head	1.56;
access;
symbols
	REL9_0_0:1.56
	REL9_1_ALPHA1:1.56
	REL9_0_RC1:1.56
	REL9_0_BETA4:1.56
	REL9_0_STABLE:1.56.0.2
	REL9_0_BETA3:1.56
	REL9_0_BETA2:1.56
	REL7_4_29:1.28
	REL8_0_25:1.32
	REL8_1_21:1.35.2.1
	REL8_2_17:1.41
	REL8_3_11:1.46
	REL8_4_4:1.51
	REL9_0_BETA1:1.56
	REL9_0_ALPHA5_BRANCH:1.55.0.2
	REL9_0_ALPHA5:1.55
	REL7_4_28:1.28
	REL8_0_24:1.32
	REL8_1_20:1.35.2.1
	REL8_2_16:1.41
	REL8_3_10:1.46
	REL8_4_3:1.51
	REL9_0_ALPHA4:1.54
	REL9_0_ALPHA4_BRANCH:1.54.0.4
	REL8_5_ALPHA3:1.54
	REL8_5_ALPHA3_BRANCH:1.54.0.2
	REL7_4_27:1.28
	REL8_0_23:1.32
	REL8_1_19:1.35.2.1
	REL8_2_15:1.41
	REL8_3_9:1.46
	REL8_4_2:1.51
	REL8_5_ALPHA2:1.53
	REL8_5_ALPHA2_BRANCH:1.53.0.2
	REL7_4_26:1.28
	REL8_0_22:1.32
	REL8_1_18:1.35.2.1
	REL8_2_14:1.41
	REL8_3_8:1.46
	REL8_4_1:1.51
	REL8_5_ALPHA1:1.51
	REL8_5_ALPHA1_BRANCH:1.51.0.4
	REL8_4_STABLE:1.51.0.2
	REL8_4_0:1.51
	REL8_4_RC2:1.51
	REL8_4_RC1:1.51
	REL8_4_BETA2:1.51
	REL8_4_BETA1:1.51
	REL7_4_25:1.28
	REL8_0_21:1.32
	REL8_1_17:1.35.2.1
	REL8_2_13:1.41
	REL8_3_7:1.46
	REL7_4_24:1.28
	REL8_0_20:1.32
	REL8_1_16:1.35.2.1
	REL8_2_12:1.41
	REL8_3_6:1.46
	REL7_4_23:1.28
	REL8_0_19:1.32
	REL8_1_15:1.35.2.1
	REL8_2_11:1.41
	REL8_3_5:1.46
	REL7_4_22:1.28
	REL8_0_18:1.32
	REL8_1_14:1.35.2.1
	REL8_2_10:1.41
	REL8_3_4:1.46
	REL7_4_21:1.28
	REL8_0_17:1.32
	REL8_1_13:1.35.2.1
	REL8_2_9:1.41
	REL8_3_3:1.46
	REL7_4_20:1.28
	REL8_0_16:1.32
	REL8_1_12:1.35.2.1
	REL8_2_8:1.41
	REL8_3_2:1.46
	REL8_2_7:1.41
	REL8_3_1:1.46
	REL8_3_STABLE:1.46.0.2
	REL8_3_0:1.46
	REL8_3_RC2:1.46
	REL7_3_21:1.22.2.1
	REL7_4_19:1.28
	REL8_0_15:1.32
	REL8_1_11:1.35.2.1
	REL8_2_6:1.41
	REL8_3_RC1:1.46
	REL8_3_BETA4:1.46
	REL8_3_BETA3:1.46
	REL8_3_BETA2:1.45
	REL8_3_BETA1:1.44
	REL7_3_20:1.22.2.1
	REL7_4_18:1.28
	REL8_0_14:1.32
	REL8_1_10:1.35.2.1
	REL8_2_5:1.41
	REL7_3_19:1.22.2.1
	REL7_4_17:1.28
	REL8_0_13:1.32
	REL8_1_9:1.35.2.1
	REL8_2_4:1.41
	REL8_0_12:1.32
	REL8_1_8:1.35.2.1
	REL8_2_3:1.41
	REL7_3_18:1.22.2.1
	REL7_4_16:1.28
	REL8_0_11:1.32
	REL8_1_7:1.35.2.1
	REL8_2_2:1.41
	REL8_0_10:1.32
	REL8_1_6:1.35.2.1
	REL8_2_1:1.41
	REL7_4_15:1.28
	REL7_3_17:1.22.2.1
	REL8_2_STABLE:1.41.0.2
	REL8_2_0:1.41
	REL8_2_RC1:1.41
	REL8_2_BETA3:1.41
	REL8_2_BETA2:1.41
	REL8_1_5:1.35.2.1
	REL8_0_9:1.32
	REL7_4_14:1.28
	REL7_3_16:1.22.2.1
	REL8_2_BETA1:1.41
	REL7_3_15:1.22.2.1
	REL7_4_13:1.28
	REL8_0_8:1.32
	REL8_1_4:1.35
	REL7_3_14:1.22.2.1
	REL7_4_12:1.28
	REL8_0_7:1.32
	REL8_1_3:1.35
	REL7_3_13:1.22.2.1
	REL7_4_11:1.28
	REL8_0_6:1.32
	REL8_1_2:1.35
	REL7_3_12:1.22.2.1
	REL7_4_10:1.28
	REL8_0_5:1.32
	REL8_1_1:1.35
	REL8_1_STABLE:1.35.0.2
	REL8_1_0:1.35
	REL8_1_0RC1:1.35
	REL8_1_0BETA4:1.35
	REL8_1_0BETA3:1.34
	REL7_3_11:1.22.2.1
	REL7_4_9:1.28
	REL8_0_4:1.32
	REL8_1_0BETA2:1.34
	REL8_1_0BETA1:1.34
	REL7_2_8:1.19
	REL7_3_10:1.22.2.1
	REL7_4_8:1.28
	REL8_0_3:1.32
	REL8_0_2:1.32
	REL7_2_7:1.19
	REL7_3_9:1.22.2.1
	REL7_4_7:1.28
	REL8_0_1:1.32
	REL8_0_STABLE:1.32.0.4
	REL8_0_0:1.32.0.2
	REL8_0_0RC5:1.32
	REL8_0_0RC4:1.32
	REL8_0_0RC3:1.32
	REL8_0_0RC2:1.32
	REL8_0_0RC1:1.32
	REL8_0_0BETA5:1.32
	REL8_0_0BETA4:1.31
	REL7_4_6:1.28
	REL7_3_8:1.22.2.1
	REL7_2_6:1.19
	REL8_0_0BETA3:1.31
	REL8_0_0BETA2:1.31
	REL7_2_5:1.19
	REL7_4_5:1.28
	REL7_3_7:1.22.2.1
	REL7_4_4:1.28
	REL8_0_0BETA1:1.31
	REL7_4_3:1.28
	REL7_4_2:1.28
	REL7_3_6:1.22.2.1
	REL7_4_1:1.28
	REL7_3_5:1.22.2.1
	REL7_4:1.28
	REL7_4_RC2:1.28
	REL7_4_STABLE:1.28.0.2
	REL7_4_RC1:1.28
	REL7_4_BETA5:1.27
	REL7_4_BETA4:1.27
	REL7_4_BETA3:1.27
	REL7_4_BETA2:1.26
	WIN32_DEV:1.26.0.2
	REL7_4_BETA1:1.26
	REL7_3_4:1.22.2.1
	REL7_3_2:1.22.2.1
	REL7_2_4:1.19
	REL7_3_STABLE:1.22.0.2
	REL7_2_3:1.19
	REL7_2_STABLE:1.19.0.2
	REL7_2:1.19
	REL7_2_RC2:1.19
	REL7_2_RC1:1.19
	REL7_2_BETA5:1.19
	REL7_2_BETA4:1.19
	REL7_2_BETA3:1.18
	REL7_2_BETA2:1.16
	REL7_2_BETA1:1.16
	REL7_1_2:1.13
	REL7_1_STABLE:1.13.0.2
	REL7_1_BETA:1.12
	REL7_1_BETA3:1.13
	REL7_1_BETA2:1.13
	REL7_1:1.13
	REL7_0_PATCHES:1.10.0.2
	REL7_0:1.10
	REL6_5_PATCHES:1.7.0.2
	REL6_5:1.7
	REL6_4:1.4.0.2;
locks; strict;
comment	@# @;


1.56
date	2010.04.03.07.23.02;	author petere;	state Exp;
branches;
next	1.55;

1.55
date	2010.03.17.20.53.19;	author petere;	state Exp;
branches;
next	1.54;

1.54
date	2009.12.11.03.34.55;	author itagaki;	state Exp;
branches;
next	1.53;

1.53
date	2009.10.12.20.39.39;	author tgl;	state Exp;
branches;
next	1.52;

1.52
date	2009.09.19.10.23.27;	author petere;	state Exp;
branches;
next	1.51;

1.51
date	2009.01.22.20.15.59;	author tgl;	state Exp;
branches;
next	1.50;

1.50
date	2008.12.19.16.25.16;	author petere;	state Exp;
branches;
next	1.49;

1.49
date	2008.11.14.10.22.47;	author petere;	state Exp;
branches;
next	1.48;

1.48
date	2008.09.08.00.47.40;	author tgl;	state Exp;
branches;
next	1.47;

1.47
date	2008.03.03.19.17.27;	author momjian;	state Exp;
branches;
next	1.46;

1.46
date	2007.10.30.19.43.30;	author tgl;	state Exp;
branches;
next	1.45;

1.45
date	2007.10.10.21.38.51;	author neilc;	state Exp;
branches;
next	1.44;

1.44
date	2007.04.07.04.04.56;	author momjian;	state Exp;
branches;
next	1.43;

1.43
date	2007.04.07.03.48.25;	author momjian;	state Exp;
branches;
next	1.42;

1.42
date	2007.01.31.23.26.04;	author momjian;	state Exp;
branches;
next	1.41;

1.41
date	2006.09.16.00.30.19;	author momjian;	state Exp;
branches;
next	1.40;

