Skip to content

adding GRANT/REVOKE ... (COLUMN) ON TABLE TO ROLE #7287

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
c2main opened this issue Oct 30, 2023 · 5 comments · Fixed by #7918
Closed

adding GRANT/REVOKE ... (COLUMN) ON TABLE TO ROLE #7287

c2main opened this issue Oct 30, 2023 · 5 comments · Fixed by #7918

Comments

@c2main
Copy link
Contributor

c2main commented Oct 30, 2023

I am looking into adding support to this privilege in citus.

Before stepping in, is it something which has already been evaluated ?

Specifically I wonder about possible implication with citus planner/rewriter/executor: is there a risk that citus rewrite or execute a query in a way that the privilege on a column is not respected ?

Else is it as easy as "just allow this syntax now" ?
@JelteF
Copy link
Contributor

JelteF commented Oct 30, 2023 •
edited
Loading

Honestly, as far as I know this should already be supported. Could you share an example of a set of commands that is not working as expected for you. Most likely it's an oversight and fixing it should hopefully be rather straight forward.

@JelteF
Copy link
Contributor

JelteF commented Oct 30, 2023 •
edited
Loading

@gurkanindibay recently created a PR to update the documentation for DDL propagation like this. That might help if you want to take a stab at fixing the issue: #7267

@c2main
Copy link
Contributor Author

c2main commented Oct 30, 2023

mmh, the title was wrong, I've updated.
I believe it is not supported:

citus/src/test/regress/expected/multi_multiuser_master_protocol.out

Line 304 in ee8f4bb

ERROR: grant/revoke on column list is currently unsupported

@c2main c2main changed the title adding GRANT/REVOKE ... ON TABLE(COLUMN) TO ROLE adding GRANT/REVOKE ... (COLUMN) ON TABLE TO ROLE Oct 30, 2023
@JelteF JelteF mentioned this issue Oct 30, 2023
Open
57 tasks
@JelteF
Copy link
Contributor

JelteF commented Oct 30, 2023

Definitely an oversight then I think. In #4812, our DDL support tracking issue, we had the following marked as complete:

GRANT/REVOKE on database objects other than on tables and schemas (type, function, sequence, ...)

I added the item you're describing to the list, to at least have the tracking be correct. Help implementing support for that is definitely welcome

@c2main
Copy link
Contributor Author

c2main commented Oct 30, 2023

Definitely an oversight then I think. In #4812, our DDL support tracking issue, we had the following marked as complete:

GRANT/REVOKE on database objects other than on tables and schemas (type, function, sequence, ...)

I added the item you're describing to the list, to at least have the tracking be correct. Help implementing support for that is definitely welcome

Sure, we will work on it, but not in the next days.

@c2main c2main mentioned this issue Mar 10, 2025
Merged
naisila pushed a commit that referenced this issue Apr 4, 2025
@c2main
Propagates GRANT/REVOKE rights on table columns (#7918)
1dc60e3 
This commit adds support for GRANT/REVOKE on table columns.

It extends propagated DDL according to this logic:
https://github.com/citusdata/citus/tree/main/src/backend/distributed#ddl

* Unchanged pre-existing behavior related to splitting ddl per relation
during propagation.
* Changed the way ACL are checked in some cases (see
`EnsureTablePermissions()` and associated commits)
* Rewrite `pg_get_table_grants` to include column grants as well
* Add missing `pfree()` in `pg_get_table_grants()`

Fixes #7287
Also check a box in #4812
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Propagates GRANT/REVOKE rights on table columns c2main/citus
2 participants
@JelteF @c2main