{"Entry":{"collection":"sql","key":"grant","name":"GRANT","aliases":["grant"],"metadata":{"aliases":["grant"],"changed_in":["7.2","7.3","7.4","8.0","8.1","8.2","8.3","8.4","9.0","9.2","9.5","10","11","14","15","16","17"],"changes":[{"from":"6.4","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","usage","compatibility"],"removed":[]},"status":"changed","synopsis":null,"to":"6.5"},{"from":"6.5","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description"],"removed":[]},"status":"changed","synopsis":null,"to":"7.0"},{"from":"7.0","purpose_changed":false,"renamed":{"from_file":"sql-grant.htm","to_file":"sql-grant.html"},"sections":{"added":[],"changed":["description","compatibility"],"removed":[]},"status":"changed","synopsis":null,"to":"7.1"},{"from":"7.1","purpose_changed":true,"renamed":null,"sections":{"added":["notes","examples","see_also"],"changed":["description","compatibility"],"removed":["usage"]},"status":"changed","synopsis":{"added":["GRANT { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER } [,...] | ALL [ PRIVILEGES ] }","ON [ TABLE ] objectname [, ...]","TO { username | GROUP groupname | PUBLIC } [, ...]"],"removed":["GRANT privilege [, ...] ON object [, ...]","TO { PUBLIC | GROUP group | username }"]},"to":"7.2"},{"from":"7.2","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes"],"removed":[]},"status":"changed","synopsis":{"added":["ON [ TABLE ] tablename [, ...]","GRANT { { CREATE | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }","ON DATABASE dbname [, ...]","TO { username | GROUP groupname | PUBLIC } [, ...]","GRANT { EXECUTE | ALL [ PRIVILEGES ] }","ON FUNCTION funcname ([type, ...]) [, ...]","TO { username | GROUP groupname | PUBLIC } [, ...]","GRANT { USAGE | ALL [ PRIVILEGES ] }","ON LANGUAGE langname [, ...]","TO { username | GROUP groupname | PUBLIC } [, ...]","GRANT { { CREATE | USAGE } [,...] | ALL [ PRIVILEGES ] }","ON SCHEMA schemaname [, ...]","TO { username | GROUP groupname | PUBLIC } [, ...]"],"removed":["ON [ TABLE ] objectname [, ...]"]},"to":"7.3"},{"from":"7.3","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]"],"removed":[]},"to":"7.4"},{"from":"7.4","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","examples","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["GRANT { CREATE | ALL [ PRIVILEGES ] }","ON TABLESPACE tablespacename [, ...]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]"],"removed":[]},"to":"8.0"},{"from":"8.0","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","examples"],"removed":[]},"status":"changed","synopsis":{"added":["ON FUNCTION funcname ( [ [ argmode ] [ argname ] argtype [, ...] ] ) [, ...]","GRANT role [, ...] TO username [, ...] [ WITH ADMIN OPTION ]"],"removed":["ON FUNCTION funcname ([type, ...]) [, ...]"]},"to":"8.1"},{"from":"8.1","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["GRANT { { USAGE | SELECT | UPDATE }","[,...] | ALL [ PRIVILEGES ] }","ON SEQUENCE sequencename [, ...]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [,...] | ALL [ PRIVILEGES ] }"],"removed":["GRANT { { SELECT | INSERT | UPDATE | DELETE | RULE | REFERENCES | TRIGGER }"]},"to":"8.2"},{"from":"8.2","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT role [, ...] TO rolename [, ...] [ WITH ADMIN OPTION ]"],"removed":["TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { username | GROUP groupname | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT role [, ...] TO username [, ...] [ WITH ADMIN OPTION ]"]},"to":"8.3"},{"from":"8.3","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER }","[,...] | ALL [ PRIVILEGES ] }","ON [ TABLE ] tablename [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column [, ...] )","[,...] | ALL [ PRIVILEGES ] ( column [, ...] ) }","ON DATABASE dbname [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT { USAGE | ALL [ PRIVILEGES ] }","ON FOREIGN DATA WRAPPER fdwname [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT { USAGE | ALL [ PRIVILEGES ] }","ON FOREIGN SERVER servername [, ...]"],"removed":[]},"to":"8.4"},{"from":"8.4","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","see_also"],"removed":[]},"status":"changed","synopsis":{"added":["ON { [ TABLE ] table_name [, ...]","| ALL TABLES IN SCHEMA schema_name [, ...] }","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON [ TABLE ] table_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON { SEQUENCE sequence_name [, ...]","| ALL SEQUENCES IN SCHEMA schema_name [, ...] }","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON DATABASE database_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON FOREIGN DATA WRAPPER fdw_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON FOREIGN SERVER server_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON { FUNCTION function_name ( [ [ argmode ] [ arg_name ] arg_type [, ...] ] ) [, ...]","| ALL FUNCTIONS IN SCHEMA schema_name [, ...] }","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON LANGUAGE lang_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT { { SELECT | UPDATE } [,...] | ALL [ PRIVILEGES ] }","ON LARGE OBJECT loid [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON SCHEMA schema_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON TABLESPACE tablespace_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT role_name [, ...] TO role_name [, ...] [ WITH ADMIN OPTION ]"],"removed":["ON [ TABLE ] tablename [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON [ TABLE ] tablename [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON SEQUENCE sequencename [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON DATABASE dbname [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON FOREIGN DATA WRAPPER fdwname [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON FOREIGN SERVER servername [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON FUNCTION funcname ( [ [ argmode ] [ argname ] argtype [, ...] ] ) [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON LANGUAGE langname [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON SCHEMA schemaname [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","ON TABLESPACE tablespacename [, ...]","TO { [ GROUP ] rolename | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT role [, ...] TO rolename [, ...] [ WITH ADMIN OPTION ]"]},"to":"9.0"},{"from":"9.0","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description"],"removed":[]},"status":"changed","synopsis":null,"to":"9.1"},{"from":"9.1","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["GRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column_name [, ...] )","[, ...] | ALL [ PRIVILEGES ] ( column_name [, ...] ) }","ON DATABASE database_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT { USAGE | ALL [ PRIVILEGES ] }","ON DOMAIN domain_name [, ...]","GRANT { USAGE | ALL [ PRIVILEGES ] }","ON TYPE type_name [, ...]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT role_name [, ...] TO role_name [, ...] [ WITH ADMIN OPTION ]"],"removed":["GRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column [, ...] )","[, ...] | ALL [ PRIVILEGES ] ( column [, ...] ) }"]},"to":"9.2"},{"from":"9.2","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description"],"removed":[]},"status":"changed","synopsis":null,"to":"9.3"},{"from":"9.4","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","GRANT role_name [, ...] TO role_specification [, ...]","[ GRANTED BY role_specification ]","[ GROUP ] role_name","| PUBLIC","| CURRENT_USER","| SESSION_USER"],"removed":["TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","TO { [ GROUP ] role_name | PUBLIC } [, ...] [ WITH GRANT OPTION ]","GRANT role_name [, ...] TO role_name [, ...] [ WITH ADMIN OPTION ]"]},"to":"9.5"},{"from":"9.5","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","compatibility"],"removed":[]},"status":"changed","synopsis":null,"to":"9.6"},{"from":"9.6","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["ON { FUNCTION function_name [ ( [ [ argmode ] [ arg_name ] arg_type [, ...] ] ) ] [, ...]"],"removed":[]},"to":"10"},{"from":"10","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description"],"removed":[]},"status":"changed","synopsis":{"added":["ON { { FUNCTION | PROCEDURE | ROUTINE } routine_name [ ( [ [ argmode ] [ arg_name ] arg_type [, ...] ] ) ] [, ...]","| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schema_name [, ...] }"],"removed":["ON { FUNCTION function_name [ ( [ [ argmode ] [ arg_name ] arg_type [, ...] ] ) ] [, ...]"]