1.40
date	2006.09.05.21.08.35;	author tgl;	state Exp;
branches;
next	1.39;

1.39
date	2006.08.02.16.29.49;	author tgl;	state Exp;
branches;
next	1.38;

1.38
date	2006.04.30.21.15.33;	author tgl;	state Exp;
branches;
next	1.37;

1.37
date	2006.04.30.02.09.06;	author momjian;	state Exp;
branches;
next	1.36;

1.36
date	2006.01.21.02.16.18;	author momjian;	state Exp;
branches;
next	1.35;

1.35
date	2005.10.20.19.18.01;	author tgl;	state Exp;
branches
	1.35.2.1;
next	1.34;

1.34
date	2005.07.26.23.24.02;	author tgl;	state Exp;
branches;
next	1.33;

1.33
date	2005.05.26.20.05.03;	author tgl;	state Exp;
branches;
next	1.32;

1.32
date	2004.11.05.19.15.52;	author tgl;	state Exp;
branches;
next	1.31;

1.31
date	2004.06.18.06.13.05;	author tgl;	state Exp;
branches;
next	1.30;

1.30
date	2004.06.01.21.49.21;	author tgl;	state Exp;
branches;
next	1.29;

1.29
date	2003.11.29.19.51.39;	author pgsql;	state Exp;
branches;
next	1.28;

1.28
date	2003.10.31.20.00.48;	author tgl;	state Exp;
branches;
next	1.27;

1.27
date	2003.08.31.17.32.24;	author petere;	state Exp;
branches;
next	1.26;

1.26
date	2003.04.26.23.56.51;	author petere;	state Exp;
branches
	1.26.2.1;
next	1.25;

1.25
date	2003.01.23.23.38.53;	author petere;	state Exp;
branches;
next	1.24;

1.24
date	2003.01.10.11.02.51;	author petere;	state Exp;
branches;
next	1.23;

1.23
date	2002.11.21.23.34.43;	author petere;	state Exp;
branches;
next	1.22;

1.22
date	2002.04.21.00.26.42;	author tgl;	state Exp;
branches
	1.22.2.1;
next	1.21;

1.21
date	2002.02.21.22.39.36;	author momjian;	state Exp;
branches;
next	1.20;

1.20
date	2002.02.18.23.11.03;	author petere;	state Exp;
branches;
next	1.19;

1.19
date	2001.12.08.03.24.39;	author thomas;	state Exp;
branches;
next	1.18;

1.18
date	2001.11.19.19.03.56;	author tgl;	state Exp;
branches;
next	1.17;

1.17
date	2001.11.18.20.35.02;	author petere;	state Exp;
branches;
next	1.16;

1.16
date	2001.09.03.12.57.50;	author petere;	state Exp;
branches;
next	1.15;

1.15
date	2001.06.09.23.21.54;	author petere;	state Exp;
branches;
next	1.14;

1.14
date	2001.05.27.09.59.28;	author petere;	state Exp;
branches;
next	1.13;

1.13
date	2000.12.25.23.15.26;	author petere;	state Exp;
branches;
next	1.12;

1.12
date	2000.10.12.21.23.34;	author momjian;	state Exp;
branches;
next	1.11;

1.11
date	2000.10.05.19.48.18;	author momjian;	state Exp;
branches;
next	1.10;

1.10
date	2000.04.10.01.35.44;	author momjian;	state Exp;
branches;
next	1.9;

1.9
date	2000.04.07.19.20.48;	author momjian;	state Exp;
branches;
next	1.8;

1.8
date	99.07.22.15.09.14;	author thomas;	state Exp;
branches;
next	1.7;

1.7
date	99.07.06.17.16.41;	author thomas;	state Exp;
branches;
next	1.6;

1.6
date	99.06.14.07.37.04;	author thomas;	state Exp;
branches;
next	1.5;

1.5
date	98.12.29.02.24.46;	author thomas;	state Exp;
branches;
next	1.4;

1.4
date	98.10.30.19.34.34;	author thomas;	state Exp;
branches;
next	1.3;

1.3
date	98.09.25.13.42.40;	author thomas;	state Exp;
branches;
next	1.2;

1.2
date	98.09.05.06.01.56;	author thomas;	state Exp;
branches;
next	1.1;

1.1
date	98.09.01.15.53.08;	author thomas;	state Exp;
branches;
next	;

1.22.2.1
date	2002.11.21.23.31.58;	author petere;	state Exp;
branches;
next	;

1.26.2.1
date	2003.09.07.04.36.46;	author momjian;	state Exp;
branches;
next	;

1.35.2.1
date	2006.08.02.16.30.00;	author tgl;	state Exp;
branches;
next	;


desc
@@


1.56
log
@Remove unnecessary xref endterm attributes and title ids

The endterm attribute is mainly useful when the toolchain does not support
automatic link target text generation for a particular situation.  In  the
past, this was required by the man page tools for all reference page links,
but that is no longer the case, and it now actually gets in the way of
proper automatic link text generation.  The only remaining use cases are
currently xrefs to refsects.
@
text
@<!--
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.55 2010/03/17 20:53:19 petere Exp $
PostgreSQL documentation
-->

<refentry id="SQL-REVOKE">
 <refmeta>
  <refentrytitle>REVOKE</refentrytitle>
  <manvolnum>7</manvolnum>
  <refmiscinfo>SQL - Language Statements</refmiscinfo>
 </refmeta>

 <refnamediv>
  <refname>REVOKE</refname>
  <refpurpose>remove access privileges</refpurpose>
 </refnamediv>

 <indexterm zone="sql-revoke">
  <primary>REVOKE</primary>
 </indexterm>

 <refsynopsisdiv>
<synopsis>
REVOKE [ GRANT OPTION FOR ]
    { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }
    [,...] | ALL [ PRIVILEGES ] }
    ON { [ TABLE ] <replaceable class="PARAMETER">table_name</replaceable> [, ...]
         | ALL TABLES IN SCHEMA <replaceable>schema_name</replaceable> [, ...] }
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { SELECT | INSERT | UPDATE | REFERENCES } ( <replaceable class="PARAMETER">column</replaceable> [, ...] )
    [,...] | ALL [ PRIVILEGES ] ( <replaceable class="PARAMETER">column</replaceable> [, ...] ) }
    ON [ TABLE ] <replaceable class="PARAMETER">table_name</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { USAGE | SELECT | UPDATE }
    [,...] | ALL [ PRIVILEGES ] }
    ON { SEQUENCE <replaceable class="PARAMETER">sequence_name</replaceable> [, ...]
         | ALL SEQUENCES IN SCHEMA <replaceable>schema_name</replaceable> [, ...] }
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { CREATE | CONNECT | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
    ON DATABASE <replaceable>database_name</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { USAGE | ALL [ PRIVILEGES ] }
    ON FOREIGN DATA WRAPPER <replaceable>fdw_name</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { USAGE | ALL [ PRIVILEGES ] }
    ON FOREIGN SERVER <replaceable>server_name</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { EXECUTE | ALL [ PRIVILEGES ] }
    ON { FUNCTION <replaceable>function_name</replaceable> ( [ [ <replaceable class="parameter">argmode</replaceable> ] [ <replaceable class="parameter">arg_name</replaceable> ] <replaceable class="parameter">arg_type</replaceable> [, ...] ] ) [, ...]
         | ALL FUNCTIONS IN SCHEMA <replaceable>schema_name</replaceable> [, ...] }
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { USAGE | ALL [ PRIVILEGES ] }
    ON LANGUAGE <replaceable>lang_name</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { SELECT | UPDATE } [,...] | ALL [ PRIVILEGES ] }
    ON LARGE OBJECT <replaceable class="PARAMETER">loid</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
    ON SCHEMA <replaceable>schema_name</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
    { CREATE | ALL [ PRIVILEGES ] }
    ON TABLESPACE <replaceable>tablespace_name</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">role_name</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ ADMIN OPTION FOR ]
    <replaceable class="PARAMETER">role_name</replaceable> [, ...] FROM <replaceable class="PARAMETER">role_name</replaceable> [, ...]
    [ CASCADE | RESTRICT ]
</synopsis>
 </refsynopsisdiv>

 <refsect1 id="SQL-REVOKE-description">
  <title>Description</title>

  <para>
   The <command>REVOKE</command> command revokes previously granted
   privileges from one or more roles.  The key word
   <literal>PUBLIC</literal> refers to the implicitly defined group of
   all roles.
  </para>

  <para>
   See the description of the <xref linkend="sql-grant"> command for
   the meaning of the privilege types.
  </para>

  <para>
   Note that any particular role will have the sum
   of privileges granted directly to it, privileges granted to any role it
   is presently a member of, and privileges granted to
   <literal>PUBLIC</literal>.  Thus, for example, revoking <literal>SELECT</> privilege
   from <literal>PUBLIC</literal> does not necessarily mean that all roles
   have lost <literal>SELECT</> privilege on the object: those who have it granted
   directly or via another role will still have it.  Similarly, revoking
   <literal>SELECT</> from a user might not prevent that user from using
   <literal>SELECT</> if <literal>PUBLIC</literal> or another membership
   role still has <literal>SELECT</> rights.
  </para>

  <para>
   If <literal>GRANT OPTION FOR</literal> is specified, only the grant
   option for the privilege is revoked, not the privilege itself.
   Otherwise, both the privilege and the grant option are revoked.
  </para>

  <para>
   If a user holds a privilege with grant option and has granted it to
   other users then the privileges held by those other users are
   called dependent privileges. If the privilege or the grant option
   held by the first user is being revoked and dependent privileges
   exist, those dependent privileges are also revoked if
   <literal>CASCADE</literal> is specified; if it is not, the revoke action
   will fail.  This recursive revocation only affects privileges that
   were granted through a chain of users that is traceable to the user
   that is the subject of this <literal>REVOKE</literal> command.
   Thus, the affected users might effectively keep the privilege if it
   was also granted through other users.
  </para>

