Re: Modifying pg_shadow?

Jason Hihn wrote:
> Correct me if I'm wrong:
> I can create payroll.accountname.* (d.s.t), but the login security can only
> auth to database level. Meaning my schema security must fall upon
> grant/revoke.

Right. The default for a schema is that only the owner can
use it. That might be already what you want.

> I could then create payroll.tax (d.s), and set the search_path=account,tax
> and share the same tax tables between all accounts.

I'm not sure if I understand what you mean.

By default, only the owner of the tax schema will be able
to see the tables inside. To grant everyone access who can
connect to the payroll database, you would do something
like GRANT USAGE ON SCHEMA tax TO PUBLIC. See the docs
on the GRANT command for details.

> Any database table (database.table) is in the public schema,

Actually database.public.table. There's nothing magic about
the "public" schema. It's just the default. You can even
drop it and work entirely with your own schemas.

> with pg_*
> ALWAYS avaible regardless of search_path. (so I could also do
> payroll.taxtable{1,2,3} and still share but with search_path=account,public

The pg_* system tables are contained in a system schema
called pg_catalog. It's explained in the docs.

The docs really aren't that bad. You just have to read
them. Repeatedly, if necessary. ;-)

> How is the pg_dump done when only done for a schema?
> "pg_dump d.s"?

No, you have to name the tables of that schema, using the
-t option.

> Looks like I have to u/g from 7.2 to 7.3 sooner than I thought. Any word on
> 7.4? (Yeah, I know, "when its ready" but how ready does it look?)

I leave that answer to the experts. :-)

Regards
Oliver

--
Oliver Fromme, secnetix GmbH & Co KG, Oettingenstr. 2, 80538 München
Any opinions expressed in this message may be personal to the author
and may not necessarily reflect the opinions of secnetix in any way.

"When your hammer is C++, everything begins to look like a thumb."
-- Steve Haflich, in comp.lang.c++