},"to":"11"},{"from":"11","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes"],"removed":[]},"status":"changed","synopsis":null,"to":"12"},{"from":"13","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["[ GRANTED BY role_specification ]","[ GRANTED BY role_specification ]","[ GRANTED BY role_specification ]","[ GRANTED BY role_specification ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","[ GRANTED BY role_specification ]","[ GRANTED BY role_specification ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","[ GRANTED BY role_specification ]","[ GRANTED BY role_specification ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","[ GRANTED BY role_specification ]","[ GRANTED BY role_specification ]","[ GRANTED BY role_specification ]","[ GRANTED BY role_specification ]","TO role_specification [, ...] [ WITH GRANT OPTION ]","[ GRANTED BY role_specification ]","| CURRENT_ROLE","| CURRENT_USER"],"removed":[]},"to":"14"},{"from":"14","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","compatibility"],"removed":[]},"status":"changed","synopsis":{"added":["GRANT { { SET | ALTER SYSTEM } [, ... ] | ALL [ PRIVILEGES ] }","ON PARAMETER configuration_parameter [, ...]","TO role_specification [, ...] [ WITH GRANT OPTION ]","[ GRANTED BY role_specification ]","GRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }"],"removed":[]},"to":"15"},{"from":"15","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes"],"removed":[]},"status":"changed","synopsis":{"added":["[ WITH { ADMIN | INHERIT | SET } { OPTION | TRUE | FALSE } ]"],"removed":[]},"to":"16"},{"from":"16","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes"],"removed":[]},"status":"changed","synopsis":{"added":["GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }"],"removed":[]},"to":"17"},{"from":"18","purpose_changed":false,"renamed":null,"sections":{"added":[],"changed":["description","notes"],"removed":[]},"status":"changed","synopsis":null,"to":"19"}],"content_hash":"0e990cb763258741d86554964d0f6f938f0b1f2268d4678624c938cef48a38c1","editorial":{},"first_version":"6.4","group":"role","imported_at":"2026-09-30T17:43:37.904383+08:00","last_version":"20","name":"GRANT","object":"","position":5000,"present_in":["6.4","6.5","7.0","7.1","7.2","7.3","7.4","8.0","8.1","8.2","8.3","8.4","9.0","9.1","9.2","9.3","9.4","9.5","9.6","10","11","12","13","14","15","16","17","18","19","20"],"purpose":"define access privileges","purpose_zh":"","related":["revoke","alter-default-privileges"],"slug":"grant","source_rev":"a709ab85","synopsis":"GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }\n[, ...] | ALL [ PRIVILEGES ] }\nON { [ TABLE ] table_name [, ...]\n| ALL TABLES IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column_name [, ...] )\n[, ...] | ALL [ PRIVILEGES ] ( column_name [, ...] ) }\nON [ TABLE ] table_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { USAGE | SELECT | UPDATE }\n[, ...] | ALL [ PRIVILEGES ] }\nON { SEQUENCE sequence_name [, ...]\n| ALL SEQUENCES IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\nON DATABASE database_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON DOMAIN domain_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN DATA WRAPPER fdw_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN SERVER server_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { EXECUTE | ALL [ PRIVILEGES ] }\nON { { FUNCTION | PROCEDURE | ROUTINE } routine_name [ ( [ [ argmode ] [ arg_name ] arg_type [, ...] ] ) ] [, ...]\n| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON LANGUAGE lang_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\nON LARGE OBJECT loid [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SET | ALTER SYSTEM } [, ... ] | ALL [ PRIVILEGES ] }\nON PARAMETER configuration_parameter [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\nON SCHEMA schema_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { CREATE | ALL [ PRIVILEGES ] }\nON TABLESPACE tablespace_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON TYPE type_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT role_name [, ...] TO role_specification [, ...]\n[ WITH { ADMIN | INHERIT | SET } { OPTION | TRUE | FALSE } ]\n[ GRANTED BY role_specification ]\n\nwhere role_specification can be:\n\n[ GROUP ] role_name\n| PUBLIC\n| CURRENT_ROLE\n| CURRENT_USER\n| SESSION_USER","verb":"GRANT"}},"Definition":{"Collection":"sql","Key":"grant","SourceDatabase":"center","Version":"18","SourceTable":"sqlcmd","SourceKey":"grant","SourceRevision":"a709ab85","Facts":{"anchor":"SQL-GRANT","file":"sql-grant.html","lang":"en","name":"GRANT","purpose":"define access privileges","purpose_zh":"","related":["revoke","alter-default-privileges"],"sections":[{"html":"\u003cp\u003eThe \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e command has two basic variants: one that grants privileges on a database object (table, column, view, foreign table, sequence, database, foreign-data wrapper, foreign server, function, procedure, procedural language, large object, configuration parameter, schema, tablespace, or type), and one that grants membership in a role. These variants are similar in many ways, but they are different enough to be described separately.\u003c/p\u003e\u003cdiv class=\"refsect2\"\u003e\u003ch3\u003eGRANT on Database Objects\u003c/h3\u003e\u003cp\u003eThis variant of the \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e command gives specific privileges on a database object to one or more roles. These privileges are added to those already granted, if any.\u003c/p\u003e\u003cp\u003eThe key word \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e indicates that the privileges are to be granted to all roles, including those that might be created later. \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e can be thought of as an implicitly defined group that always includes all roles. Any particular role will have the sum of privileges granted directly to it, privileges granted to any role it is presently a member of, and privileges granted to \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eIf \u003ccode class=\"literal\"\u003eWITH GRANT OPTION\u003c/code\u003e is specified, the recipient of the privilege can in turn grant it to others. Without a grant option, the recipient cannot do that. Grant options cannot be granted to \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eIf \u003ccode class=\"literal\"\u003eGRANTED BY\u003c/code\u003e is specified, the specified grantor must be the current user. This clause is currently present in this form only for SQL compatibility.\u003c/p\u003e\u003cp\u003eThere is no need to grant privileges to the owner of an object (usually the user that created it), as the owner has all privileges by default. (The owner could, however, choose to revoke some of their own privileges for safety.)\u003c/p\u003e\u003cp\u003eThe right to drop an object, or to alter its definition in any way, is not treated as a grantable privilege; it is inherent in the owner, and cannot be granted or revoked. (However, a similar effect can be obtained by granting or revoking membership in the role that owns the object; see below.) The owner implicitly has all grant options for the object, too.\u003c/p\u003e\u003cp\u003eThe possible privileges are:\u003c/p\u003e\u003cdiv class=\"variablelist\"\u003e\u003cdl class=\"variablelist\"\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eSELECT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eINSERT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eUPDATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eDELETE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eTRUNCATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eREFERENCES\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eTRIGGER\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eCREATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eCONNECT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eTEMPORARY\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eEXECUTE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eUSAGE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eSET\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eALTER SYSTEM\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eMAINTAIN\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003eSpecific types of privileges, as defined in \u003ca href=\"/docs/18/ddl-priv.html\" title=\"5.8. Privileges\"\u003eSection 5.8\u003c/a\u003e.\u003c/p\u003e\u003c/dd\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eTEMP\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003eAlternative spelling for \u003ccode class=\"literal\"\u003eTEMPORARY\u003c/code\u003e.\u003c/p\u003e\u003c/dd\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eALL PRIVILEGES\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003eGrant all of the privileges available for the object's type. The \u003ccode class=\"literal\"\u003ePRIVILEGES\u003c/code\u003e key word is optional in \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e, though it is required by strict SQL.\u003c/p\u003e\u003c/dd\u003e\u003c/dl\u003e\u003c/div\u003e\u003cp\u003eThe \u003ccode class=\"literal\"\u003eFUNCTION\u003c/code\u003e syntax works for plain functions, aggregate functions, and window functions, but not for procedures; use \u003ccode class=\"literal\"\u003ePROCEDURE\u003c/code\u003e for those. Alternatively, use \u003ccode class=\"literal\"\u003eROUTINE\u003c/code\u003e to refer to a function, aggregate function, window function, or procedure regardless of its precise type.\u003c/p\u003e\u003cp\u003eThere is also an option to grant privileges on all objects of the same type within one or more schemas. This functionality is currently supported only for tables, sequences, functions, and procedures. \u003ccode class=\"literal\"\u003eALL TABLES\u003c/code\u003e also affects views and foreign tables, just like the specific-object \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e command. \u003ccode class=\"literal\"\u003eALL FUNCTIONS\u003c/code\u003e also affects aggregate and window functions, but not procedures, again just like the specific-object \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e command. Use \u003ccode class=\"literal\"\u003eALL ROUTINES\u003c/code\u003e to include procedures.