  <para>
   When revoking privileges on a table, the corresponding column privileges
   (if any) are automatically revoked on each column of the table, as well.
  </para>

  <para>
   When revoking membership in a role, <literal>GRANT OPTION</> is instead
   called <literal>ADMIN OPTION</>, but the behavior is similar.
   Note also that this form of the command does not
   allow the noise word <literal>GROUP</>.
  </para>
 </refsect1>

 <refsect1 id="SQL-REVOKE-notes">
  <title>Notes</title>

  <para>
   Use <xref linkend="app-psql">'s <command>\dp</command> command to
   display the privileges granted on existing tables and columns.  See <xref
   linkend="sql-grant"> for information about the
   format.  For non-table objects there are other <command>\d</> commands
   that can display their privileges.
  </para>

  <para>
   A user can only revoke privileges that were granted directly by
   that user.  If, for example, user A has granted a privilege with
   grant option to user B, and user B has in turned granted it to user
   C, then user A cannot revoke the privilege directly from C.
   Instead, user A could revoke the grant option from user B and use
   the <literal>CASCADE</literal> option so that the privilege is
   in turn revoked from user C.  For another example, if both A and B
   have granted the same privilege to C, A can revoke his own grant
   but not B's grant, so C will still effectively have the privilege.
  </para>

   <para>
    When a non-owner of an object attempts to <command>REVOKE</> privileges
    on the object, the command will fail outright if the user has no
    privileges whatsoever on the object.  As long as some privilege is
    available, the command will proceed, but it will revoke only those
    privileges for which the user has grant options.  The <command>REVOKE ALL
    PRIVILEGES</> forms will issue a warning message if no grant options are
    held, while the other forms will issue a warning if grant options for
    any of the privileges specifically named in the command are not held.
    (In principle these statements apply to the object owner as well, but
    since the owner is always treated as holding all grant options, the
    cases can never occur.)
   </para>

   <para>
    If a superuser chooses to issue a <command>GRANT</> or <command>REVOKE</>
    command, the command is performed as though it were issued by the
    owner of the affected object.  Since all privileges ultimately come
    from the object owner (possibly indirectly via chains of grant options),
    it is possible for a superuser to revoke all privileges, but this might
    require use of <literal>CASCADE</literal> as stated above.
   </para>

   <para>
    <command>REVOKE</> can also be done by a role
    that is not the owner of the affected object, but is a member of the role
    that owns the object, or is a member of a role that holds privileges
    <literal>WITH GRANT OPTION</literal> on the object.  In this case the
    command is performed as though it were issued by the containing role that
    actually owns the object or holds the privileges
    <literal>WITH GRANT OPTION</literal>.  For example, if table
    <literal>t1</> is owned by role <literal>g1</>, of which role
    <literal>u1</> is a member, then <literal>u1</> can revoke privileges
    on <literal>t1</> that are recorded as being granted by <literal>g1</>.
    This would include grants made by <literal>u1</> as well as by other
    members of role <literal>g1</>.
   </para>

   <para>
    If the role executing <command>REVOKE</> holds privileges
    indirectly via more than one role membership path, it is unspecified
    which containing role will be used to perform the command.  In such cases
    it is best practice to use <command>SET ROLE</> to become the specific
    role you want to do the <command>REVOKE</> as.  Failure to do so might
    lead to revoking privileges other than the ones you intended, or not
    revoking anything at all.
   </para>
 </refsect1>

 <refsect1 id="SQL-REVOKE-examples">
  <title>Examples</title>

  <para>
   Revoke insert privilege for the public on table
   <literal>films</literal>:

<programlisting>
REVOKE INSERT ON films FROM PUBLIC;
</programlisting>
  </para>

  <para>
   Revoke all privileges from user <literal>manuel</literal> on view
   <literal>kinds</literal>:

<programlisting>
REVOKE ALL PRIVILEGES ON kinds FROM manuel;
</programlisting>

   Note that this actually means <quote>revoke all privileges that I
   granted</>.
  </para>

  <para>
   Revoke membership in role <literal>admins</> from user <literal>joe</>:

<programlisting>
REVOKE admins FROM joe;
</programlisting>
  </para>
 </refsect1>

 <refsect1 id="SQL-REVOKE-compatibility">
  <title>Compatibility</title>

   <para>
    The compatibility notes of the <xref linkend="sql-grant"> command
    apply analogously to <command>REVOKE</command>.
    The keyword <literal>RESTRICT</literal> or <literal>CASCADE</literal>
    is required according to the standard, but <productname>PostgreSQL</>
    assumes <literal>RESTRICT</literal> by default.
   </para>
 </refsect1>

 <refsect1>
  <title>See Also</title>

  <simpara>
   <xref linkend="sql-grant">
  </simpara>
 </refsect1>

</refentry>
@


1.55
log
@Make typography consistent
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.54 2009/12/11 03:34:55 itagaki Exp $
d8 1
a8 1
  <refentrytitle id="sql-revoke-title">REVOKE</refentrytitle>
d113 1
a113 1
   See the description of the <xref linkend="sql-grant" endterm="sql-grant-title"> command for
d169 1
a169 1
   linkend="sql-grant" endterm="sql-grant-title"> for information about the
d272 1
a272 1
    The compatibility notes of the <xref linkend="sql-grant" endterm="sql-grant-title"> command
d284 1
a284 1
   <xref linkend="sql-grant" endterm="sql-grant-title">
@


1.54
log
@Add large object access control.

A new system catalog pg_largeobject_metadata manages
ownership and access privileges of large objects.

KaiGai Kohei, reviewed by Jaime Casanova.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.53 2009/10/12 20:39:39 tgl Exp $
d81 1
a81 1
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
@


1.53
log
@Support GRANT/REVOKE ON ALL TABLES/SEQUENCES/FUNCTIONS IN SCHEMA.

Petr Jelinek
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.52 2009/09/19 10:23:27 petere Exp $
d79 6
@


1.52
log
@Make the placeholder naming in the synopses of the SQL help more consistent
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.51 2009/01/22 20:15:59 tgl Exp $
d27 2
a28 1
    ON [ TABLE ] <replaceable class="PARAMETER">table_name</replaceable> [, ...]
d42 2
a43 1
    ON SEQUENCE <replaceable class="PARAMETER">sequence_name</replaceable> [, ...]
d67 2
a68 1
    ON FUNCTION <replaceable>function_name</replaceable> ( [ [ <replaceable class="parameter">argmode</replaceable> ] [ <replaceable class="parameter">arg_name</replaceable> ] <replaceable class="parameter">arg_type</replaceable> [, ...] ] ) [, ...]
@


1.51
log
@Support column-level privileges, as required by SQL standard.

Stephen Frost, with help from KaiGai Kohei and others
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.50 2008/12/19 16:25:16 petere Exp $
d27 2
a28 2
    ON [ TABLE ] <replaceable class="PARAMETER">tablename</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d34 2
a35 2
    ON [ TABLE ] <replaceable class="PARAMETER">tablename</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d41 2
a42 2
    ON SEQUENCE <replaceable class="PARAMETER">sequencename</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d47 2
a48 2
    ON DATABASE <replaceable>dbname</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d53 2
a54 2
    ON FOREIGN DATA WRAPPER <replaceable>fdwname</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d59 2
a60 2
    ON FOREIGN SERVER <replaceable>servername</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d65 2
a66 2
    ON FUNCTION <replaceable>funcname</replaceable> ( [ [ <replaceable class="parameter">argmode</replaceable> ] [ <replaceable class="parameter">argname</replaceable> ] <replaceable class="parameter">argtype</replaceable> [, ...] ] ) [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d71 2
a72 2
    ON LANGUAGE <replaceable>langname</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d77 2
a78 2
    ON SCHEMA <replaceable>schemaname</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d83 2
a84 2
    ON TABLESPACE <replaceable>tablespacename</replaceable> [, ...]
    FROM { [ GROUP ] <replaceable class="PARAMETER">rolename</replaceable> | PUBLIC } [, ...]
d88 1
a88 1
    <replaceable class="PARAMETER">role</replaceable> [, ...] FROM <replaceable class="PARAMETER">rolename</replaceable> [, ...]
@


1.50
log
@SQL/MED catalog manipulation facilities

This doesn't do any remote or external things yet, but it gives modules
like plproxy and dblink a standardized and future-proof system for
managing their connection information.

Martin Pihlak and Peter Eisentraut
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.49 2008/11/14 10:22:47 petere Exp $
d32 7
d142 5
d158 5
a162 3
   Use <xref linkend="app-psql">'s <command>\z</command> command to
   display the privileges granted on existing objects.  See <xref
   linkend="sql-grant" endterm="sql-grant-title"> for information about the format.
@


1.49
log
@Set SQL man pages to be section 7 by default, and only transform them to
another section if required by the platform (instead of the old way of
building them in section "l" and always transforming them to the
platform-specific section).

This speeds up the installation on common platforms, and it avoids some
funny business with the man page tools and build process.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.48 2008/09/08 00:47:40 tgl Exp $
d45 12
@


1.48
log
@Create a separate grantable privilege for TRUNCATE, rather than having it be
always owner-only.  The TRUNCATE privilege works identically to the DELETE
privilege so far as interactions with the rest of the system go.

