PostgreSQL權限（二）

一.角色權限繼承

       在create role時經過指定in role和inherit能夠繼承權限，這是沒問題的，可是系統權限（見postgresql權限（一））是沒法繼承的，只能經過alter命令進行修改。
lihao=# create role role1 superuser createdb createrole login password '123456';
CREATE ROLE
lihao=# grant select on table t1 to role1;
GRANT
lihao=# create user user1 in role role1 inherit;
CREATE ROLE
lihao=> \du+
                                    List of roles
 Role name |                   Attributes                   | Member of | Description
-----------+------------------------------------------------+-----------+-------------
 lihao     | Superuser, Create role, Create DB, Replication | {}        |
 role1     | Superuser, Create role, Create DB, Replication | {}        |
 user1     |                                                                           | {role1}   |
lihao=# \c lihao user1
You are now connected to database "lihao" as user "user1".
lihao=> create database db1;
ERROR:  permission denied to create database
lihao=> create role role1;
ERROR:  permission denied to create role
lihao=> select * from t1;
 id
----
(0 rows)

lihao=> \c lihao role1
You are now connected to database "lihao" as user "role1".

lihao=# alter user user1 createdb;
ALTER ROLE
lihao=# \c lihao user1
You are now connected to database "lihao" as user "user1".
lihao=> create database test;
CREATE DATABASE

二.角色默認權限修改

      這裏使用的是ALTER DEFAUT PRIVILEGES命令。能夠用這條命令來修改修改的是「未來」你或你所在角色組要建立對象的權限，對已有對象的權限不會有影響。這種修改在當前庫或指定模式下是全局性的，目前只能修改表（包括外部表），序列，函數，類型（包括域）。

//驗證組成員能夠修改所在角色組的default權限
lihao=# create database db1 owner "lihao";
CREATE DATABASE
lihao=# \c db1 lihao
You are now connected to database "db1" as user "lihao".
db1=# create role role1 login password 'oracle';
CREATE ROLE
//使用NOINHERIT建立用戶，不然user1默認繼承role1的select權限
db1=# create user user1 in role role1 noinherit password 'oracle';
CREATE ROLE
db1=# create user user2 in role role1;
CREATE ROLE
db1=# \c db1 role1
You are now connected to database "db1" as user "role1".
db1=> create table t1 (id int);
CREATE TABLE
db1=> \c db1 user1
You are now connected to database "db1" as user "user1".
db1=> select * from t1;
ERROR:  permission denied for relation t1
db1=> alter default privileges for role role1 in schema public grant select on tables to user1;
ALTER DEFAULT PRIVILEGES
db1=> \c db1 role1
You are now connected to database "db1" as user "role1".
db1=> create table t2 (id int);
CREATE TABLE
db1=> \c db1 user1
You are now connected to database "db1" as user "user1".
db1=> select * from t2;
 id
----
(0 rows)
db1=> select * from t1;
ERROR:  permission denied for relation t1

db1=> alter default privileges for user user2  in schema public grant select on tables to user1;
ERROR:  must be member of role "user2

//證實這條修改只能在當前庫下生效
db1=> \c lihao role1
You are now connected to database "lihao" as user "role1".
lihao=> create table t3 (id int);
CREATE TABLE
lihao=> \c lihao user1
You are now connected to database "lihao" as user "user1".
lihao=> select * from t3;
ERROR:  permission denied for relation t3

注意：

       經過讀文檔你們能夠看到alter default privileges***revoke**操做，而後在實驗這條命令，好比此時有多個角色成員，卻只想要回收掉角色成員user1在角色role1」未來要「建立對象上的select權限，會發現命令提示成功，卻沒有生效，這是由於以前所說的，revoke操做只能回收grant賦予的權限，對於角色成員所繼承的角色權限不能在角色成員上revoke掉，只能經過對角色進行revoke。