\u003c/p\u003e\u003c/div\u003e\u003cdiv class=\"refsect2\"\u003e\u003ch3\u003eGRANT on Roles\u003c/h3\u003e\u003cp\u003eThis variant of the \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e command grants membership in a role to one or more other roles, and the modification of membership options \u003ccode class=\"literal\"\u003eSET\u003c/code\u003e, \u003ccode class=\"literal\"\u003eINHERIT\u003c/code\u003e, and \u003ccode class=\"literal\"\u003eADMIN\u003c/code\u003e; see \u003ca href=\"/docs/18/role-membership.html\" title=\"21.3. Role Membership\"\u003eSection 21.3\u003c/a\u003e for details. Membership in a role is significant because it potentially allows access to the privileges granted to a role to each of its members, and potentially also the ability to make changes to the role itself. However, the actual permissions conferred depend on the options associated with the grant. To modify that options of an existing membership, simply specify the membership with updated option values.\u003c/p\u003e\u003cp\u003eEach of the options described below can be set to either \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e or \u003ccode class=\"literal\"\u003eFALSE\u003c/code\u003e. The keyword \u003ccode class=\"literal\"\u003eOPTION\u003c/code\u003e is accepted as a synonym for \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e, so that \u003ccode class=\"literal\"\u003eWITH ADMIN OPTION\u003c/code\u003e is a synonym for \u003ccode class=\"literal\"\u003eWITH ADMIN TRUE\u003c/code\u003e. When altering an existing membership the omission of an option results in the current value being retained.\u003c/p\u003e\u003cp\u003eThe \u003ccode class=\"literal\"\u003eADMIN\u003c/code\u003e option allows the member to in turn grant membership in the role to others, and revoke membership in the role as well. Without the admin option, ordinary users cannot do that. A role is not considered to hold \u003ccode class=\"literal\"\u003eWITH ADMIN OPTION\u003c/code\u003e on itself. Database superusers can grant or revoke membership in any role to anyone. This option defaults to \u003ccode class=\"literal\"\u003eFALSE\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eThe \u003ccode class=\"literal\"\u003eINHERIT\u003c/code\u003e option controls the inheritance status of the new membership; see \u003ca href=\"/docs/18/role-membership.html\" title=\"21.3. Role Membership\"\u003eSection 21.3\u003c/a\u003e for details on inheritance. If it is set to \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e, it causes the new member to inherit from the granted role. If set to \u003ccode class=\"literal\"\u003eFALSE\u003c/code\u003e, the new member does not inherit. If unspecified when creating a new role membership, this defaults to the inheritance attribute of the new member.\u003c/p\u003e\u003cp\u003eThe \u003ccode class=\"literal\"\u003eSET\u003c/code\u003e option, if it is set to \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e, allows the member to change to the granted role using the \u003ca href=\"/docs/18/sql-set-role.html\" title=\"SET ROLE\"\u003e\u003ccode class=\"command\"\u003eSET ROLE\u003c/code\u003e\u003c/a\u003e command. If a role is an indirect member of another role, it can use \u003ccode class=\"literal\"\u003eSET ROLE\u003c/code\u003e to change to that role only if there is a chain of grants each of which has \u003ccode class=\"literal\"\u003eSET TRUE\u003c/code\u003e. This option defaults to \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e.\u003c/p\u003e\u003cp\u003eTo create an object owned by another role or give ownership of an existing object to another role, you must have the ability to \u003ccode class=\"literal\"\u003eSET ROLE\u003c/code\u003e to that role; otherwise, commands such as \u003ccode class=\"literal\"\u003eALTER ... OWNER TO\u003c/code\u003e or \u003ccode class=\"literal\"\u003eCREATE DATABASE ... OWNER\u003c/code\u003e will fail. However, a user who inherits the privileges of a role but does not have the ability to \u003ccode class=\"literal\"\u003eSET ROLE\u003c/code\u003e to that role may be able to obtain full access to the role by manipulating existing objects owned by that role (e.g. they could redefine an existing function to act as a Trojan horse). Therefore, if a role's privileges are to be inherited but should not be accessible via \u003ccode class=\"literal\"\u003eSET ROLE\u003c/code\u003e, it should not own any SQL objects.\u003c/p\u003e\u003cp\u003eIf \u003ccode class=\"literal\"\u003eGRANTED BY\u003c/code\u003e is specified, the grant is recorded as having been done by the specified role. A user can only attribute a grant to another role if they possess the privileges of that role. The role recorded as the grantor must have \u003ccode class=\"literal\"\u003eADMIN OPTION\u003c/code\u003e on the target role, unless it is the bootstrap superuser. When a grant is recorded as having a grantor other than the bootstrap superuser, it depends on the grantor continuing to possess \u003ccode class=\"literal\"\u003eADMIN OPTION\u003c/code\u003e on the role; so, if \u003ccode class=\"literal\"\u003eADMIN OPTION\u003c/code\u003e is revoked, dependent grants must be revoked as well.\u003c/p\u003e\u003cp\u003eUnlike the case with privileges, membership in a role cannot be granted to \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e. Note also that this form of the command does not allow the noise word \u003ccode class=\"literal\"\u003eGROUP\u003c/code\u003e in \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e.\u003c/p\u003e\u003c/div\u003e","key":"description","title":"Description"},{"html":"\u003cp\u003eThe \u003ca href=\"/docs/18/sql-revoke.html\" title=\"REVOKE\"\u003e\u003ccode class=\"command\"\u003eREVOKE\u003c/code\u003e\u003c/a\u003e command is used to revoke access privileges.\u003c/p\u003e\u003cp\u003eSince \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 8.1, the concepts of users and groups have been unified into a single kind of entity called a role. It is therefore no longer necessary to use the keyword \u003ccode class=\"literal\"\u003eGROUP\u003c/code\u003e to identify whether a grantee is a user or a group. \u003ccode class=\"literal\"\u003eGROUP\u003c/code\u003e is still allowed in the command, but it is a noise word.\u003c/p\u003e\u003cp\u003eA user may perform \u003ccode class=\"command\"\u003eSELECT\u003c/code\u003e, \u003ccode class=\"command\"\u003eINSERT\u003c/code\u003e, etc. on a column if they hold that privilege for either the specific column or its whole table. Granting the privilege at the table level and then revoking it for one column will not do what one might wish: the table-level grant is unaffected by a column-level operation.\u003c/p\u003e\u003cp\u003eWhen a non-owner of an object attempts to \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e privileges on the object, the command will fail outright if the user has no privileges whatsoever on the object. As long as some privilege is available, the command will proceed, but it will grant only those privileges for which the user has grant options. The \u003ccode class=\"command\"\u003eGRANT ALL PRIVILEGES\u003c/code\u003e forms will issue a warning message if no grant options are held, while the other forms will issue a warning if grant options for any of the privileges specifically named in the command are not held. (In principle these statements apply to the object owner as well, but since the owner is always treated as holding all grant options, the cases can never occur.)\u003c/p\u003e\u003cp\u003eIt should be noted that database superusers can access all objects regardless of object privilege settings. This is comparable to the rights of \u003ccode class=\"literal\"\u003eroot\u003c/code\u003e in a Unix system. As with \u003ccode class=\"literal\"\u003eroot\u003c/code\u003e, it's unwise to operate as a superuser except when absolutely necessary.\u003c/p\u003e\u003cp\u003eIf a superuser chooses to issue a \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e or \u003ccode class=\"command\"\u003eREVOKE\u003c/code\u003e command, the command is performed as though it were issued by the owner of the affected object. In particular, privileges granted via such a command will appear to have been granted by the object owner. (For role membership, the membership appears to have been granted by the bootstrap superuser.)\u003c/p\u003e\u003cp\u003e\u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e and \u003ccode class=\"command\"\u003eREVOKE\u003c/code\u003e can also be done by a role that is not the owner of the affected object, but is a member of the role that owns the object, or is a member of a role that holds privileges \u003ccode class=\"literal\"\u003eWITH GRANT OPTION\u003c/code\u003e on the object. In this case the privileges will be recorded as having been granted by the role that actually owns the object or holds the privileges \u003ccode class=\"literal\"\u003eWITH GRANT OPTION\u003c/code\u003e. For example, if table \u003ccode class=\"literal\"\u003et1\u003c/code\u003e is owned by role \u003ccode class=\"literal\"\u003eg1\u003c/code\u003e, of which role \u003ccode class=\"literal\"\u003eu1\u003c/code\u003e is a member, then \u003ccode class=\"literal\"\u003eu1\u003c/code\u003e can grant privileges on \u003ccode class=\"literal\"\u003et1\u003c/code\u003e to \u003ccode class=\"literal\"\u003eu2\u003c/code\u003e, but those privileges will appear to have been granted directly by \u003ccode class=\"literal\"\u003eg1\u003c/code\u003e. Any other member of role \u003ccode class=\"literal\"\u003eg1\u003c/code\u003e could revoke them later.