Robert Haas
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.47 2008/03/03 19:17:27 momjian Exp $
d9 1
@


1.47
log
@Document that REVOKE doesn't remove all permissions if PUBLIC has permissions.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.46 2007/10/30 19:43:30 tgl Exp $
d24 1
a24 1
    { { SELECT | INSERT | UPDATE | DELETE | REFERENCES | TRIGGER }
@


1.46
log
@Update some obsolete stuff in the GRANT and REVOKE reference pages:
simplify the syntax examples by unifying user and group cases, and fix
no-longer-correct example of psql \z output.  Per Erwin Brandstetter.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.45 2007/10/10 21:38:51 neilc Exp $
d95 4
a98 1
   directly or via another role will still have it.
@


1.45
log
@Fix typo in REVOKE reference page. Guillaume Lelarge.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.44 2007/04/07 04:04:56 momjian Exp $
d27 1
a27 1
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
d34 1
a34 1
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
d40 1
a40 1
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
d46 1
a46 1
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
d52 1
a52 1
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
d58 1
a58 1
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
d64 1
a64 1
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
d68 1
a68 1
    <replaceable class="PARAMETER">role</replaceable> [, ...] FROM <replaceable class="PARAMETER">username</replaceable> [, ...]
d110 1
a110 1
   <literal>CASCADE</literal> is specified, else the revoke action
@


1.44
log
@Slight wording improvement.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.43 2007/04/07 03:48:25 momjian Exp $
d235 1
a235 1
    They keyword <literal>RESTRICT</literal> or <literal>CASCADE</literal>
@


1.43
log
@Remove example of SQL-standard syntax for GRANT/REVOKE --- was causing
confusion.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.42 2007/01/31 23:26:04 momjian Exp $
d235 1
a235 1
    <literal>RESTRICT</literal> or <literal>CASCADE</literal>
@


1.42
log
@Update reference documentation on may/can/might:

Standard English uses "may", "can", and "might" in different ways:

        may - permission, "You may borrow my rake."

        can - ability, "I can lift that log."

        might - possibility, "It might rain today."

Unfortunately, in conversational English, their use is often mixed, as
in, "You may use this variable to do X", when in fact, "can" is a better
choice.  Similarly, "It may crash" is better stated, "It might crash".
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.41 2006/09/16 00:30:19 momjian Exp $
d234 2
a235 9
    apply analogously to <command>REVOKE</command>.  The syntax summary is:

<synopsis>
REVOKE [ GRANT OPTION FOR ] <replaceable class="PARAMETER">privileges</replaceable>
    ON <replaceable class="parameter">object</replaceable> [ ( <replaceable class="parameter">column</replaceable> [, ...] ) ]
    FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] }
    { RESTRICT | CASCADE }
</synopsis>
    One of <literal>RESTRICT</literal> or <literal>CASCADE</literal>
@


1.41
log
@Remove emacs info from footer of SGML files.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.40 2006/09/05 21:08:35 tgl Exp $
d114 1
a114 1
   Thus, the affected users may effectively keep the privilege if it
d166 1
a166 1
    it is possible for a superuser to revoke all privileges, but this may
d190 1
a190 1
    role you want to do the <command>REVOKE</> as.  Failure to do so may
@


1.40
log
@Get rid of the separate RULE privilege for tables: now only a table's owner
can create or modify rules for the table.  Do setRuleCheckAsUser() while
loading rules into the relcache, rather than when defining a rule.  This
ensures that permission checks for tables referenced in a rule are done with
respect to the current owner of the rule's table, whereas formerly ALTER TABLE
OWNER would fail to update the permission checking for associated rules.
Removal of separate RULE privilege is needed to prevent various scenarios
in which a grantee of RULE privilege could effectively have any privilege
of the table owner.  For backwards compatibility, GRANT/REVOKE RULE is still
accepted, but it doesn't do anything.  Per discussion here:
http://archives.postgresql.org/pgsql-hackers/2006-04/msg01138.php
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.39 2006/08/02 16:29:49 tgl Exp $
a256 17

<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:nil
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:1
sgml-indent-data:t
sgml-parent-document:nil
sgml-default-dtd-file:"../reference.ced"
sgml-exposed-tags:nil
sgml-local-catalogs:"/usr/lib/sgml/catalog"
sgml-local-ecat-files:nil
End:
-->
@


1.39
log
@Fix documentation error: GRANT/REVOKE for roles only accept role names
as grantees, not PUBLIC ... and you can't say GROUP either.  Noted by
Brian Hurt.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.38 2006/04/30 21:15:33 tgl Exp $
d24 1
a24 1
    { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER }
@


1.38
log
@Code review for GRANT CONNECT patch.  Spell the privilege as CONNECT not
CONNECTION, fix a number of places that were missed (eg pg_dump support),
avoid executing an extra search of pg_database during startup.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.37 2006/04/30 02:09:06 momjian Exp $
d68 1
a68 2
    <replaceable class="PARAMETER">role</replaceable> [, ...]
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
d121 2
@


1.37
log
@Add GRANT CONNECTION ON DATABASE, to be used in addition to pg_hba.conf.

Gevik Babakhani
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.36 2006/01/21 02:16:18 momjian Exp $
d38 1
a38 1
    { { CREATE | TEMPORARY | TEMP | CONNECTION } [,...] | ALL [ PRIVILEGES ] }
@


1.36
log
@Add GRANT ON SEQUENCE syntax to support sequence-only permissions.
Continue to support GRANT ON [TABLE] for sequences for backward
compatibility;  issue warning for invalid sequence permissions.

[Backward compatibility warning message.]

Add USAGE permission for sequences that allows only currval() and
nextval(), not setval().

Mention object name in grant/revoke warnings because of possible
multi-object operations.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.35 2005/10/20 19:18:01 tgl Exp $
d38 1
a38 1
    { { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
@


1.35
log
@Document the behavior of GRANT/REVOKE in cases where the privilege is
held by means of role membership, rather than directly.  Per discussion
and bug fix of a couple weeks ago.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.34 2005/07/26 23:24:02 tgl Exp $
d31 7
@


1.35.2.1
log
@Fix documentation error: GRANT/REVOKE for roles only accept role names
as grantees, not PUBLIC ... and you can't say GROUP either.  Noted by
Brian Hurt.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.35 2005/10/20 19:18:01 tgl Exp $
d61 2
a62 1
    <replaceable class="PARAMETER">role</replaceable> [, ...] FROM <replaceable class="PARAMETER">username</replaceable> [, ...]
a114 2
   Note also that this form of the command does not
   allow the noise word <literal>GROUP</>.
@


1.34
log
@Basic documentation for ROLEs.  The user-manag chapter still needs to
be rewritten, but at least the reference pages are reasonably sane.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.33 2005/05/26 20:05:03 tgl Exp $
d161 25
@


1.33
log
@Document that utility commands such as DROP FUNCTION allow argument names
and modes to be included when naming an existing function.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.32 2004/11/05 19:15:52 tgl Exp $
d59 5
d72 1
a72 1
   privileges from one or more users or groups of users.  The key word
d74 1
a74 1
   all users.
d83 2
a84 2
   Note that any particular user will have the sum
   of privileges granted directly to him, privileges granted to any group he
d87 1
a87 1
   from <literal>PUBLIC</literal> does not necessarily mean that all users
d89 1
a89 1
   directly or via a group will still have it.
d111 5
d186 8
@


1.32
log
@Create 'default_tablespace' GUC variable that supplies a TABLESPACE
clause implicitly whenever one is not given explicitly.  Remove concept
of a schema having an associated tablespace, and simplify the rules for
selecting a default tablespace for a table or index.  It's now just
(a) explicit TABLESPACE clause; (b) default_tablespace if that's not an
empty string; (c) database's default.  This will allow pg_dump to use
SET commands instead of tablespace clauses to determine object locations
(but I didn't actually make it do so).  All per recent discussions.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql/doc/src/sgml/ref/revoke.sgml,v 1.31 2004/06/18 06:13:05 tgl Exp $
d38 1
a38 1
    ON FUNCTION <replaceable>funcname</replaceable> ([<replaceable>type</replaceable>, ...]) [, ...]
@


1.31
log
@Tablespaces.  Alternate database locations are dead, long live tablespaces.

There are various things left to do: contrib dbsize and oid2name modules
need work, and so does the documentation.  Also someone should think about
COMMENT ON TABLESPACE and maybe RENAME TABLESPACE.  Also initlocation is
dead, it just doesn't know it yet.

Gavin Sherry and Tom Lane.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.30 2004/06/01 21:49:21 tgl Exp $
a36 6
    { CREATE | ALL [ PRIVILEGES ] }
    ON TABLESPACE <replaceable>tablespacename</replaceable> [, ...]
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC } [, ...]
    [ CASCADE | RESTRICT ]

REVOKE [ GRANT OPTION FOR ]
d53 6
@


1.30
log
@Align GRANT/REVOKE behavior more closely with the SQL spec, per discussion
of bug report #1150.  Also, arrange that the object owner's irrevocable
grant-option permissions are handled implicitly by the system rather than
being listed in the ACL as self-granted rights (which was wrong anyway).
I did not take the further step of showing these permissions in an
explicit 'granted by _SYSTEM' ACL entry, as that seemed more likely to
bollix up existing clients than to do anything really useful.  It's still
a possible future direction, though.
@
text
@d2 1
a2 1
$PostgreSQL: pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.29 2003/11/29 19:51:39 pgsql Exp $
d33 6
@


1.29
log
@
$Header: -> $PostgreSQL Changes ...
@
text
@d2 1
a2 1
$PostgreSQL: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.28 2003/10/31 20:00:48 tgl Exp $
d84 1
d107 1
a107 1
   display the privileges granted on existing objects.  See also <xref
d118 3
a120 1
   automatically revoked from user C.
d124 14
d160 2
a161 1
   Revoke all privileges from user <literal>manuel</literal> on view <literal>kinds</literal>:
d163 1
a163 1
<programlisting>  
d166 3
@


1.28
log
@When a superuser does GRANT or REVOKE on an object he doesn't own,
process the command as though it were issued by the object owner.
This prevents creating weird scenarios in which the same privileges
may appear to flow from different sources, and ensures that a superuser
can in fact revoke all privileges if he wants to.  In particular this
means that the regression tests work when run by a superuser other than
the original bootstrap userid.  Per report from Larry Rosenman.
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.27 2003/08/31 17:32:24 petere Exp $
@


1.27
log
@Add/edit index entries.
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.26 2003/04/26 23:56:51 petere Exp $
d67 5
a81 5
   See the description of the <xref linkend="sql-grant" endterm="sql-grant-title"> command for
   the meaning of the privilege types.
  </para>

  <para>
d119 9
d165 2
a166 1
    is required.
@


1.26
log
@Editing of more reference pages.
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.25 2003/01/23 23:38:53 petere Exp $
d16 4
@


