how to grant update or select on some specified row in postgresql table?

Question

I want to create some roles in my Postgresql DB and grant some access.

I have student role and i want to grant this user type : can edit only record a bout him/her in student table and can not edit other rows

how can i do it?

thanks

Answer 1

Create a view on the table with an appropriate where clause, then grant access to that:

create view students_view as
select col1, col2, col3 -- limit column access here
from mytable
where <whatever>; -- limit row access here

-- limit what he can do here
grant update, select to student_role;

BTW It is a commonly held misconception that you can't update a view, but that is only true if the view is a join or similarly complicated query.

Answer 2

PostgreSQL doesn't have row-level declarative security (yet, there's ongoing work into it) so if you can't just create a view - say, if you have many different people who need this access - you will probably need a SECURITY DEFINER helper function or trigger.

You've got a couple of options:

• Write a SECURITY DEFINER function that lets them make only the permitted changes and limit their access to the table to SELECT, revoking UPDATE, DELETE, TRUNCATE and INSERT rights; or
• write a trigger that tries to restrict them from making changes you don't want them to make and GRANT them write access to the table.

Of the two, the function and restricted rights approach is by far the safest option so long as you follow the SECURITY DEFINER secure coding guidelines set above - setting search_path for the function, avoiding dynamic SQL (EXECUTE) with string substitutions, etc.

The view approach given above can work quite nicely if it's a view that filters by current_user. You may also want to look at the new SECURITY BARRIER views; see this post for a useful discussion of them.