\u003c/p\u003e\u003cp\u003eIf the role executing \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e holds the required privileges indirectly via more than one role membership path, it is unspecified which containing role will be recorded as having done the grant. In such cases it is best practice to use \u003ccode class=\"command\"\u003eSET ROLE\u003c/code\u003e to become the specific role you want to do the \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e as.\u003c/p\u003e\u003cp\u003eGranting permission on a table does not automatically extend permissions to any sequences used by the table, including sequences tied to \u003ccode class=\"type\"\u003eSERIAL\u003c/code\u003e columns. Permissions on sequences must be set separately.\u003c/p\u003e\u003cp\u003eSee \u003ca href=\"/docs/18/ddl-priv.html\" title=\"5.8. Privileges\"\u003eSection 5.8\u003c/a\u003e for more information about specific privilege types, as well as how to inspect objects' privileges.\u003c/p\u003e","key":"notes","title":"Notes"},{"html":"\u003cp\u003eGrant insert privilege to all users on table \u003ccode class=\"literal\"\u003efilms\u003c/code\u003e:\u003c/p\u003e\u003cpre class=\"programlisting\"\u003eGRANT INSERT ON films TO PUBLIC;\n\u003c/pre\u003e\u003cp\u003eGrant all available privileges to user \u003ccode class=\"literal\"\u003emanuel\u003c/code\u003e on view \u003ccode class=\"literal\"\u003ekinds\u003c/code\u003e:\u003c/p\u003e\u003cpre class=\"programlisting\"\u003eGRANT ALL PRIVILEGES ON kinds TO manuel;\n\u003c/pre\u003e\u003cp\u003eNote that while the above will indeed grant all privileges if executed by a superuser or the owner of \u003ccode class=\"literal\"\u003ekinds\u003c/code\u003e, when executed by someone else it will only grant those permissions for which the someone else has grant options.\u003c/p\u003e\u003cp\u003eGrant membership in role \u003ccode class=\"literal\"\u003eadmins\u003c/code\u003e to user \u003ccode class=\"literal\"\u003ejoe\u003c/code\u003e:\u003c/p\u003e\u003cpre class=\"programlisting\"\u003eGRANT admins TO joe;\n\u003c/pre\u003e","key":"examples","title":"Examples"},{"html":"\u003cp\u003eAccording to the SQL standard, the \u003ccode class=\"literal\"\u003ePRIVILEGES\u003c/code\u003e key word in \u003ccode class=\"literal\"\u003eALL PRIVILEGES\u003c/code\u003e is required. The SQL standard does not support setting the privileges on more than one object per command.\u003c/p\u003e\u003cp\u003e\u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e allows an object owner to revoke their own ordinary privileges: for example, a table owner can make the table read-only to themselves by revoking their own \u003ccode class=\"literal\"\u003eINSERT\u003c/code\u003e, \u003ccode class=\"literal\"\u003eUPDATE\u003c/code\u003e, \u003ccode class=\"literal\"\u003eDELETE\u003c/code\u003e, and \u003ccode class=\"literal\"\u003eTRUNCATE\u003c/code\u003e privileges. This is not possible according to the SQL standard. The reason is that \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e treats the owner's privileges as having been granted by the owner to themselves; therefore they can revoke them too. In the SQL standard, the owner's privileges are granted by an assumed entity \u003cspan class=\"quote\"\u003e“\u003cspan class=\"quote\"\u003e_SYSTEM\u003c/span\u003e”\u003c/span\u003e. Not being \u003cspan class=\"quote\"\u003e“\u003cspan class=\"quote\"\u003e_SYSTEM\u003c/span\u003e”\u003c/span\u003e, the owner cannot revoke these rights.\u003c/p\u003e\u003cp\u003eAccording to the SQL standard, grant options can be granted to \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e; PostgreSQL only supports granting grant options to roles.\u003c/p\u003e\u003cp\u003eThe SQL standard allows the \u003ccode class=\"literal\"\u003eGRANTED BY\u003c/code\u003e option to specify only \u003ccode class=\"literal\"\u003eCURRENT_USER\u003c/code\u003e or \u003ccode class=\"literal\"\u003eCURRENT_ROLE\u003c/code\u003e. The other variants are PostgreSQL extensions.\u003c/p\u003e\u003cp\u003eThe SQL standard provides for a \u003ccode class=\"literal\"\u003eUSAGE\u003c/code\u003e privilege on other kinds of objects: character sets, collations, translations.\u003c/p\u003e\u003cp\u003eIn the SQL standard, sequences only have a \u003ccode class=\"literal\"\u003eUSAGE\u003c/code\u003e privilege, which controls the use of the \u003ccode class=\"literal\"\u003eNEXT VALUE FOR\u003c/code\u003e expression, which is equivalent to the function \u003ccode class=\"function\"\u003enextval\u003c/code\u003e in PostgreSQL. The sequence privileges \u003ccode class=\"literal\"\u003eSELECT\u003c/code\u003e and \u003ccode class=\"literal\"\u003eUPDATE\u003c/code\u003e are PostgreSQL extensions. The application of the sequence \u003ccode class=\"literal\"\u003eUSAGE\u003c/code\u003e privilege to the \u003ccode class=\"literal\"\u003ecurrval\u003c/code\u003e function is also a PostgreSQL extension (as is the function itself).\u003c/p\u003e\u003cp\u003ePrivileges on databases, tablespaces, schemas, languages, and configuration parameters are \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e extensions.\u003c/p\u003e","key":"compatibility","title":"Compatibility"},{"html":"\u003cspan class=\"simplelist\"\u003e\u003ca href=\"/wiki/sql/revoke/?v=18\" title=\"REVOKE\"\u003e\u003cspan class=\"refentrytitle\"\u003eREVOKE\u003c/span\u003e\u003c/a\u003e, \u003ca href=\"/wiki/sql/alter-default-privileges/?v=18\" title=\"ALTER DEFAULT PRIVILEGES\"\u003e\u003cspan class=\"refentrytitle\"\u003eALTER DEFAULT PRIVILEGES\u003c/span\u003e\u003c/a\u003e\u003c/span\u003e","key":"see_also","title":"See Also"}],"sections_same_as":"","slug":"18","synopsis_html":"GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }\n    [, ...] | ALL [ PRIVILEGES ] }\n    ON { [ TABLE ] \u003cem class=\"replaceable\"\u003e\u003ccode\u003etable_name\u003c/code\u003e\u003c/em\u003e [, ...]\n         | ALL TABLES IN SCHEMA \u003cem class=\"replaceable\"\u003e\u003ccode\u003eschema_name\u003c/code\u003e\u003c/em\u003e [, ...] }\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( \u003cem class=\"replaceable\"\u003e\u003ccode\u003ecolumn_name\u003c/code\u003e\u003c/em\u003e [, ...] )\n    [, ...] | ALL [ PRIVILEGES ] ( \u003cem class=\"replaceable\"\u003e\u003ccode\u003ecolumn_name\u003c/code\u003e\u003c/em\u003e [, ...] ) }\n    ON [ TABLE ] \u003cem class=\"replaceable\"\u003e\u003ccode\u003etable_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { USAGE | SELECT | UPDATE }\n    [, ...] | ALL [ PRIVILEGES ] }\n    ON { SEQUENCE \u003cem class=\"replaceable\"\u003e\u003ccode\u003esequence_name\u003c/code\u003e\u003c/em\u003e [, ...]\n         | ALL SEQUENCES IN SCHEMA \u003cem class=\"replaceable\"\u003e\u003ccode\u003eschema_name\u003c/code\u003e\u003c/em\u003e [, ...] }\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\n    ON DATABASE \u003cem class=\"replaceable\"\u003e\u003ccode\u003edatabase_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON DOMAIN \u003cem class=\"replaceable\"\u003e\u003ccode\u003edomain_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON FOREIGN DATA WRAPPER \u003cem class=\"replaceable\"\u003e\u003ccode\u003efdw_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON FOREIGN SERVER \u003cem class=\"replaceable\"\u003e\u003ccode\u003eserver_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { EXECUTE | ALL [ PRIVILEGES ] }\n    ON { { FUNCTION | PROCEDURE | ROUTINE } \u003cem class=\"replaceable\"\u003e\u003ccode\u003eroutine_name\u003c/code\u003e\u003c/em\u003e [ ( [ [ \u003cem class=\"replaceable\"\u003e\u003ccode\u003eargmode\u003c/code\u003e\u003c/em\u003e ] [ \u003cem class=\"replaceable\"\u003e\u003ccode\u003earg_name\u003c/code\u003e\u003c/em\u003e ] \u003cem class=\"replaceable\"\u003e\u003ccode\u003earg_type\u003c/code\u003e\u003c/em\u003e [, ...] ] ) ] [, ...]\n         | ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA \u003cem class=\"replaceable\"\u003e\u003ccode\u003eschema_name\u003c/code\u003e\u003c/em\u003e [, ...] }\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON LANGUAGE \u003cem class=\"replaceable\"\u003e\u003ccode\u003elang_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\n    ON LARGE OBJECT \u003cem class=\"replaceable\"\u003e\u003ccode\u003eloid\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { SET | ALTER SYSTEM } [, ... ] | ALL [ PRIVILEGES ] }\n    ON PARAMETER \u003cem class=\"replaceable\"\u003e\u003ccode\u003econfiguration_parameter\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\n    ON SCHEMA \u003cem class=\"replaceable\"\u003e\u003ccode\u003eschema_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { CREATE | ALL [ PRIVILEGES ] }\n    ON TABLESPACE \u003cem class=\"replaceable\"\u003e\u003ccode\u003etablespace_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON TYPE \u003cem class=\"replaceable\"\u003e\u003ccode\u003etype_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_name\u003c/code\u003e\u003c/em\u003e [, ...] TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...]