1.26.2.1
log
@Update this branch to match CVS head, includes WIN32 improvements.
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.27 2003/08/31 17:32:24 petere Exp $
a15 4

 <indexterm zone="sql-revoke">
  <primary>REVOKE</primary>
 </indexterm>
@


1.25
log
@Grant options, and cascading revoke.  Grant options are allowed only for
users right now, not groups.  Extension of has_foo_privileges functions to
query the grant options.  Extension of aclitem type to store grantor.
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.24 2003/01/10 11:02:51 petere Exp $
d56 4
a59 4
   <command>REVOKE</command> allows the creator of an object to revoke
   previously granted permissions from one or more users or groups of users.
   The key word <literal>PUBLIC</literal> refers to the implicitly defined
   group of all users.
d66 1
a66 1
   <literal>PUBLIC</literal>.  Thus, for example, revoking SELECT privilege
d68 1
a68 1
   have lost SELECT privilege on the object: those who have it granted
a140 3
  <refsect2>
   <title>SQL92</title>

d146 1
a146 1
REVOKE [ GRANT OPTION FOR ] { SELECT | INSERT | UPDATE | DELETE | REFERENCES }
a153 1
  </refsect2>
@


1.24
log
@Add optional drop behavior clause to REVOKE command, for SQL conformance.
Currently, only RESTRICT is allowed.
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.23 2002/11/21 23:34:43 petere Exp $
d19 2
a20 1
REVOKE { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER }
d24 1
a24 1
    [ RESTRICT ]
d26 2
a27 1
REVOKE { { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }
d30 1
a30 1
    [ RESTRICT ]
d32 2
a33 1
REVOKE { EXECUTE | ALL [ PRIVILEGES ] }
d36 1
a36 1
    [ RESTRICT ]
d38 2
a39 1
REVOKE { USAGE | ALL [ PRIVILEGES ] }
d42 1
a42 1
    [ RESTRICT ]
d44 2
a45 1
REVOKE { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }
d48 1
a48 1
    [ RESTRICT ]
d78 16
a93 2
   The <literal>RESTRICT</literal> key word is currently only noise.
   See also the compatibility notes below.
d105 10
d154 2
a155 10
   </para>

   <para> 
    If user1 gives a privilege WITH GRANT OPTION to user2,
    and user2 gives it to user3 then user1 can revoke
    this privilege in cascade using the CASCADE keyword.
    If user1 gives a privilege WITH GRANT OPTION to user2,
    and user2 gives it to user3, then if user1 tries to revoke
    this privilege it fails if he specifies the RESTRICT
    keyword.
@


1.23
log
@Fixups for man pages
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.22 2002/04/21 00:26:42 tgl Exp $
d23 1
d28 1
d33 1
d38 1
d43 1
d70 5
@


1.22
log
@Restructure AclItem representation so that we can have more than eight
different privilege bits (might as well make use of the space we were
wasting on padding).  EXECUTE and USAGE bits for procedures, languages
now are separate privileges instead of being overlaid on SELECT.  Add
privileges for namespaces and databases.  The GRANT and REVOKE commands
work for these object types, but we don't actually enforce the privileges
yet...
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.21 2002/02/21 22:39:36 momjian Exp $
d74 1
a74 1
   linkend="sql-grant"> for information about the format.
d133 1
a133 1
   <xref linkend="sql-grant">
@


1.22.2.1
log
@Fixups for man pages
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql-server/doc/src/sgml/ref/revoke.sgml,v 1.22 2002/04/21 00:26:42 tgl Exp $
d74 1
a74 1
   linkend="sql-grant" endterm="sql-grant-title"> for information about the format.
d133 1
a133 1
   <xref linkend="sql-grant" endterm="sql-grant-title">
@


1.21
log
@Wrap some SQL syntax examples so \h shows them better.
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.20 2002/02/18 23:11:03 petere Exp $
d21 5
a25 1
    ON [ TABLE ] <replaceable class="PARAMETER">object</replaceable> [, ...]
d34 4
@


1.20
log
@Privileges on functions and procedural languages
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.19 2001/12/08 03:24:39 thomas Exp $
d19 2
a20 1
REVOKE { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,...] | ALL [ PRIVILEGES ] }
@


1.19
log
@Use PostgreSQL consistantly throughout docs. Before, usage was split evenly
 between Postgres and PostgreSQL.
@
text
@d2 1
a2 1
$Header: /cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.18 2001/11/19 19:03:56 tgl Exp $
d21 8
@


1.18
log
@Try to be a little bit clearer about the implications of GRANT TO PUBLIC
and REVOKE FROM PUBLIC: the latter is not the same as 'revoke from all
users', but the ref page blurred the difference.
@
text
@d2 2
a3 2
$Header: /cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.17 2001/11/18 20:35:02 petere Exp $
Postgres documentation
@


1.17
log
@Initial round of tweakage for man pages
@
text
@d2 1
a2 1
$Header: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.16 2001/09/03 12:57:50 petere Exp $
d30 13
a42 3
   permissions granted before, from a users or a group of users.  The
   key word <literal>PUBLIC</literal> means to revoke this privilege
   from all users.
d65 1
a65 1
   Revoke insert privilege from all users on table
d106 1
a106 1
    this privilege it fails if he specify the RESTRICT
@


1.16
log
@Put some kind of grammatical uniformity in the <refpurpose> lines.
@
text
@d2 1
a2 1
$Header: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.15 2001/06/09 23:21:54 petere Exp $
d8 1
a8 1
  <refentrytitle>REVOKE</refentrytitle>
d36 1
a36 1
   See the description of the <xref linkend="sql-grant"> command for
d79 1
a79 1
    The compatibility notes of the <xref linkend="sql-grant"> command
@


1.15
log
@Allow GRANT/REVOKE to/from more than one user per invocation.  Command tag
for GRANT/REVOKE is now just that, not "CHANGE".

On the way, migrate some of the aclitem internal representation away from
the parser and build a real parse tree instead.  Also add some 'const'
qualifiers.
@
text
@d2 1
a2 1
$Header: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.14 2001/05/27 09:59:28 petere Exp $
d14 1
a14 1
  <refpurpose>Revokes access privilege from a user, a group, or all users.</refpurpose>
@


1.14
log
@Make UPDATE and DELETE privileges distinct.  Add REFERENCES and TRIGGER
privileges.  INSERT and COPY FROM now require INSERT (only).  Add
privileges regression test.
@
text
@d2 1
a2 1
$Header: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.13 2000/12/25 23:15:26 petere Exp $
d21 1
a21 1
    FROM { <replaceable class="PARAMETER">username</replaceable> | GROUP <replaceable class="PARAMETER">groupname</replaceable> | PUBLIC }
@


1.13
log
@Refine some things to create better looking man pages.
@
text
@d2 1
a2 1
$Header: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.12 2000/10/12 21:23:34 momjian Exp $
d8 1
a8 3
  <refentrytitle id="SQL-REVOKE-TITLE">
   REVOKE
  </refentrytitle>
d11 1
d13 2
a14 6
  <refname>
   REVOKE
  </refname>
  <refpurpose>
   Revokes access privilege from a user, a group or all users.
  </refpurpose>
d16 1
d18 6
a23 17
  <refsynopsisdivinfo>
   <date>1999-07-20</date>
  </refsynopsisdivinfo>
  <synopsis>
REVOKE <replaceable class="PARAMETER">privilege</replaceable> [, ...]
    ON <replaceable class="PARAMETER">object</replaceable> [, ...]
    FROM { PUBLIC | GROUP <replaceable class="PARAMETER">groupname</replaceable> | <replaceable class="PARAMETER">username</replaceable> }
  </synopsis>

  <refsect2 id="R2-SQL-REVOKE-1">
   <refsect2info>
    <date>1998-09-24</date>
   </refsect2info>
   <title>
    Inputs
   </title>
   <para>
d25 2
a26 132
    <variablelist>
     <varlistentry>
      <term><replaceable class="PARAMETER">privilege</replaceable></term>
      <listitem>
       <para>
	The possible privileges are:

	<variablelist>
	 <varlistentry>
	  <term>SELECT</term>
	  <listitem>
	   <para>
	    Privilege to access all of the columns of a specific
	    table/view.
	   </para>
	  </listitem>
	 </varlistentry>

	 <varlistentry>
	  <term>INSERT</term>
	  <listitem>
	   <para>
	    Privilege to insert data into all columns of a
	    specific table.
	   </para>
	  </listitem>
	 </varlistentry>

	 <varlistentry>
	  <term>UPDATE</term>
	  <listitem>
	   <para>
	    Privilege to update all columns of a specific
	    table.
	   </para>
	  </listitem>
	 </varlistentry>

	 <varlistentry>
	  <term>DELETE</term>
	  <listitem>
	   <para>
	    Privilege to delete rows from a specific table.
	   </para>
	  </listitem>
	 </varlistentry>

	 <varlistentry>
	  <term>RULE</term>
	  <listitem>
	   <para>
	    Privilege to define rules on table/view.
	    (See 
	    <xref linkend="sql-createrule" endterm="sql-createrule-title">).
	   </para>
	  </listitem>
	 </varlistentry>

	 <varlistentry>
	  <term>ALL</term>
	  <listitem>
	   <para>
	    Rescind all privileges.
	   </para>
	  </listitem>
	 </varlistentry>
	</variablelist>
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term><replaceable class="PARAMETER">object</replaceable></term>
      <listitem>
       <para>
	The name of an object from which to revoke access.

