[HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Tomonari Katsumata
Hi, Could anyone tell me how to create read-only view on PostgreSQL 9.3 ? I've been testing updatable views and noticed that all simple views are updatable. When I use pg_dump for upgrading from PostgreSQL 9.2 to PostgreSQL 9.3 and if the databse has views, all views are updatable on the

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Szymon Guz
On 13 August 2013 11:43, Tomonari Katsumata katsumata.tomon...@po.ntts.co.jp wrote: Hi, Could anyone tell me how to create read-only view on PostgreSQL 9.3 ? I've been testing updatable views and noticed that all simple views are updatable. When I use pg_dump for upgrading from

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Tomonari Katsumata
Hi Szymon, Thank you for response. Could you show an example? I do below things on one server. The path to database cluster and port are different with each other. [9.2.4] initdb --no-locale -E UTF8 pg_ctl start createdb testdb psql testdb -c create table tbl(i int) psql testdb -c insert

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Merlin Moncure
On Tue, Aug 13, 2013 at 5:37 AM, Tomonari Katsumata katsumata.tomon...@po.ntts.co.jp wrote: Hi Szymon, Thank you for response. Could you show an example? I do below things on one server. The path to database cluster and port are different with each other. [9.2.4] initdb --no-locale -E

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Hannu Krosing
On 08/13/2013 03:25 PM, Merlin Moncure wrote: On Tue, Aug 13, 2013 at 5:37 AM, Tomonari Katsumata katsumata.tomon...@po.ntts.co.jp wrote: Hi Szymon, Thank you for response. Could you show an example? I do below things on one server. The path to database cluster and port are different

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Merlin Moncure
On Tue, Aug 13, 2013 at 10:12 AM, Hannu Krosing ha...@2ndquadrant.com wrote: On 08/13/2013 03:25 PM, Merlin Moncure wrote: I chatted about this on IRC for a bit. Apparently, updatability of views is a mandatory feature in the sql standard and by relying on the read-only-ness you were relying

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Andrew Dunstan
On 08/13/2013 12:09 PM, Merlin Moncure wrote: On Tue, Aug 13, 2013 at 10:12 AM, Hannu Krosing ha...@2ndquadrant.com wrote: On 08/13/2013 03:25 PM, Merlin Moncure wrote: I chatted about this on IRC for a bit. Apparently, updatability of views is a mandatory feature in the sql standard and by

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Josh Berkus
All, In any case, using permissions is a somewhat leaky bandaid, since superusers have overriding access privileges anyway. A better way to do what the OP wants might be to have a view trigger that raises an exception. I think it would be better to supply a script which revoked write

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Hannu Krosing
On 08/13/2013 06:23 PM, Andrew Dunstan wrote: On 08/13/2013 12:09 PM, Merlin Moncure wrote: On Tue, Aug 13, 2013 at 10:12 AM, Hannu Krosing ha...@2ndquadrant.com wrote: On 08/13/2013 03:25 PM, Merlin Moncure wrote: I chatted about this on IRC for a bit. Apparently, updatability of views is

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Stephen Frost
* Hannu Krosing (ha...@2ndquadrant.com) wrote: If you earlier used views for granting limited read access to some views you definitely did not want view users suddenly gain also write access to underlying table. You also probably did not GRANT only SELECT to your views as this was the

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Tom Lane
Hannu Krosing ha...@2ndquadrant.com writes: If you earlier used views for granting limited read access to some views you definitely did not want view users suddenly gain also write access to underlying table. Unless you'd explicitly granted those users insert/update/delete privilege on the

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Andrew Dunstan
On 08/13/2013 01:33 PM, Hannu Krosing wrote: In any case, using permissions is a somewhat leaky bandaid, since superusers have overriding access privileges anyway. A better way to do what the OP wants might be to have a view trigger that raises an exception. Superuser can easily disable or

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Merlin Moncure
On Tue, Aug 13, 2013 at 1:18 PM, Tom Lane t...@sss.pgh.pa.us wrote: There's no security hole here; if someone can do something that they couldn't do before, it's because you explicitly granted them privileges to do so. This point is completely bogus. Very, very few applications I've run

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread David Fetter
On Tue, Aug 13, 2013 at 10:24:32AM -0700, Josh Berkus wrote: All, In any case, using permissions is a somewhat leaky bandaid, since superusers have overriding access privileges anyway. A better way to do what the OP wants might be to have a view trigger that raises an exception. I

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Josh Berkus
On 08/13/2013 11:18 AM, Tom Lane wrote: Hannu Krosing ha...@2ndquadrant.com writes: If you earlier used views for granting limited read access to some views you definitely did not want view users suddenly gain also write access to underlying table. Unless you'd explicitly granted those

Re: [HACKERS] How to create read-only view on 9.3

2013-08-13 Thread Tomonari Katsumata
Hi, (2013/08/14 5:24), Josh Berkus wrote: On 08/13/2013 11:18 AM, Tom Lane wrote: Hannu Krosing ha...@2ndquadrant.com writes: If you earlier used views for granting limited read access to some views you definitely did not want view users suddenly gain also write access to underlying