\n    [ WITH { ADMIN | INHERIT | SET } { OPTION | TRUE | FALSE } ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\n\u003cspan class=\"phrase\"\u003ewhere \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e can be:\u003c/span\u003e\n\n    [ GROUP ] \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_name\u003c/code\u003e\u003c/em\u003e\n  | PUBLIC\n  | CURRENT_ROLE\n  | CURRENT_USER\n  | SESSION_USER","synopsis_text":"GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }\n[, ...] | ALL [ PRIVILEGES ] }\nON { [ TABLE ] table_name [, ...]\n| ALL TABLES IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column_name [, ...] )\n[, ...] | ALL [ PRIVILEGES ] ( column_name [, ...] ) }\nON [ TABLE ] table_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { USAGE | SELECT | UPDATE }\n[, ...] | ALL [ PRIVILEGES ] }\nON { SEQUENCE sequence_name [, ...]\n| ALL SEQUENCES IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\nON DATABASE database_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON DOMAIN domain_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN DATA WRAPPER fdw_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN SERVER server_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { EXECUTE | ALL [ PRIVILEGES ] }\nON { { FUNCTION | PROCEDURE | ROUTINE } routine_name [ ( [ [ argmode ] [ arg_name ] arg_type [, ...] ] ) ] [, ...]\n| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON LANGUAGE lang_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\nON LARGE OBJECT loid [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SET | ALTER SYSTEM } [, ... ] | ALL [ PRIVILEGES ] }\nON PARAMETER configuration_parameter [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\nON SCHEMA schema_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { CREATE | ALL [ PRIVILEGES ] }\nON TABLESPACE tablespace_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON TYPE type_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT role_name [, ...] TO role_specification [, ...]\n[ WITH { ADMIN | INHERIT | SET } { OPTION | TRUE | FALSE } ]\n[ GRANTED BY role_specification ]\n\nwhere role_specification can be:\n\n[ GROUP ] role_name\n| PUBLIC\n| CURRENT_ROLE\n| CURRENT_USER\n| SESSION_USER"},"ManualEvidence":{},"MeasuredEvidence":{}},"Text":{"Collection":"sql","Key":"grant","SourceDatabase":"pgweb","Version":"18","Locale":"zh-Hans","Title":"GRANT","Summary":"定义访问权限","BodyHTML":"\u003cpre\u003eGRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }\n[, ...] | ALL [ PRIVILEGES ] }\nON { [ TABLE ] table_name [, ...]\n| ALL TABLES IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column_name [, ...] )\n[, ...] | ALL [ PRIVILEGES ] ( column_name [, ...] ) }\nON [ TABLE ] table_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { USAGE | SELECT | UPDATE }\n[, ...] | ALL [ PRIVILEGES ] }\nON { SEQUENCE sequence_name [, ...]\n| ALL SEQUENCES IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\nON DATABASE database_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON DOMAIN domain_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN DATA WRAPPER fdw_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN SERVER server_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { EXECUTE | ALL [ PRIVILEGES ] }\nON { { FUNCTION | PROCEDURE | ROUTINE } routine_name [ ( [ [ argmode ] [ arg_name ] arg_type [, ...] ] ) ] [, ...]\n| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON LANGUAGE lang_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\nON LARGE OBJECT loid [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SET | ALTER SYSTEM } [, ... ] | ALL [ PRIVILEGES ] }\nON PARAMETER configuration_parameter [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\nON SCHEMA schema_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { CREATE | ALL [ PRIVILEGES ] }\nON TABLESPACE tablespace_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON TYPE type_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT role_name [, ...] TO role_specification [, ...]\n[ WITH { ADMIN | INHERIT | SET } { OPTION | TRUE | FALSE } ]\n[ GRANTED BY role_specification ]\n\n其中role_specification可以是：\n\n[ GROUP ] role_name\n| PUBLIC\n| CURRENT_ROLE\n| CURRENT_USER\n| SESSION_USER\u003c/pre\u003e\u003csection\u003e\u003ch2\u003e描述\u003c/h2\u003e\u003cp\u003e\u003ccode\u003eGRANT\u003c/code\u003e 命令有两个基本变体：一种是在数据库对象（表、列、视图、外部表、序列、数据库、外部数据包装器、外部服务器、函数、过程、过程语言、大对象、配置参数、模式、表空间或类型）上授予权限，另一种是授予角色成员资格。这两种变体在许多方面相似，但差异也足够大，因此分别说明。\u003c/p\u003e\u003cdiv\u003e\u003ch3\u003e在数据库对象上 GRANT\u003c/h3\u003e\u003cp\u003e这种 \u003ccode\u003eGRANT\u003c/code\u003e 命令变体将数据库对象上的特定权限授予一个或多个角色。如果此前已经授予过某些权限，新授予的权限会加到现有权限之上。\u003c/p\u003e\u003cp\u003e关键字 \u003ccode\u003ePUBLIC\u003c/code\u003e 表示要把权限授予所有角色，包括以后可能创建的角色。\u003ccode\u003ePUBLIC\u003c/code\u003e 可以视为一个隐式定义的组，并且始终包含所有角色。任何特定角色实际拥有的权限，是直接授予给它的权限、授予给它当前所属任一角色的权限，以及授予给 \u003ccode\u003ePUBLIC\u003c/code\u003e 的权限之和。\u003c/p\u003e\u003cp\u003e如果指定了 \u003ccode\u003eWITH GRANT OPTION\u003c/code\u003e，权限接收者随后可以再把该权限授予其他人。没有授予选项时，接收者不能这样做。授予选项不能授予给 \u003ccode\u003ePUBLIC\u003c/code\u003e。\u003c/p\u003e\u003cp\u003e如果指定了 \u003ccode\u003eGRANTED BY\u003c/code\u003e，指定的授权者必须是当前用户。该子句目前仅以这种形式存在，只是为了兼容 SQL。\u003c/p\u003e\u003cp\u003e没有必要向对象拥有者（通常是创建它的用户）授予权限，因为拥有者默认拥有全部权限。（不过，出于安全考虑，拥有者也可以选择撤销自己的某些权限。）\u003c/p\u003e\u003cp\u003e删除对象或以任何方式更改其定义的权利，不被视为一种可授予的权限；它是拥有者固有的，不能被授予或撤销。（不过，可以通过授予或撤销拥有该对象的角色的成员资格，获得类似效果；见下文。）拥有者还隐式拥有该对象上的全部授予选项。\u003c/p\u003e\u003cp\u003e可用权限如下：\u003c/p\u003e\u003cdiv\u003e\u003cdl\u003e\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eSELECT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eINSERT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eUPDATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eDELETE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eTRUNCATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eREFERENCES\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eTRIGGER\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eCREATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eCONNECT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eTEMPORARY\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eEXECUTE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eUSAGE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eSET\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eALTER SYSTEM\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan\u003e\u003ccode\u003eMAINTAIN\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e具体的权限类型见\u003ca href=\"/docs/18/ddl-priv.html\" rel=\"nofollow\"\u003e第 5.8 节\u003c/a\u003e。\u003c/p\u003e\u003c/dd\u003e\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eTEMP\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e\u003ccode\u003eTEMPORARY\u003c/code\u003e 的另一种拼写。\u003c/p\u003e\u003c/dd\u003e\u003cdt\u003e\u003cspan\u003e\u003ccode\u003eALL PRIVILEGES\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e授予该对象类型可用的全部权限。在 \u003cspan\u003ePostgreSQL\u003c/span\u003e 中，\u003ccode\u003ePRIVILEGES\u003c/code\u003e 关键字是可选的，不过在严格 SQL 中则是必需的。\u003c/p\u003e\u003c/dd\u003e\u003c/dl\u003e\u003c/div\u003e\u003cp\u003e\u003ccode\u003eFUNCTION\u003c/code\u003e 语法适用于普通函数、聚合函数和窗口函数，但不适用于过程；对于过程请使用 \u003ccode\u003ePROCEDURE\u003c/code\u003e。或者，使用 \u003ccode\u003eROUTINE\u003c/code\u003e 可以在不区分精确类型时指代函数、聚合函数、窗口函数或过程。\u003c/p\u003e\u003cp\u003e还可以选择在一个或多个模式中，对同一类型的所有对象授予权限。目前仅对表、序列、函数和过程支持这一功能。\u003ccode\u003eALL TABLES\u003c/code\u003e 也会影响视图和外部表，这与针对特定对象的 \u003ccode\u003eGRANT\u003c/code\u003e 命令相同。\u003ccode\u003eALL FUNCTIONS\u003c/code\u003e 也会影响聚合函数和窗口函数，但不包括过程，这同样与针对特定对象的 \u003ccode\u003eGRANT\u003c/code\u003e 命令一致。要包含过程，请使用 \u003ccode\u003eALL ROUTINES\u003c/code\u003e。\u003c/p\u003e\u003c/div\u003e\u003cdiv\u003e\u003ch3\u003e角色上的 GRANT\u003c/h3\u003e\u003cp\u003e这种 \u003ccode\u003eGRANT\u003c/code\u003e 命令变体把一个角色的成员资格授予一个或多个其他角色，并修改成员资格选项 \u003ccode\u003eSET\u003c/code\u003e、\u003ccode\u003eINHERIT\u003c/code\u003e 和 \u003ccode\u003eADMIN\u003c/code\u003e；详见\u003ca href=\"/docs/18/role-membership.html\" rel=\"nofollow\"\u003e第 21.3 节\u003c/a\u003e。角色成员资格之所以重要，是因为它可能使成员能够访问授予给该角色的权限，也可能使其能够对该角色本身作出更改。不过，实际赋予的权限取决于该授权所关联的选项。要修改现有成员资格的这些选项，只需再次指定该成员资格并给出更新后的选项值即可。\u003c/p\u003e\u003cp\u003e下面描述的每个选项都可以设为 \u003ccode\u003eTRUE\u003c/code\u003e 或 \u003ccode\u003eFALSE\u003c/code\u003e。关键字 \u003ccode\u003eOPTION\u003c/code\u003e 可作为 \u003ccode\u003eTRUE\u003c/code\u003e 的同义词，因此 \u003ccode\u003eWITH ADMIN OPTION\u003c/code\u003e 等同于 \u003ccode\u003eWITH ADMIN TRUE\u003c/code\u003e。修改现有成员资格时，省略某个选项表示保留其当前值。\u003c/p\u003e\u003cp\u003e\u003ccode\u003eADMIN\u003c/code\u003e 选项允许成员随后将该角色的成员资格授予其他人，也允许撤销该角色中的成员资格。没有该选项时，普通用户不能这样做。角色不被视为在其自身上持有 \u003ccode\u003eWITH ADMIN OPTION\u003c/code\u003e。数据库超级用户可以向任何人授予或撤销任何角色的成员资格。该选项默认为 \u003ccode\u003eFALSE\u003c/code\u003e。\u003c/p\u003e\u003cp\u003e\u003ccode\u003eINHERIT\u003c/code\u003e 选项控制新成员资格的继承状态；有关继承的细节见\u003ca href=\"/docs/18/role-membership.html\" rel=\"nofollow\"\u003e第 21.3 节\u003c/a\u003e。如果设为 \u003ccode\u003eTRUE\u003c/code\u003e，会使新成员从被授予的角色继承权限；如果设为 \u003ccode\u003eFALSE\u003c/code\u003e，新成员就不会继承。创建新的角色成员资格时，如果未指定该选项，则默认采用新成员的继承属性。