	The possible objects are:
	<itemizedlist spacing="compact" mark="bullet">
	 <listitem>
	  <para>
	   table 
	  </para>
	 </listitem>

	 <listitem>
	  <para>
	   view 
	  </para>
	 </listitem>

	 <listitem>
	  <para>
	   sequence
	  </para>
	 </listitem>

	</itemizedlist>
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term><replaceable class="PARAMETER">group</replaceable></term>
      <listitem>
       <para>
	The name of a group from whom to revoke privileges.
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term><replaceable class="PARAMETER">username</replaceable></term>
      <listitem>
       <para>
	The name of a user from whom revoke privileges. Use the PUBLIC keyword
	to specify all users.
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term>PUBLIC</term>
      <listitem>
       <para>
	Rescind the specified privilege(s) for all users.
       </para>
      </listitem>
     </varlistentry>
    </variablelist>
   </para>
  </refsect2>
d28 6
a33 8
  <refsect2 id="R2-SQL-REVOKE-2">
   <refsect2info>
    <date>1998-09-24</date>
   </refsect2info>
   <title>
    Outputs
   </title>
   <para>
a34 35
    <variablelist>
     <varlistentry>
      <term><computeroutput>
CHANGE
       </computeroutput></term>
      <listitem>
       <para>
	Message returned if successfully.
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term><computeroutput>
ERROR
       </computeroutput></term>
      <listitem>
       <para>
	Message returned if object is not available or impossible
	to revoke privileges from a group or users.
       </para>
      </listitem>
     </varlistentry>		  
    </variablelist>
   </para>
  </refsect2>
 </refsynopsisdiv>

 <refsect1 id="R1-SQL-REVOKE-1">
  <refsect1info>
   <date>1998-09-24</date>
  </refsect1info>
  <title>
   Description
  </title>
d36 2
a37 2
   <command>REVOKE</command> allows creator of an object to revoke permissions granted
   before, from all users (via PUBLIC) or a certain user or group.
d39 1
d41 2
a42 41
  <refsect2 id="R2-SQL-REVOKE-3">
   <refsect2info>
    <date>1998-09-24</date>
   </refsect2info>
   <title>
    Notes
   </title>
   <para>
    Refer to psql \z command for further information about permissions 
    on existing objects:

    <programlisting>
Database    = lusitania
+------------------+---------------------------------------------+
|  Relation        |        Grant/Revoke Permissions             |
+------------------+---------------------------------------------+
| mytable          | {"=rw","miriam=arwR","group todos=rw"}      |
+------------------+---------------------------------------------+
Legend:
     uname=arwR -- privileges granted to a user
     group gname=arwR -- privileges granted to a GROUP
     =arwR -- privileges granted to PUBLIC
		  
     r -- SELECT
     w -- UPDATE/DELETE
     a -- INSERT
     R -- RULE
     arwR -- ALL
    </programlisting>
   </para>
   <tip>
    <para>
     Currently, to create a GROUP you have to insert 
     data manually into table pg_group as:

     <programlisting>
INSERT INTO pg_group VALUES ('todos');
CREATE USER miriam IN GROUP todos;
     </programlisting>
    </para>
   </tip>
d44 5
a48 1
  </refsect2>
d51 3
a53 4
 <refsect1 id="R1-SQL-REVOKE-2">
  <title>
   Usage
  </title>
d58 1
a58 1
   <programlisting>
d60 1
a60 1
  </programlisting>
d66 3
a68 3
   <programlisting>  
REVOKE ALL ON kinds FROM manuel;
   </programlisting>
d72 2
a73 12
 <refsect1 id="R1-SQL-REVOKE-3">
  <title>
   Compatibility
  </title>

  <refsect2 id="R2-SQL-REVOKE-4">
   <refsect2info>
    <date>1998-09-01</date>
   </refsect2info>
   <title>
    SQL92
   </title>
d75 2
a76 46
   <para>
    The SQL92 syntax for <command>REVOKE</command>
    has additional capabilities for rescinding
    privileges, including those on individual columns in tables:

    <variablelist>
     <varlistentry>
      <term>
       <synopsis>
REVOKE { SELECT | DELETE | USAGE | ALL PRIVILEGES } [, ...]
    ON <replaceable class="parameter">object</replaceable>
    FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
REVOKE { INSERT | UPDATE | REFERENCES } [, ...] [ ( <replaceable class="parameter">column</replaceable> [, ...] ) ]
    ON <replaceable class="parameter">object</replaceable>
    FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
       </synopsis>
      </term>
      <listitem>
       <para>
	Refer to
	<xref linkend="sql-grant" endterm="sql-grant-title">
	for details on individual fields.
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term>
       <synopsis>
REVOKE GRANT OPTION FOR <replaceable class="parameter">privilege</replaceable> [, ...]
    ON <replaceable class="parameter">object</replaceable>
    FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
       </synopsis>
      </term>
      <listitem>
       <para>
	Rescinds authority for a user to grant the specified privilege
	to others.
	Refer to
	<xref linkend="sql-grant" endterm="sql-grant-title">
	for details on individual fields.
       </para>
      </listitem>
     </varlistentry>
    </variablelist>
   </para>
d79 9
a87 18
    The possible objects are:
    <simplelist>
     <member>
      [ TABLE ] table/view
     </member>
     <member>
      CHARACTER SET character-set
     </member>
     <member>
      COLLATION collation
     </member>
     <member>
      TRANSLATION translation
     </member>
     <member>
      DOMAIN domain
     </member>
    </simplelist>
a93 3
   </para>

   <para>
d101 9
@


1.12
log
@Fix typo
@
text
@d2 1
a2 1
$Header: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.11 2000/10/05 19:48:18 momjian Exp $
d93 1
a93 1
	    <xref linkend="sql-createrule-title" endterm="sql-createrule-title">).
d322 1
a322 1
	<xref linkend="sql-grant-title" endterm="sql-grant-title">
d341 1
a341 1
	<xref linkend="sql-grant-title" endterm="sql-grant-title">
@


1.11
log
@Add proofreader's changes to docs.
Fix misspelling of disbursion to dispersion.
@
text
@d2 1
a2 1
$Header: /home/projects/pgsql/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.10 2000/04/10 01:35:44 momjian Exp $
d378 1
a378 1
    and user2 gives it to user3, then if user1 tries revoke
@


1.10
log
@No revoke on indexes any more
@
text
@d2 1
a2 1
$Header: /usr/local/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.9 2000/04/07 19:20:48 momjian Exp $
d378 2
a379 2
    and user2 gives it to user3 then if user1 try revoke
    this privilege it fails if he/she specify the RESTRICT
@


1.9
log
@More man updates to fix bad tags
@
text
@d2 1
a2 1
$Header: /usr/local/cvsroot/pgsql/doc/src/sgml/ref/revoke.sgml,v 1.8 1999/07/22 15:09:14 thomas Exp $
a136 5
	 <listitem>
	  <para>
	   index
	  </para>
	 </listitem>
@


1.8
log
@Complete merge of all old man page information.
ecpg reference page still needs formatting.
@
text
@d2 1
a2 1
$Header$
d28 1
a28 1
    FROM { PUBLIC | GROUP <replaceable class="PARAMETER">ER">g</replaceable>BLE> | <replaceable class="PARAMETER">username</replaceable> }
@


1.7
log
@Fix markup for docbook2man man page generation.
No big deal; fixed lots of other markup at the same time.
Bigest change: make sure there is no whitespace
 in front of <term> contents.
This will probably help the other output types too.
@
text
@d1 5
d8 1
a8 1
  <refentrytitle>
d23 1
a23 1
   <date>1998-09-24</date>
d92 2
a93 1
	    (See <command>CREATE RULE</command>).
d306 1
d326 3
a328 1
	Refer to <command>GRANT</command> for details on individual fields.
d345 3
a347 2
	Refer to the <command>GRANT</command> command for details
	on individual fields.
@


1.6
log
@Minor updates for release.
Split reference pages for CREATE TABLE AS and SELECT INTO to allow psgml
 (the emacs parser) to handle parsing.
@
text
@d37 1
a37 3
      <term>
       <replaceable class="PARAMETER">privilege</replaceable>
      </term>
a40 3
       </para>
      </listitem>
     </varlistentry>
d42 59
a100 8
     <varlistentry>
      <term>
       SELECT
      </term>
      <listitem>
       <para>
	Privilege to access all of the columns of a specific
	table/view.
d106 1
a106 3
      <term>
       INSERT
      </term>
d109 1
a109 17
	Privilege to insert data into all columns of a
	specific table.
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term>
       UPDATE
      </term>
      <listitem>
       <para>
	Privilege to update all columns of a specific
	table.
       </para>
      </listitem>
     </varlistentry>
a110 41
     <varlistentry>
      <term>
       DELETE
      </term>
      <listitem>
       <para>
	Privilege to delete rows from a specific table.
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term>
       RULE
      </term>
      <listitem>
       <para>
	Privilege to define rules on table/view.
	(See <command>CREATE RULE</command>).
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term>
       ALL
      </term>
      <listitem>
       <para>
	Rescind all privileges.
       </para>
      </listitem>
     </varlistentry>

     <varlistentry>
      <term>
       <replaceable class="PARAMETER">object</replaceable>
      </term>
      <listitem>
       <para>
	The name of an object from which to revoke access.
d142 1
a142 3
      <term>
       <replaceable class="PARAMETER">group</replaceable>
      </term>
d151 1
a151 3
      <term>
       <replaceable class="PARAMETER">username</replaceable>
      </term>
d161 1
a161 3
      <term>
       PUBLIC
      </term>
d183 3
a185 3
      <term>
       CHANGE
      </term>
d194 3
a196 3
      <term>
       ERROR
      </term>
d217 1
a217 1
   REVOKE allows creator of an object to revoke permissions granted
d255 2
a256 1
     <programlisting>          
d271 3
a274 2
-- revoke insert privilege from all users on table films:
--
d277 4
a282 2
-- revoke all privileges from user manuel on view kinds:
--
d343 1
d370 1
@


