The following bug has been logged online:
Bug reference: 1150
Logged by: Fabien Coelho
Email address: coelho@cri.ensmp.fr
PostgreSQL version: 7.5 Dev
Operating system: Linux
Description: grant options not properly checked
Details:
It seems that GRANT ALL ON SCHEMA does not properly
check for grantor rights. I haven't tested other
grantable stuff...
repeat:
psql> SELECT CURRENT_USER;
current_user
--------------
hobbes
psql> SELECT * FROM pg_namespace WHERE nspname='foo';
nspname | nspowner | nspacl
---------+----------+----------------------------------------
foo | 101 | {calvin=U*C*/calvin,hobbes=U*C/calvin}
As hobbes, I should only be able to grant usage.
However:
psql> GRANT ALL ON SCHEMA foo TO suzy;
psql> SELECT * FROM pg_namespace WHERE nspname='foo';
nspname | nspowner | nspacl
---------+----------+-------------------------------------------------------
foo | 101 | {calvin=U*C*/calvin,hobbes=U*C/calvin,suzy=UC/hobbes}
Suzy has both Usage and Create rights on schema foo,
although hobbes had only a grant option for usage.