\u003c/p\u003e\u003cp\u003e如果 \u003ccode\u003eSET\u003c/code\u003e 选项设为 \u003ccode\u003eTRUE\u003c/code\u003e，成员就可以使用\u003ca href=\"/docs/18/sql-set-role.html\" title=\"SET ROLE\" rel=\"nofollow\"\u003e\u003ccode\u003eSET ROLE\u003c/code\u003e\u003c/a\u003e 命令切换到被授予的角色。如果一个角色是另一个角色的间接成员，那么只有在整条授权链上的每一次授权都带有 \u003ccode\u003eSET TRUE\u003c/code\u003e 时，它才能使用 \u003ccode\u003eSET ROLE\u003c/code\u003e 切换到该角色。该选项默认为 \u003ccode\u003eTRUE\u003c/code\u003e。\u003c/p\u003e\u003cp\u003e若要创建由其他角色拥有的对象，或把现有对象的所有权赋给其他角色，必须具备切换为该角色的能力，即能够对该角色执行 \u003ccode\u003eSET ROLE\u003c/code\u003e；否则，诸如 \u003ccode\u003eALTER ... OWNER TO\u003c/code\u003e 或 \u003ccode\u003eCREATE DATABASE ... OWNER\u003c/code\u003e 之类的命令都会失败。不过，一个继承了某角色权限但不能对其执行 \u003ccode\u003eSET ROLE\u003c/code\u003e 的用户，仍可能通过操纵该角色拥有的现有对象而获得对该角色的完全访问能力（例如，可以把现有函数重定义为特洛伊木马）。因此，如果某个角色的权限应当可继承，但不应通过 \u003ccode\u003eSET ROLE\u003c/code\u003e 访问，那么它就不应拥有任何 SQL 对象。\u003c/p\u003e\u003cp\u003e如果指定了 \u003ccode\u003eGRANTED BY\u003c/code\u003e，该授权会被记录为由指定角色执行。只有在用户拥有该角色权限时，才能把授权记为来自另一个角色。除非该角色是引导超级用户，否则被记录为授权者的角色必须对目标角色持有 \u003ccode\u003eADMIN OPTION\u003c/code\u003e。当授权被记录为由引导超级用户以外的某个授权者发出时，该授权依赖于授权者继续持有该角色上的 \u003ccode\u003eADMIN OPTION\u003c/code\u003e；因此，如果 \u003ccode\u003eADMIN OPTION\u003c/code\u003e 被撤销，依赖的授权也必须一并撤销。\u003c/p\u003e\u003cp\u003e与权限的情况不同，角色成员资格不能授予给 \u003ccode\u003ePUBLIC\u003c/code\u003e。还要注意，这种形式的命令不允许在 \u003cem\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e 中使用噪声词 \u003ccode\u003eGROUP\u003c/code\u003e。\u003c/p\u003e\u003c/div\u003e\u003c/section\u003e\u003csection\u003e\u003ch2\u003e注解\u003c/h2\u003e\u003cp\u003e\u003ca href=\"/docs/18/sql-revoke.html\" title=\"REVOKE\" rel=\"nofollow\"\u003e\u003ccode\u003eREVOKE\u003c/code\u003e\u003c/a\u003e 命令用于撤销访问权限。\u003c/p\u003e\u003cp\u003e从 \u003cspan\u003ePostgreSQL\u003c/span\u003e 8.1 起，用户和组的概念已统一为一种称为角色的单一实体。因此，不再需要使用关键字 \u003ccode\u003eGROUP\u003c/code\u003e 来标识被授权者是用户还是组。\u003ccode\u003eGROUP\u003c/code\u003e 仍可出现在命令中，但它只是一个噪声词。\u003c/p\u003e\u003cp\u003e如果用户对某一列本身，或者对其所在整张表拥有该权限，就可以在该列上执行 \u003ccode\u003eSELECT\u003c/code\u003e、\u003ccode\u003eINSERT\u003c/code\u003e 等操作。在表级授予某项权限后，再在单列上撤销该权限，并不会产生人们可能期望的效果：表级授权不会受到列级操作的影响。\u003c/p\u003e\u003cp\u003e当对象的非拥有者试图在该对象上执行 \u003ccode\u003eGRANT\u003c/code\u003e 时，如果该用户在该对象上完全没有任何权限，命令会立即失败。只要有某项权限可用，命令就会继续执行，但只会授予那些该用户持有授予选项的权限。如果未持有任何授予选项，\u003ccode\u003eGRANT ALL PRIVILEGES\u003c/code\u003e 形式会发出警告；而其他形式如果命令中特别列出的任一权限未持有其授予选项，也会发出警告。（原则上，这些说明也适用于对象拥有者；但由于拥有者总是被视为持有全部授予选项，这种情况实际上不会发生。）\u003c/p\u003e\u003cp\u003e需要注意，数据库超级用户可以访问所有对象，而不受对象权限设置的影响。这可类比于 Unix 系统中的 \u003ccode\u003eroot\u003c/code\u003e 权限。和 \u003ccode\u003eroot\u003c/code\u003e 一样，除非绝对必要，否则不宜以超级用户身份操作。\u003c/p\u003e\u003cp\u003e如果超级用户选择执行 \u003ccode\u003eGRANT\u003c/code\u003e 或 \u003ccode\u003eREVOKE\u003c/code\u003e 命令，该命令会像由受影响对象的拥有者发出一样执行。特别是，通过这种命令授予的权限看起来会像是由对象拥有者授予的。（对于角色成员资格，则看起来像是由引导超级用户授予的。）\u003c/p\u003e\u003cp\u003e\u003ccode\u003eGRANT\u003c/code\u003e 和 \u003ccode\u003eREVOKE\u003c/code\u003e 也可以由并非受影响对象拥有者的角色执行，只要该角色是拥有该对象之角色的成员，或者是持有该对象上 \u003ccode\u003eWITH GRANT OPTION\u003c/code\u003e 权限之角色的成员。在这种情况下，权限会记录为由实际拥有该对象的角色，或者由持有 \u003ccode\u003eWITH GRANT OPTION\u003c/code\u003e 权限的角色授予。例如，如果表 \u003ccode\u003et1\u003c/code\u003e 由角色 \u003ccode\u003eg1\u003c/code\u003e 拥有，而角色 \u003ccode\u003eu1\u003c/code\u003e 是 \u003ccode\u003eg1\u003c/code\u003e 的成员，那么 \u003ccode\u003eu1\u003c/code\u003e 可以把 \u003ccode\u003et1\u003c/code\u003e 上的权限授予给 \u003ccode\u003eu2\u003c/code\u003e，但这些权限看起来会像是直接由 \u003ccode\u003eg1\u003c/code\u003e 授予的。角色 \u003ccode\u003eg1\u003c/code\u003e 的任何其他成员之后都可以撤销这些权限。\u003c/p\u003e\u003cp\u003e如果执行 \u003ccode\u003eGRANT\u003c/code\u003e 的角色通过多条角色成员资格路径间接持有所需权限，则将哪个上层角色记录为授权者并无规定。在这种情况下，最佳做法是使用 \u003ccode\u003eSET ROLE\u003c/code\u003e 切换成你希望作为其身份执行 \u003ccode\u003eGRANT\u003c/code\u003e 的那个具体角色。\u003c/p\u003e\u003cp\u003e在表上授予权限，并不会自动把权限扩展到该表使用的任何序列，包括绑定到 \u003ccode\u003eSERIAL\u003c/code\u003e 列的序列。序列上的权限必须单独设置。\u003c/p\u003e\u003cp\u003e有关具体权限类型以及如何检查对象权限的更多信息，请参见\u003ca href=\"/docs/18/ddl-priv.html\" rel=\"nofollow\"\u003e第 5.8 节\u003c/a\u003e。\u003c/p\u003e\u003c/section\u003e\u003csection\u003e\u003ch2\u003e示例\u003c/h2\u003e\u003cp\u003e将表 \u003ccode\u003efilms\u003c/code\u003e 上的插入权限授予所有用户：\u003c/p\u003e\u003cpre\u003eGRANT INSERT ON films TO PUBLIC;\n\u003c/pre\u003e\u003cp\u003e将视图 \u003ccode\u003ekinds\u003c/code\u003e 上的所有可用权限授予用户 \u003ccode\u003emanuel\u003c/code\u003e：\u003c/p\u003e\u003cpre\u003eGRANT ALL PRIVILEGES ON kinds TO manuel;\n\u003c/pre\u003e\u003cp\u003e请注意，如果上述命令由超级用户或 \u003ccode\u003ekinds\u003c/code\u003e 的拥有者执行，确实会授予所有权限；但如果由其他人执行，则只会授予该执行者持有授予选项的那些权限。\u003c/p\u003e\u003cp\u003e将角色 \u003ccode\u003eadmins\u003c/code\u003e 的成员资格授予用户 \u003ccode\u003ejoe\u003c/code\u003e：\u003c/p\u003e\u003cpre\u003eGRANT admins TO joe;\n\u003c/pre\u003e\u003c/section\u003e\u003csection\u003e\u003ch2\u003e兼容性\u003c/h2\u003e\u003cp\u003e根据 SQL 标准，\u003ccode\u003eALL PRIVILEGES\u003c/code\u003e 中的 \u003ccode\u003ePRIVILEGES\u003c/code\u003e 关键字是必需的。SQL 标准也不支持每条命令对多个对象设置权限。\u003c/p\u003e\u003cp\u003e\u003cspan\u003ePostgreSQL\u003c/span\u003e 允许对象拥有者撤销自己的普通权限：例如，表拥有者可以通过撤销自己的 \u003ccode\u003eINSERT\u003c/code\u003e、\u003ccode\u003eUPDATE\u003c/code\u003e、\u003ccode\u003eDELETE\u003c/code\u003e 和 \u003ccode\u003eTRUNCATE\u003c/code\u003e 权限，使该表对自己变成只读。这在 SQL 标准中是不可能的。原因是 \u003cspan\u003ePostgreSQL\u003c/span\u003e 把拥有者的权限视为拥有者授予给自己的；因此他们也可以撤销这些权限。在 SQL 标准中，拥有者的权限由一个假定实体\u003cspan\u003e“\u003cspan\u003e_SYSTEM\u003c/span\u003e”\u003c/span\u003e授予。由于拥有者并不是\u003cspan\u003e“\u003cspan\u003e_SYSTEM\u003c/span\u003e”\u003c/span\u003e，因此不能撤销这些权利。\u003c/p\u003e\u003cp\u003e根据 SQL 标准，授予选项可以授予给 \u003ccode\u003ePUBLIC\u003c/code\u003e；\u003cspan\u003ePostgreSQL\u003c/span\u003e 只支持将授予选项授予给角色。\u003c/p\u003e\u003cp\u003eSQL 标准允许 \u003ccode\u003eGRANTED BY\u003c/code\u003e 选项仅指定 \u003ccode\u003eCURRENT_USER\u003c/code\u003e 或 \u003ccode\u003eCURRENT_ROLE\u003c/code\u003e。其他变体都是 \u003cspan\u003ePostgreSQL\u003c/span\u003e 扩展。\u003c/p\u003e\u003cp\u003eSQL 标准还为其他种类的对象提供 \u003ccode\u003eUSAGE\u003c/code\u003e 权限：字符集、排序规则、翻译。\u003c/p\u003e\u003cp\u003e在 SQL 标准中，序列只有 \u003ccode\u003eUSAGE\u003c/code\u003e 这一项权限，它控制 \u003ccode\u003eNEXT VALUE FOR\u003c/code\u003e 表达式的使用；该表达式等价于 \u003cspan\u003ePostgreSQL\u003c/span\u003e 中的 \u003ccode\u003enextval\u003c/code\u003e 函数。序列上的 \u003ccode\u003eSELECT\u003c/code\u003e 和 \u003ccode\u003eUPDATE\u003c/code\u003e 权限都是 \u003cspan\u003ePostgreSQL\u003c/span\u003e 扩展。把序列的 \u003ccode\u003eUSAGE\u003c/code\u003e 权限应用到 \u003ccode\u003ecurrval\u003c/code\u003e 函数上也是 \u003cspan\u003ePostgreSQL\u003c/span\u003e 扩展（该函数本身也是扩展）。\u003c/p\u003e\u003cp\u003e数据库、表空间、模式、语言以及配置参数上的权限都是 \u003cspan\u003ePostgreSQL\u003c/span\u003e 扩展。\u003c/p\u003e\u003c/section\u003e\u003csection\u003e\u003ch2\u003e另见\u003c/h2\u003e\u003cspan\u003e\u003ca href=\"/wiki/sql/revoke/?v=18\" title=\"REVOKE\" rel=\"nofollow\"\u003e\u003cspan\u003eREVOKE\u003c/span\u003e\u003c/a\u003e, \u003ca href=\"/wiki/sql/alter-default-privileges/?v=18\" title=\"ALTER DEFAULT PRIVILEGES\" rel=\"nofollow\"\u003e\u003cspan\u003eALTER DEFAULT PRIVILEGES\u003c/span\u003e\u003c/a\u003e\u003c/span\u003e\u003c/section\u003e","SourceRevision":"1b5ca64c","ContentHash":"0ca89a6c5b76adad20173aca687ba84a4a0fb55fdd2b03ea8852f884add2a409","Payload":{"purpose_zh":"定义访问权限","sections":[{"html":"\u003cp\u003e\u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 命令有两个基本变体：一种是在数据库对象（表、列、视图、外部表、序列、数据库、外部数据包装器、外部服务器、函数、过程、过程语言、大对象、配置参数、模式、表空间或类型）上授予权限，另一种是授予角色成员资格。这两种变体在许多方面相似，但差异也足够大，因此分别说明。\u003c/p\u003e\u003cdiv class=\"refsect2\"\u003e\u003ch3\u003e在数据库对象上 GRANT\u003c/h3\u003e\u003cp\u003e这种 \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 命令变体将数据库对象上的特定权限授予一个或多个角色。如果此前已经授予过某些权限，新授予的权限会加到现有权限之上。\u003c/p\u003e\u003cp\u003e关键字 \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e 表示要把权限授予所有角色，包括以后可能创建的角色。\u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e 可以视为一个隐式定义的组，并且始终包含所有角色。任何特定角色实际拥有的权限，是直接授予给它的权限、授予给它当前所属任一角色的权限，以及授予给 \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e 的权限之和。\u003c/p\u003e\u003cp\u003e如果指定了 \u003ccode class=\"literal\"\u003eWITH GRANT OPTION\u003c/code\u003e，权限接收者随后可以再把该权限授予其他人。没有授予选项时，接收者不能这样做。授予选项不能授予给 \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e。\u003c/p\u003e\u003cp\u003e如果指定了 \u003ccode class=\"literal\"\u003eGRANTED BY\u003c/code\u003e，指定的授权者必须是当前用户。该子句目前仅以这种形式存在，只是为了兼容 SQL。\u003c/p\u003e\u003cp\u003e没有必要向对象拥有者（通常是创建它的用户）授予权限，因为拥有者默认拥有全部权限。（不过，出于安全考虑，拥有者也可以选择撤销自己的某些权限。）\u003c/p\u003e\u003cp\u003e删除对象或以任何方式更改其定义的权利，不被视为一种可授予的权限；它是拥有者固有的，不能被授予或撤销。（不过，可以通过授予或撤销拥有该对象的角色的成员资格，获得类似效果；见下文。）拥有者还隐式拥有该对象上的全部授予选项。\u003c/p\u003e\u003cp\u003e可用权限如下：\u003c/p\u003e\u003cdiv class=\"variablelist\"\u003e\u003cdl class=\"variablelist\"\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eSELECT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eINSERT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eUPDATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eDELETE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eTRUNCATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eREFERENCES\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eTRIGGER\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eCREATE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eCONNECT\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eTEMPORARY\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eEXECUTE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eUSAGE\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eSET\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eALTER SYSTEM\u003c/code\u003e\u003cbr\u003e\u003c/span\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eMAINTAIN\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e具体的权限类型见\u003ca href=\"/docs/18/ddl-priv.html\" title=\"5.8. 