1.5
log
@Clean up to ensure tag completion as required by the newest versions
 of Norm's Modular Style Sheets and jade/docbook.
From Vince Vielhaber <vev@@michvhf.com>.
@
text
@d1 128
a128 189
<REFENTRY ID="SQL-REVOKE">
<REFMETA>
<REFENTRYTITLE>
REVOKE
</REFENTRYTITLE>
<REFMISCINFO>SQL - Language Statements</REFMISCINFO>
</REFMETA>
<REFNAMEDIV>
<REFNAME>
REVOKE
</REFNAME>
<REFPURPOSE>
Revokes access privilege from a user, a group or all users.
</REFPURPOSE>
  </refnamediv>
<REFSYNOPSISDIV>
<REFSYNOPSISDIVINFO>
<DATE>1998-09-24</DATE>
</REFSYNOPSISDIVINFO>
<SYNOPSIS>
<REPLACEABLE CLASS="PARAMETER">
</REPLACEABLE>
REVOKE <REPLACEABLE CLASS="PARAMETER">privilege</REPLACEABLE> [, ...]
    ON <REPLACEABLE CLASS="PARAMETER">object</REPLACEABLE> [, ...]
    FROM { PUBLIC | GROUP <REPLACEABLE CLASS="PARAMETER">group</REPLACEABLE> | <REPLACEABLE CLASS="PARAMETER">username</REPLACEABLE> }
</SYNOPSIS>

	<REFSECT2 ID="R2-SQL-REVOKE-1">
	  <REFSECT2INFO>
		<DATE>1998-09-24</DATE>
	  </REFSECT2INFO>
	  <TITLE>
		Inputs
	  </TITLE>
	  <PARA>
		
		<VARIABLELIST>
		  <VARLISTENTRY>
			<TERM>
			  <REPLACEABLE CLASS="PARAMETER">privilege</REPLACEABLE>
			</TERM>
			<LISTITEM>
			  <PARA>
				The possible privileges are:
			  </para>
			</listitem>
		  </varlistentry>

		  <VARLISTENTRY>
			<TERM>
			  SELECT
			</TERM>
			<LISTITEM>
			  <PARA>
				Privilege to access all of the columns of a specific
				table/view.
			  </PARA>
			</LISTITEM>
		  </VARLISTENTRY>
		  
		  <VARLISTENTRY>
			<TERM>
			  INSERT
			</TERM>
			<LISTITEM>
			  <PARA>
				Privilege to insert data into all columns of a
				specific table.
			  </para>
			</listitem>
		  </varlistentry>
		  
		  <VARLISTENTRY>
			<TERM>
			  UPDATE
			</TERM>
			<LISTITEM>
			  <PARA>
				Privilege to update all columns of a specific
				table.
			  </para>
			</listitem>
		  </varlistentry>
		  
		  <VARLISTENTRY>
			<TERM>
			  DELETE
			</TERM>
			<LISTITEM>
			  <PARA>
				Privilege to delete rows from a specific table.
			  </para>
			</listitem>
		  </varlistentry>
		  
		  <VARLISTENTRY>
			<TERM>
			  RULE
			</TERM>
			<LISTITEM>
			  <PARA>
				Privilege to define rules on table/view.
				(See <command>CREATE RULE</command>).
			  </para>
			</listitem>
		  </varlistentry>
		  
		  <VARLISTENTRY>
			<TERM>
			  ALL
			</TERM>
			<LISTITEM>
			  <PARA>
				Rescind all privileges.
			  </para>
			</listitem>
		  </varlistentry>
		  
		  <VARLISTENTRY>
			<TERM>
			  <REPLACEABLE CLASS="PARAMETER">object</REPLACEABLE>
			</TERM>
			<LISTITEM>
			  <PARA>
				The name of an object from which to revoke access.
				The possible objects are:
				<itemizedlist mark="bullet" spacing="compact">
				  <listitem>
					<para>
					  table 
					</para>
				  </listitem>
				  
				  <listitem>
					<para>
					  view 
					</para>
				  </listitem>
				  
				  <listitem>
					<para>
					  sequence
					</para>
				  </listitem>
				  
				  <listitem>
					<para>
					  index
					</para>
				  </listitem>
				</itemizedlist>
			  </para>
			</listitem>
		  </varlistentry>
		  
		  <VARLISTENTRY>
			<TERM>
			  <REPLACEABLE CLASS="PARAMETER">group</REPLACEABLE>
			</TERM>
			<LISTITEM>
			  <PARA>
				The name of a group from whom to revoke privileges.
			  </PARA>
			</LISTITEM>
		  </VARLISTENTRY>
		  
		  <VARLISTENTRY>
			<TERM>
			  <REPLACEABLE CLASS="PARAMETER">username</REPLACEABLE>
			</TERM>
			<LISTITEM>
			  <PARA>
				The name of a user from whom revoke privileges. Use the PUBLIC keyword
				to specify all users.
			  </PARA>
			</LISTITEM>
		  </VARLISTENTRY>
		  
		  <VARLISTENTRY>
			<TERM>
			  PUBLIC
			</TERM>
			<LISTITEM>
			  <PARA>
				Rescind the specified privilege(s) for all users.
			  </para>
			</LISTITEM>
		  </VARLISTENTRY>
		</VARIABLELIST>
d130 1
a130 1
	</REFSECT2>
d132 3
a134 162
	<REFSECT2 ID="R2-SQL-REVOKE-2">
	  <REFSECT2INFO>
		<DATE>1998-09-24</DATE>
	  </REFSECT2INFO>
	  <TITLE>
		Outputs
	  </TITLE>
	  <PARA>
		
		<VARIABLELIST>
		  <VARLISTENTRY>
			<TERM>
			  CHANGE
			</TERM>
			<LISTITEM>
			  <PARA>
				Message returned if successfully.
			  </para>
			</listitem>
		  </varlistentry>
		  
		  <VARLISTENTRY>
			<TERM>
			  ERROR
			</TERM>
			<LISTITEM>
			  <PARA>
				Message returned if object is not available or impossible
				to revoke privileges from a group or users.
			  </para>
			</listitem>
		  </varlistentry>		  
		</VARIABLELIST>
	  </para>
	</REFSECT2>
  </REFSYNOPSISDIV>
  
  <REFSECT1 ID="R1-SQL-REVOKE-1">
	<REFSECT1INFO>
	  <DATE>1998-09-24</DATE>
	</REFSECT1INFO>
	<TITLE>
	  Description
	</TITLE>
	<PARA>
	  REVOKE allows creator of an object to revoke permissions granted
	  before, from all users (via PUBLIC) or a certain user or group.
	</para>

	<REFSECT2 ID="R2-SQL-REVOKE-3">
	  <REFSECT2INFO>
		<DATE>1998-09-24</DATE>
	  </REFSECT2INFO>
	  <TITLE>
		Notes
	  </TITLE>
	  <PARA>
		Refer to psql \z command for further information about permissions 
		on existing objects:
		
		<programlisting>
		  Database    = lusitania
		  +------------------+---------------------------------------------+
		  |  Relation        |        Grant/Revoke Permissions             |
		  +------------------+---------------------------------------------+
		  | mytable          | {"=rw","miriam=arwR","group todos=rw"}      |
		  +------------------+---------------------------------------------+
		  Legend:
		  uname=arwR -- privileges granted to a user
		  group gname=arwR -- privileges granted to a GROUP
		  =arwR -- privileges granted to PUBLIC
		  
		  r -- SELECT
		  w -- UPDATE/DELETE
		  a -- INSERT
		  R -- RULE
		  arwR -- ALL
		</programlisting>
	  </para>
	  <tip>
		<para>
		  Currently, to create a GROUP you have to insert 
          data manually into table pg_group as:
		  <programlisting>          
			INSERT INTO pg_group VALUES ('todos');
			CREATE USER miriam IN GROUP todos;
		  </programlisting>
		</para>
	  </tip>

	</REFSECT2>
  </refsect1>

  <REFSECT1 ID="R1-SQL-REVOKE-2">
	<TITLE>
	  Usage
	</TITLE>
	<PARA>
	  <ProgramListing>
		-- revoke insert privilege from all users on table films:
		--
		REVOKE INSERT ON films FROM PUBLIC;
		
		-- revoke all privileges from user manuel on view kinds:
		--
		REVOKE ALL ON kinds FROM manuel;
	  </ProgramListing>
	</para>
  </REFSECT1>
  
  <REFSECT1 ID="R1-SQL-REVOKE-3">
	<TITLE>
	  Compatibility
	</TITLE>
	
	<REFSECT2 ID="R2-SQL-REVOKE-4">
	  <REFSECT2INFO>
		<DATE>1998-09-01</DATE>
	  </REFSECT2INFO>
	  <TITLE>
		SQL92
	  </TITLE>
	  <PARA>
		The SQL92 syntax for <command>REVOKE</command>
		has additional capabilities for rescinding
		privileges, including those on individual columns in tables:

		<variablelist>
		  <varlistentry>
			<term>
			  <synopsis>
				REVOKE { SELECT | DELETE | USAGE | ALL PRIVILEGES } [, ...]
				ON <replaceable class="parameter">object</replaceable>
				FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
				REVOKE { INSERT | UPDATE | REFERENCES } [, ...] [ ( <replaceable class="parameter">column</replaceable> [, ...] ) ]
				ON <replaceable class="parameter">object</replaceable>
				FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
			  </synopsis>
			</term>
			<listitem>
			  <para>
				Refer to the <command>GRANT</command> command for details on individual fields.
			  </para>
			</listitem>
		  </varlistentry>
		  
		  <varlistentry>
			<term>
			  <synopsis>
				REVOKE GRANT OPTION FOR <replaceable class="parameter">privilege</replaceable> [, ...]
				ON <replaceable class="parameter">object</replaceable>
				FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
			  </synopsis>
			</term>
			<listitem>
			  <para>
				Rescinds authority for a user to grant the specified privilege to others.
				Refer to the <command>GRANT</command> command for details on individual fields.
			  </para>
			</listitem>
		  </varlistentry>
		</variablelist>
d136 3
d140 1
a140 18
		The possible objects are:
		<simplelist>
		  <member>          [ TABLE ] table/view
		  </member>
		  <member>          CHARACTER SET character-set
		  </member>
		  <member>          COLLATION collation
		  </member>
		  <member>          TRANSLATION translation
		  </member>
		  <member>          DOMAIN domain
		  </member>
		</simplelist>
	  </para>
	  <para> 
		If user1 gives a privilege WITH GRANT OPTION to user2,
		and user2 gives it to user3 then user1 can revoke
		this privilege in cascade using the CASCADE keyword.
d142 3
d146 1
a146 4
		If user1 gives a privilege WITH GRANT OPTION to user2,
		and user2 gives it to user3 then if user1 try revoke
		this privilege it fails if he/she specify the RESTRICT
		keyword.
d148 262
a409 3
	</refsect2>
  </refsect1>
</REFENTRY>
@


1.4
log
@Minor cleanup in markup, especially in the Output section.
@
text
@d15 1
a15 1

d28 247
a274 215
<REFSECT2 ID="R2-SQL-REVOKE-1">
<REFSECT2INFO>
<DATE>1998-09-24</DATE>
</REFSECT2INFO>
<TITLE>
Inputs
</TITLE>
<PARA>

<VARIABLELIST>
<VARLISTENTRY>
<TERM>
<REPLACEABLE CLASS="PARAMETER">privilege</REPLACEABLE>
</TERM>
<LISTITEM>
<PARA>
         The possible privileges are:

<VARIABLELIST>
<VARLISTENTRY>
<TERM>
SELECT
</TERM>
<LISTITEM>
<PARA>
Privilege to access all of the columns of a specific
                        table/view.
</PARA>
</LISTITEM>
</VARLISTENTRY>

<VARLISTENTRY>
<TERM>
INSERT
</TERM>
<LISTITEM>
<PARA>
Privilege to insert data into all columns of a
                        specific table.

