE TABLE bill (
id integer PRIMARY KEY,
proj_id integer REFERENCES proj
);
INSERT INTO emp VALUES (1, 100000);
INSERT INTO proj VALUES (1, 1);
INSERT INTO bill VALUES (1, 1);
GRANT ALL ON proj TO someone;
Connect as someone:
=> INSERT INTO proj VALUES (2, 1);
ERROR: emp: Permission denied.
=> UPDATE proj SET id = 2;
ERROR: bill: Permission denied.
It appears that I need to grant:
SELECT,UPDATE on emp to UPDATE or INSERT into proj.
SELECT,UPDATE on bill to UPDATE proj.
When I grant these permissions, the above statements succeed.
If I don't want users to have UPDATE (or even SELECT) access on the
other tables (bill and emp), but I want referential integrity, what can
I do?
--
Rick Delaney