权限\"\u003e第 5.8 节\u003c/a\u003e。\u003c/p\u003e\u003c/dd\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eTEMP\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e\u003ccode class=\"literal\"\u003eTEMPORARY\u003c/code\u003e 的另一种拼写。\u003c/p\u003e\u003c/dd\u003e\u003cdt\u003e\u003cspan class=\"term\"\u003e\u003ccode class=\"literal\"\u003eALL PRIVILEGES\u003c/code\u003e\u003c/span\u003e\u003c/dt\u003e\u003cdd\u003e\u003cp\u003e授予该对象类型可用的全部权限。在 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 中，\u003ccode class=\"literal\"\u003ePRIVILEGES\u003c/code\u003e 关键字是可选的，不过在严格 SQL 中则是必需的。\u003c/p\u003e\u003c/dd\u003e\u003c/dl\u003e\u003c/div\u003e\u003cp\u003e\u003ccode class=\"literal\"\u003eFUNCTION\u003c/code\u003e 语法适用于普通函数、聚合函数和窗口函数，但不适用于过程；对于过程请使用 \u003ccode class=\"literal\"\u003ePROCEDURE\u003c/code\u003e。或者，使用 \u003ccode class=\"literal\"\u003eROUTINE\u003c/code\u003e 可以在不区分精确类型时指代函数、聚合函数、窗口函数或过程。\u003c/p\u003e\u003cp\u003e还可以选择在一个或多个模式中，对同一类型的所有对象授予权限。目前仅对表、序列、函数和过程支持这一功能。\u003ccode class=\"literal\"\u003eALL TABLES\u003c/code\u003e 也会影响视图和外部表，这与针对特定对象的 \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 命令相同。\u003ccode class=\"literal\"\u003eALL FUNCTIONS\u003c/code\u003e 也会影响聚合函数和窗口函数，但不包括过程，这同样与针对特定对象的 \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 命令一致。要包含过程，请使用 \u003ccode class=\"literal\"\u003eALL ROUTINES\u003c/code\u003e。\u003c/p\u003e\u003c/div\u003e\u003cdiv class=\"refsect2\"\u003e\u003ch3\u003e角色上的 GRANT\u003c/h3\u003e\u003cp\u003e这种 \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 命令变体把一个角色的成员资格授予一个或多个其他角色，并修改成员资格选项 \u003ccode class=\"literal\"\u003eSET\u003c/code\u003e、\u003ccode class=\"literal\"\u003eINHERIT\u003c/code\u003e 和 \u003ccode class=\"literal\"\u003eADMIN\u003c/code\u003e；详见\u003ca href=\"/docs/18/role-membership.html\" title=\"21.3. 角色成员资格\"\u003e第 21.3 节\u003c/a\u003e。角色成员资格之所以重要，是因为它可能使成员能够访问授予给该角色的权限，也可能使其能够对该角色本身作出更改。不过，实际赋予的权限取决于该授权所关联的选项。要修改现有成员资格的这些选项，只需再次指定该成员资格并给出更新后的选项值即可。\u003c/p\u003e\u003cp\u003e下面描述的每个选项都可以设为 \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e 或 \u003ccode class=\"literal\"\u003eFALSE\u003c/code\u003e。关键字 \u003ccode class=\"literal\"\u003eOPTION\u003c/code\u003e 可作为 \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e 的同义词，因此 \u003ccode class=\"literal\"\u003eWITH ADMIN OPTION\u003c/code\u003e 等同于 \u003ccode class=\"literal\"\u003eWITH ADMIN TRUE\u003c/code\u003e。修改现有成员资格时，省略某个选项表示保留其当前值。\u003c/p\u003e\u003cp\u003e\u003ccode class=\"literal\"\u003eADMIN\u003c/code\u003e 选项允许成员随后将该角色的成员资格授予其他人，也允许撤销该角色中的成员资格。没有该选项时，普通用户不能这样做。角色不被视为在其自身上持有 \u003ccode class=\"literal\"\u003eWITH ADMIN OPTION\u003c/code\u003e。数据库超级用户可以向任何人授予或撤销任何角色的成员资格。该选项默认为 \u003ccode class=\"literal\"\u003eFALSE\u003c/code\u003e。\u003c/p\u003e\u003cp\u003e\u003ccode class=\"literal\"\u003eINHERIT\u003c/code\u003e 选项控制新成员资格的继承状态；有关继承的细节见\u003ca href=\"/docs/18/role-membership.html\" title=\"21.3. 角色成员资格\"\u003e第 21.3 节\u003c/a\u003e。如果设为 \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e，会使新成员从被授予的角色继承权限；如果设为 \u003ccode class=\"literal\"\u003eFALSE\u003c/code\u003e，新成员就不会继承。创建新的角色成员资格时，如果未指定该选项，则默认采用新成员的继承属性。\u003c/p\u003e\u003cp\u003e如果 \u003ccode class=\"literal\"\u003eSET\u003c/code\u003e 选项设为 \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e，成员就可以使用\u003ca href=\"/docs/18/sql-set-role.html\" title=\"SET ROLE\"\u003e\u003ccode class=\"command\"\u003eSET ROLE\u003c/code\u003e\u003c/a\u003e 命令切换到被授予的角色。如果一个角色是另一个角色的间接成员，那么只有在整条授权链上的每一次授权都带有 \u003ccode class=\"literal\"\u003eSET TRUE\u003c/code\u003e 时，它才能使用 \u003ccode class=\"literal\"\u003eSET ROLE\u003c/code\u003e 切换到该角色。该选项默认为 \u003ccode class=\"literal\"\u003eTRUE\u003c/code\u003e。\u003c/p\u003e\u003cp\u003e若要创建由其他角色拥有的对象，或把现有对象的所有权赋给其他角色，必须具备切换为该角色的能力，即能够对该角色执行 \u003ccode class=\"literal\"\u003eSET ROLE\u003c/code\u003e；否则，诸如 \u003ccode class=\"literal\"\u003eALTER ... OWNER TO\u003c/code\u003e 或 \u003ccode class=\"literal\"\u003eCREATE DATABASE ... OWNER\u003c/code\u003e 之类的命令都会失败。不过，一个继承了某角色权限但不能对其执行 \u003ccode class=\"literal\"\u003eSET ROLE\u003c/code\u003e 的用户，仍可能通过操纵该角色拥有的现有对象而获得对该角色的完全访问能力（例如，可以把现有函数重定义为特洛伊木马）。因此，如果某个角色的权限应当可继承，但不应通过 \u003ccode class=\"literal\"\u003eSET ROLE\u003c/code\u003e 访问，那么它就不应拥有任何 SQL 对象。\u003c/p\u003e\u003cp\u003e如果指定了 \u003ccode class=\"literal\"\u003eGRANTED BY\u003c/code\u003e，该授权会被记录为由指定角色执行。只有在用户拥有该角色权限时，才能把授权记为来自另一个角色。除非该角色是引导超级用户，否则被记录为授权者的角色必须对目标角色持有 \u003ccode class=\"literal\"\u003eADMIN OPTION\u003c/code\u003e。当授权被记录为由引导超级用户以外的某个授权者发出时，该授权依赖于授权者继续持有该角色上的 \u003ccode class=\"literal\"\u003eADMIN OPTION\u003c/code\u003e；因此，如果 \u003ccode class=\"literal\"\u003eADMIN OPTION\u003c/code\u003e 被撤销，依赖的授权也必须一并撤销。\u003c/p\u003e\u003cp\u003e与权限的情况不同，角色成员资格不能授予给 \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e。还要注意，这种形式的命令不允许在 \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e 中使用噪声词 \u003ccode class=\"literal\"\u003eGROUP\u003c/code\u003e。\u003c/p\u003e\u003c/div\u003e","key":"description","title":"描述"},{"html":"\u003cp\u003e\u003ca href=\"/docs/18/sql-revoke.html\" title=\"REVOKE\"\u003e\u003ccode class=\"command\"\u003eREVOKE\u003c/code\u003e\u003c/a\u003e 命令用于撤销访问权限。\u003c/p\u003e\u003cp\u003e从 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 8.1 起，用户和组的概念已统一为一种称为角色的单一实体。因此，不再需要使用关键字 \u003ccode class=\"literal\"\u003eGROUP\u003c/code\u003e 来标识被授权者是用户还是组。\u003ccode class=\"literal\"\u003eGROUP\u003c/code\u003e 仍可出现在命令中，但它只是一个噪声词。\u003c/p\u003e\u003cp\u003e如果用户对某一列本身，或者对其所在整张表拥有该权限，就可以在该列上执行 \u003ccode class=\"command\"\u003eSELECT\u003c/code\u003e、\u003ccode class=\"command\"\u003eINSERT\u003c/code\u003e 等操作。在表级授予某项权限后，再在单列上撤销该权限，并不会产生人们可能期望的效果：表级授权不会受到列级操作的影响。\u003c/p\u003e\u003cp\u003e当对象的非拥有者试图在该对象上执行 \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 时，如果该用户在该对象上完全没有任何权限，命令会立即失败。只要有某项权限可用，命令就会继续执行，但只会授予那些该用户持有授予选项的权限。如果未持有任何授予选项，\u003ccode class=\"command\"\u003eGRANT ALL PRIVILEGES\u003c/code\u003e 形式会发出警告；而其他形式如果命令中特别列出的任一权限未持有其授予选项，也会发出警告。（原则上，这些说明也适用于对象拥有者；但由于拥有者总是被视为持有全部授予选项，这种情况实际上不会发生。）\u003c/p\u003e\u003cp\u003e需要注意，数据库超级用户可以访问所有对象，而不受对象权限设置的影响。这可类比于 Unix 系统中的 \u003ccode class=\"literal\"\u003eroot\u003c/code\u003e 权限。和 \u003ccode class=\"literal\"\u003eroot\u003c/code\u003e 一样，除非绝对必要，否则不宜以超级用户身份操作。\u003c/p\u003e\u003cp\u003e如果超级用户选择执行 \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 或 \u003ccode class=\"command\"\u003eREVOKE\u003c/code\u003e 命令，该命令会像由受影响对象的拥有者发出一样执行。特别是，通过这种命令授予的权限看起来会像是由对象拥有者授予的。（对于角色成员资格，则看起来像是由引导超级用户授予的。）\u003c/p\u003e\u003cp\u003e\u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 和 \u003ccode class=\"command\"\u003eREVOKE\u003c/code\u003e 也可以由并非受影响对象拥有者的角色执行，只要该角色是拥有该对象之角色的成员，或者是持有该对象上 \u003ccode class=\"literal\"\u003eWITH GRANT OPTION\u003c/code\u003e 权限之角色的成员。在这种情况下，权限会记录为由实际拥有该对象的角色，或者由持有 \u003ccode class=\"literal\"\u003eWITH GRANT OPTION\u003c/code\u003e 权限的角色授予。例如，如果表 \u003ccode class=\"literal\"\u003et1\u003c/code\u003e 由角色 \u003ccode class=\"literal\"\u003eg1\u003c/code\u003e 拥有，而角色 \u003ccode class=\"literal\"\u003eu1\u003c/code\u003e 是 \u003ccode class=\"literal\"\u003eg1\u003c/code\u003e 的成员，那么 \u003ccode class=\"literal\"\u003eu1\u003c/code\u003e 可以把 \u003ccode class=\"literal\"\u003et1\u003c/code\u003e 上的权限授予给 \u003ccode class=\"literal\"\u003eu2\u003c/code\u003e，但这些权限看起来会像是直接由 \u003ccode class=\"literal\"\u003eg1\u003c/code\u003e 授予的。角色 \u003ccode class=\"literal\"\u003eg1\u003c/code\u003e 的任何其他成员之后都可以撤销这些权限。\u003c/p\u003e\u003cp\u003e如果执行 \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 的角色通过多条角色成员资格路径间接持有所需权限，则将哪个上层角色记录为授权者并无规定。在这种情况下，最佳做法是使用 \u003ccode class=\"command\"\u003eSET ROLE\u003c/code\u003e 切换成你希望作为其身份执行 \u003ccode class=\"command\"\u003eGRANT\u003c/code\u003e 的那个具体角色。\u003c/p\u003e\u003cp\u003e在表上授予权限，并不会自动把权限扩展到该表使用的任何序列，包括绑定到 \u003ccode class=\"type\"\u003eSERIAL\u003c/code\u003e 列的序列。序列上的权限必须单独设置。\u003c/p\u003e\u003cp\u003e有关具体权限类型以及如何检查对象权限的更多信息，请参见\u003ca href=\"/docs/18/ddl-priv.html\" title=\"5.8. 权限\"\u003e第 5.8 节\u003c/a\u003e。\u003c/p\u003e","key":"notes","title":"注解"},{"html":"\u003cp\u003e将表 \u003ccode class=\"literal\"\u003efilms\u003c/code\u003e 上的插入权限授予所有用户：\u003c/p\u003e\u003cpre class=\"programlisting\"\u003eGRANT INSERT ON films TO PUBLIC;\n\u003c/pre\u003e\u003cp\u003e将视图 \u003ccode class=\"literal\"\u003ekinds\u003c/code\u003e 上的所有可用权限授予用户 \u003ccode class=\"literal\"\u003emanuel\u003c/code\u003e：\u003c/p\u003e\u003cpre class=\"programlisting\"\u003eGRANT ALL PRIVILEGES ON kinds TO manuel;\n\u003c/pre\u003e\u003cp\u003e请注意，如果上述命令由超级用户或 \u003ccode class=\"literal\"\u003ekinds\u003c/code\u003e 的拥有者执行，确实会授予所有权限；但如果由其他人执行，则只会授予该执行者持有授予选项的那些权限。\u003c/p\u003e\u003cp\u003e将角色 \u003ccode class=\"literal\"\u003eadmins\u003c/code\u003e 的成员资格授予用户 \u003ccode class=\"literal\"\u003ejoe\u003c/code\u003e：\u003c/p\u003e\u003cpre class=\"programlisting\"\u003eGRANT admins TO joe;\n\u003c/pre\u003e","key":"examples","title":"示例"},{"html":"\u003cp\u003e根据 SQL 标准，\u003ccode class=\"literal\"\u003eALL PRIVILEGES\u003c/code\u003e 中的 \u003ccode class=\"literal\"\u003ePRIVILEGES\u003c/code\u003e 关键字是必需的。