PostgreSQL stores permissions assigned to roles and objects as Access Control Lists (ACLs), and, when needed, it examines the ACLs for a specific role and a database object in order to understand whether the command or query can be performed. In this section, you will learn what ACLs are, how they are stored, and how to interpret them to understand what permissions an ACL provides.
An ACL is a representation of a group of permissions with the following structure:
grantee=flags/grantor
Here, we see the following:
- grantee is the role name of the role to which the permissions are applied.
- flags is the string representing the permissions.
- grantor is the user who granted the permissions.
Whenever the granted and grantee results in the same name, the role is the owner of the database object.
The flags that can be used in an ACL are those reported in the following table. As you can see, not all the flags apply to all the objects: for example it does not make sense to have...