Menu

#472 Permission issues with view updation

Development Queue
open
nobody
5
2014-06-27
2014-01-27
Abbas Butt
No

Consider this test case taken from updatable_views.sql

CREATE USER view_user1;
CREATE USER view_user2;

SET SESSION AUTHORIZATION view_user1;
CREATE TABLE base_tbl(a int, b text, c float) distribute by replication;
INSERT INTO base_tbl VALUES (1, 'Row 1', 1.0);
CREATE VIEW rw_view1 AS SELECT b AS bb, c AS cc, a AS aa FROM base_tbl;

GRANT SELECT ON base_tbl TO view_user2;
GRANT SELECT ON rw_view1 TO view_user2;
GRANT UPDATE (a,c) ON base_tbl TO view_user2;
GRANT UPDATE (bb,cc) ON rw_view1 TO view_user2;
RESET SESSION AUTHORIZATION;

SET SESSION AUTHORIZATION view_user2;
UPDATE rw_view1 SET bb=bb, cc=cc;

explain verbose UPDATE rw_view1 SET bb=bb, cc=cc;

                                        QUERY PLAN

Update on public.base_tbl (cost=0.00..0.00 rows=1000 width=50)
Primary node/s: data_node_1
Node/s: data_node_2, data_node_3, data_node_4
Remote query: UPDATE ONLY public.base_tbl SET a = $1, b = $2, c = $3 WHERE (base_tbl.ctid = $4)
-> Data Node Scan on base_tbl "REMOTE_TABLE_QUERY" (cost=0.00..0.00 rows=1000 width=50)
Output: base_tbl.a, base_tbl.b, base_tbl.c, base_tbl.ctid
Node/s: data_node_1
Remote query: SELECT a, b, c, ctid FROM ONLY public.base_tbl WHERE true
(8 rows)

This case fails because of the following reason:
Views are created only on coordinators and hence we will update the underlying table in XC as shown by the plan.
Note that the test involves a user view_user2. This user has the right to select from base_tbl and update a & c column of base_tbl
Whereas the update query that is being tried updates column b too, and hence the query fails on XC giving the following error
ERROR: permission denied for relation base_tbl
The same query works fine in PG because of the following rules described in documentation
at http://www.postgresql.org/docs/9.3/static/sql-createview.html
"The user performing the insert, update or delete on the view must have the corresponding insert, update or delete privilege on the view. In addition the view's owner must have the relevant privileges on the underlying base relations, but the user performing the update does not need any permissions on the underlying base relations"

Discussion


Log in to post a comment.

Want the latest updates on software, tech news, and AI?
Get latest updates about software, tech news, and AI from SourceForge directly in your inbox once a month.