SQL 标准也不支持每条命令对多个对象设置权限。\u003c/p\u003e\u003cp\u003e\u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 允许对象拥有者撤销自己的普通权限：例如，表拥有者可以通过撤销自己的 \u003ccode class=\"literal\"\u003eINSERT\u003c/code\u003e、\u003ccode class=\"literal\"\u003eUPDATE\u003c/code\u003e、\u003ccode class=\"literal\"\u003eDELETE\u003c/code\u003e 和 \u003ccode class=\"literal\"\u003eTRUNCATE\u003c/code\u003e 权限，使该表对自己变成只读。这在 SQL 标准中是不可能的。原因是 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 把拥有者的权限视为拥有者授予给自己的；因此他们也可以撤销这些权限。在 SQL 标准中，拥有者的权限由一个假定实体\u003cspan class=\"quote\"\u003e“\u003cspan class=\"quote\"\u003e_SYSTEM\u003c/span\u003e”\u003c/span\u003e授予。由于拥有者并不是\u003cspan class=\"quote\"\u003e“\u003cspan class=\"quote\"\u003e_SYSTEM\u003c/span\u003e”\u003c/span\u003e，因此不能撤销这些权利。\u003c/p\u003e\u003cp\u003e根据 SQL 标准，授予选项可以授予给 \u003ccode class=\"literal\"\u003ePUBLIC\u003c/code\u003e；\u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 只支持将授予选项授予给角色。\u003c/p\u003e\u003cp\u003eSQL 标准允许 \u003ccode class=\"literal\"\u003eGRANTED BY\u003c/code\u003e 选项仅指定 \u003ccode class=\"literal\"\u003eCURRENT_USER\u003c/code\u003e 或 \u003ccode class=\"literal\"\u003eCURRENT_ROLE\u003c/code\u003e。其他变体都是 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 扩展。\u003c/p\u003e\u003cp\u003eSQL 标准还为其他种类的对象提供 \u003ccode class=\"literal\"\u003eUSAGE\u003c/code\u003e 权限：字符集、排序规则、翻译。\u003c/p\u003e\u003cp\u003e在 SQL 标准中，序列只有 \u003ccode class=\"literal\"\u003eUSAGE\u003c/code\u003e 这一项权限，它控制 \u003ccode class=\"literal\"\u003eNEXT VALUE FOR\u003c/code\u003e 表达式的使用；该表达式等价于 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 中的 \u003ccode class=\"function\"\u003enextval\u003c/code\u003e 函数。序列上的 \u003ccode class=\"literal\"\u003eSELECT\u003c/code\u003e 和 \u003ccode class=\"literal\"\u003eUPDATE\u003c/code\u003e 权限都是 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 扩展。把序列的 \u003ccode class=\"literal\"\u003eUSAGE\u003c/code\u003e 权限应用到 \u003ccode class=\"literal\"\u003ecurrval\u003c/code\u003e 函数上也是 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 扩展（该函数本身也是扩展）。\u003c/p\u003e\u003cp\u003e数据库、表空间、模式、语言以及配置参数上的权限都是 \u003cspan class=\"productname\"\u003ePostgreSQL\u003c/span\u003e 扩展。\u003c/p\u003e","key":"compatibility","title":"兼容性"},{"html":"\u003cspan class=\"simplelist\"\u003e\u003ca href=\"/wiki/sql/revoke/?v=18\" title=\"REVOKE\"\u003e\u003cspan class=\"refentrytitle\"\u003eREVOKE\u003c/span\u003e\u003c/a\u003e, \u003ca href=\"/wiki/sql/alter-default-privileges/?v=18\" title=\"ALTER DEFAULT PRIVILEGES\"\u003e\u003cspan class=\"refentrytitle\"\u003eALTER DEFAULT PRIVILEGES\u003c/span\u003e\u003c/a\u003e\u003c/span\u003e","key":"see_also","title":"另见"}],"sections_same_as":"","synopsis_html":"GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }\n    [, ...] | ALL [ PRIVILEGES ] }\n    ON { [ TABLE ] \u003cem class=\"replaceable\"\u003e\u003ccode\u003etable_name\u003c/code\u003e\u003c/em\u003e [, ...]\n         | ALL TABLES IN SCHEMA \u003cem class=\"replaceable\"\u003e\u003ccode\u003eschema_name\u003c/code\u003e\u003c/em\u003e [, ...] }\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( \u003cem class=\"replaceable\"\u003e\u003ccode\u003ecolumn_name\u003c/code\u003e\u003c/em\u003e [, ...] )\n    [, ...] | ALL [ PRIVILEGES ] ( \u003cem class=\"replaceable\"\u003e\u003ccode\u003ecolumn_name\u003c/code\u003e\u003c/em\u003e [, ...] ) }\n    ON [ TABLE ] \u003cem class=\"replaceable\"\u003e\u003ccode\u003etable_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { USAGE | SELECT | UPDATE }\n    [, ...] | ALL [ PRIVILEGES ] }\n    ON { SEQUENCE \u003cem class=\"replaceable\"\u003e\u003ccode\u003esequence_name\u003c/code\u003e\u003c/em\u003e [, ...]\n         | ALL SEQUENCES IN SCHEMA \u003cem class=\"replaceable\"\u003e\u003ccode\u003eschema_name\u003c/code\u003e\u003c/em\u003e [, ...] }\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\n    ON DATABASE \u003cem class=\"replaceable\"\u003e\u003ccode\u003edatabase_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON DOMAIN \u003cem class=\"replaceable\"\u003e\u003ccode\u003edomain_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON FOREIGN DATA WRAPPER \u003cem class=\"replaceable\"\u003e\u003ccode\u003efdw_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON FOREIGN SERVER \u003cem class=\"replaceable\"\u003e\u003ccode\u003eserver_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { EXECUTE | ALL [ PRIVILEGES ] }\n    ON { { FUNCTION | PROCEDURE | ROUTINE } \u003cem class=\"replaceable\"\u003e\u003ccode\u003eroutine_name\u003c/code\u003e\u003c/em\u003e [ ( [ [ \u003cem class=\"replaceable\"\u003e\u003ccode\u003eargmode\u003c/code\u003e\u003c/em\u003e ] [ \u003cem class=\"replaceable\"\u003e\u003ccode\u003earg_name\u003c/code\u003e\u003c/em\u003e ] \u003cem class=\"replaceable\"\u003e\u003ccode\u003earg_type\u003c/code\u003e\u003c/em\u003e [, ...] ] ) ] [, ...]\n         | ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA \u003cem class=\"replaceable\"\u003e\u003ccode\u003eschema_name\u003c/code\u003e\u003c/em\u003e [, ...] }\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON LANGUAGE \u003cem class=\"replaceable\"\u003e\u003ccode\u003elang_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\n    ON LARGE OBJECT \u003cem class=\"replaceable\"\u003e\u003ccode\u003eloid\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { SET | ALTER SYSTEM } [, ... ] | ALL [ PRIVILEGES ] }\n    ON PARAMETER \u003cem class=\"replaceable\"\u003e\u003ccode\u003econfiguration_parameter\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\n    ON SCHEMA \u003cem class=\"replaceable\"\u003e\u003ccode\u003eschema_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { CREATE | ALL [ PRIVILEGES ] }\n    ON TABLESPACE \u003cem class=\"replaceable\"\u003e\u003ccode\u003etablespace_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\n    ON TYPE \u003cem class=\"replaceable\"\u003e\u003ccode\u003etype_name\u003c/code\u003e\u003c/em\u003e [, ...]\n    TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...] [ WITH GRANT OPTION ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\nGRANT \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_name\u003c/code\u003e\u003c/em\u003e [, ...] TO \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e [, ...]\n    [ WITH { ADMIN | INHERIT | SET } { OPTION | TRUE | FALSE } ]\n    [ GRANTED BY \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e ]\n\n\u003cspan class=\"phrase\"\u003e其中\u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_specification\u003c/code\u003e\u003c/em\u003e可以是：\u003c/span\u003e\n\n    [ GROUP ] \u003cem class=\"replaceable\"\u003e\u003ccode\u003erole_name\u003c/code\u003e\u003c/em\u003e\n  | PUBLIC\n  | CURRENT_ROLE\n  | CURRENT_USER\n  | SESSION_USER","synopsis_text":"GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }\n[, ...] | ALL [ PRIVILEGES ] }\nON { [ TABLE ] table_name [, ...]\n| ALL TABLES IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SELECT | INSERT | UPDATE | REFERENCES } ( column_name [, ...] )\n[, ...] | ALL [ PRIVILEGES ] ( column_name [, ...] ) }\nON [ TABLE ] table_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { USAGE | SELECT | UPDATE }\n[, ...] | ALL [ PRIVILEGES ] }\nON { SEQUENCE sequence_name [, ...]\n| ALL SEQUENCES IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { CREATE | CONNECT | TEMPORARY | TEMP } [, ...] | ALL [ PRIVILEGES ] }\nON DATABASE database_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON DOMAIN domain_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN DATA WRAPPER fdw_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON FOREIGN SERVER server_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { EXECUTE | ALL [ PRIVILEGES ] }\nON { { FUNCTION | PROCEDURE | ROUTINE } routine_name [ ( [ [ argmode ] [ arg_name ] arg_type [, ...] ] ) ] [, ...]\n| ALL { FUNCTIONS | PROCEDURES | ROUTINES } IN SCHEMA schema_name [, ...] }\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON LANGUAGE lang_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SELECT | UPDATE } [, ...] | ALL [ PRIVILEGES ] }\nON LARGE OBJECT loid [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { SET | ALTER SYSTEM } [, ... ] | ALL [ PRIVILEGES ] }\nON PARAMETER configuration_parameter [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { { CREATE | USAGE } [, ...] | ALL [ PRIVILEGES ] }\nON SCHEMA schema_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { CREATE | ALL [ PRIVILEGES ] }\nON TABLESPACE tablespace_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT { USAGE | ALL [ PRIVILEGES ] }\nON TYPE type_name [, ...]\nTO role_specification [, ...] [ WITH GRANT OPTION ]\n[ GRANTED BY role_specification ]\n\nGRANT role_name [, ...] TO role_specification [, ...]\n[ WITH { ADMIN | INHERIT | SET } { OPTION | TRUE | FALSE } ]\n[ GRANTED BY role_specification ]\n\n其中role_specification可以是：\n\n[ GROUP ] role_name\n| PUBLIC\n| CURRENT_ROLE\n| CURRENT_USER\n| SESSION_USER"}},"RequestedLocale":"zh-Hans","Fallback":false,"Versions":["10","11","12","13","14","15","16","17","18","19","20","6.4","6.5","7.0","7.1","7.2","7.3","7.4","8.0","8.1","8.2","8.3","8.4","9.0","9.1","9.2","9.3","9.4","9.5","9.6"],"Locales":["en","zh-Hans"],"Signatures":null,"Spellings":null,"SQLState":null,"Evidence":null}