<VARLISTENTRY>
<TERM>
UPDATE
</TERM>
<LISTITEM>
<PARA>
Privilege to update all columns of a specific
                        table.

<VARLISTENTRY>
<TERM>
DELETE
</TERM>
<LISTITEM>
<PARA>
Privilege to delete rows from a specific table.

<VARLISTENTRY>
<TERM>
RULE
</TERM>
<LISTITEM>
<PARA>
Privilege to define rules on table/view.
(See <command>CREATE RULE</command>).

<VARLISTENTRY>
<TERM>
ALL
</TERM>
<LISTITEM>
<PARA>
Rescind all privileges.

</VARIABLELIST>

<VARLISTENTRY>
<TERM>
<REPLACEABLE CLASS="PARAMETER">object</REPLACEABLE>
</TERM>
<LISTITEM>
<PARA>
The name of an object from which to revoke access.
          The possible objects are:
<itemizedlist mark="bullet" spacing="compact">
<listitem>
<para>
table 

<listitem>
<para>
view 

<listitem>
<para>
sequence

<listitem>
<para>
index
</itemizedlist>

<VARLISTENTRY>
<TERM>
<REPLACEABLE CLASS="PARAMETER">group</REPLACEABLE>
</TERM>
<LISTITEM>
<PARA>
          The name of a group from whom to revoke privileges.
</PARA>
</LISTITEM>
</VARLISTENTRY>

<VARLISTENTRY>
<TERM>
<REPLACEABLE CLASS="PARAMETER">username</REPLACEABLE>
</TERM>
<LISTITEM>
<PARA>
The name of a user from whom revoke privileges. Use the PUBLIC keyword
to specify all users.
</PARA>
</LISTITEM>
</VARLISTENTRY>

<VARLISTENTRY>
<TERM>
PUBLIC
</TERM>
<LISTITEM>
<PARA>
Rescind the specified privilege(s) for all users.

</LISTITEM>
</VARLISTENTRY>
</VARIABLELIST>

</REFSECT2>

<REFSECT2 ID="R2-SQL-REVOKE-2">
<REFSECT2INFO>
<DATE>1998-09-24</DATE>
</REFSECT2INFO>
<TITLE>
Outputs
</TITLE>
<PARA>

<VARIABLELIST>
<VARLISTENTRY>
<TERM>
CHANGE
</TERM>
<LISTITEM>
<PARA>
          Message returned if successfully.

<VARLISTENTRY>
<TERM>
ERROR
</TERM>
<LISTITEM>
<PARA>
          Message returned if object is not available or impossible
          to revoke privileges from a group or users.

</VARIABLELIST>

</REFSECT2>
</REFSYNOPSISDIV>

<REFSECT1 ID="R1-SQL-REVOKE-1">
<REFSECT1INFO>
<DATE>1998-09-24</DATE>
</REFSECT1INFO>
<TITLE>
Description
</TITLE>
<PARA>
   REVOKE allows creator of an object to revoke permissions granted
   before, from all users (via PUBLIC) or a certain user or group.

<REFSECT2 ID="R2-SQL-REVOKE-3">
<REFSECT2INFO>
<DATE>1998-09-24</DATE>
</REFSECT2INFO>
<TITLE>
Notes
</TITLE>
<PARA>
   Refer to psql \z command for further information about permissions 
         on existing objects:

<programlisting>
   Database    = lusitania
   +------------------+---------------------------------------------+
   |  Relation        |        Grant/Revoke Permissions             |
   +------------------+---------------------------------------------+
   | mytable          | {"=rw","miriam=arwR","group todos=rw"}      |
   +------------------+---------------------------------------------+
   Legend:
         uname=arwR -- privileges granted to a user
   group gname=arwR -- privileges granted to a GROUP
              =arwR -- privileges granted to PUBLIC

                  r -- SELECT
                  w -- UPDATE/DELETE
                  a -- INSERT
                  R -- RULE
               arwR -- ALL
</programlisting>

<tip>
<para>
Currently, to create a GROUP you have to insert 
d276 108
a383 92
<programlisting>          
          INSERT INTO pg_group VALUES ('todos');
          CREATE USER miriam IN GROUP todos;
</programlisting>
</tip>

</REFSECT2>

<REFSECT1 ID="R1-SQL-REVOKE-2">
<TITLE>
Usage
</TITLE>
<PARA>
<ProgramListing>
-- revoke insert privilege from all users on table films:
--
REVOKE INSERT ON films FROM PUBLIC;

-- revoke all privileges from user manuel on view kinds:
--
REVOKE ALL ON kinds FROM manuel;
</ProgramListing>

</REFSECT1>

<REFSECT1 ID="R1-SQL-REVOKE-3">
<TITLE>
Compatibility
</TITLE>
<PARA>

<REFSECT2 ID="R2-SQL-REVOKE-4">
<REFSECT2INFO>
<DATE>1998-09-01</DATE>
</REFSECT2INFO>
<TITLE>
SQL92
</TITLE>
<PARA>
   The SQL92 syntax for <command>REVOKE</command>
 has additional capabilities for rescinding
privileges, including those on individual columns in tables:

<variablelist>
<varlistentry>
<term>
<synopsis>
REVOKE { SELECT | DELETE | USAGE | ALL PRIVILEGES } [, ...]
    ON <replaceable class="parameter">object</replaceable>
    FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
REVOKE { INSERT | UPDATE | REFERENCES } [, ...] [ ( <replaceable class="parameter">column</replaceable> [, ...] ) ]
    ON <replaceable class="parameter">object</replaceable>
    FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
</synopsis>
<listitem>
<para>
Refer to the <command>GRANT</command> command for details on individual fields.

<varlistentry>
<term>
<synopsis>
REVOKE GRANT OPTION FOR <replaceable class="parameter">privilege</replaceable> [, ...]
    ON <replaceable class="parameter">object</replaceable>
    FROM { PUBLIC | <replaceable class="parameter">username</replaceable> [, ...] } { RESTRICT | CASCADE }
</synopsis>
<listitem>
<para>
Rescinds authority for a user to grant the specified privilege to others.
Refer to the <command>GRANT</command> command for details on individual fields.

</variablelist>

<para>
      The possible objects are:
<simplelist>
<member>          [ TABLE ] table/view
<member>          CHARACTER SET character-set
<member>          COLLATION collation
<member>          TRANSLATION translation
<member>          DOMAIN domain
</simplelist>

<para> 
If user1 gives a privilege WITH GRANT OPTION to user2,
                    and user2 gives it to user3 then user1 can revoke
                    this privilege in cascade using the CASCADE keyword.

<para>
If user1 gives a privilege WITH GRANT OPTION to user2,
                    and user2 gives it to user3 then if user1 try revoke
                    this privilege it fails if he/she specify the RESTRICT
                    keyword.
@


1.3
log
@Cleanup markup and minor editing to prepare for first release.
@
text
@d112 17
a128 10
<simplelist>
<member>
              table 
<member>
              view 
<member>
              sequence 
<member>
              index  
</simplelist>
a178 8
<replaceable>status</replaceable>
</TERM>
<LISTITEM>
<PARA>

<VARIABLELIST>
<VARLISTENTRY>
<TERM>
a193 1
</VARIABLELIST>
@


1.2
log
@Minor fix to add paragraph break.
@
text
@d18 1
a18 1
<DATE>1998-09-01</DATE>
d30 1
a30 1
<DATE>1998-09-01</DATE>
d36 1
a36 1
</PARA>
d92 1
a92 1
(See the <command>CREATE RULE</command> statement).
d162 1
a162 1
<DATE>1998-04-15</DATE>
d168 8
a175 1
</PARA>
d196 1
d203 1
a203 1
<DATE>1998-09-01</DATE>
d214 1
a214 1
<DATE>1998-04-15</DATE>
d260 7
a266 7
   -- revoke insert privilege from all users on table films:
   --
   REVOKE INSERT ON films FROM PUBLIC;

   -- revoke all privileges from user manuel on view kinds:
   --
   REVOKE ALL ON kinds FROM manuel;
a275 1
</PARA>
d285 2
a286 1
   The SQL92 syntax for REVOKE has additional capabilities for rescinding
a338 20

<!--
<REPLACEABLE CLASS="PARAMETER">
</REPLACEABLE>
<ReturnValue></ReturnValue>
<PARA>
</PARA>
<VARIABLELIST>
<VARLISTENTRY>
<TERM>&bull;
</TERM>
<LISTITEM>
<PARA>
</PARA>
</LISTITEM>
</VARLISTENTRY>
</VARIABLELIST>
<PARA>
</PARA>
-->
@


1.1
log
@Add new files from Oliver and Thomas.
@
text
@d325 1
@
